Success Factors for Efficient Vulnerability Management

There is no one-size-fits-all solution for risk-based vulnerability management, but several success factors can help to efficiently manage your company’s attack surface.

This may seem obvious, but it is essential to have a clear and agreed-upon definition of what risks a company is trying to mitigate. Working with a risk definition that captures organizational needs has some benefits.

Keeping an up-to-date inventory of all IT assets is essential, as we can only protect what we know we have. Combining vulnerability data with asset inventory information allows us to monitor that our vulnerability management program covers all our assets or, conversely, helps to quickly identify what needs to be added. Moreover, asset inventory information can add much-needed context. For example, software version information allows us to automatically derive vulnerabilities associated with the installation, and information about whether a system is internet-facing and/or contains sensitive data tells us about the likelihood and impact associated with a remediation task.  

It is unrealistic that we will ever reach a state where all known vulnerabilities have been remediated or mitigated. New vulnerabilities are reported daily. As a result, the number of open remediation tasks we have to manage is outpacing our ability to close them successfully. As we do not have an unlimited budget, we’ll need to decide what the so-called “biggest bang for the buck” is on any given day. A good prioritization approach takes multiple factors into account, starting with asset value, the severity of vulnerabilities associated with the asset, the type of attack that could be used to exploit them, the likelihood of an attack being successful, and the potential impact of a successful attack or known exploits.

A swim-lane diagram describes a well-defined process. It combines the depiction of process steps with information about who is responsible for each step. It is vital to understand who the participants are in terms of knowing the actual people who could be contacted to plan remediation efforts, get change approvals, implement remediation actions, and so on. Without known and documented contacts, nobody is responsible for any task, and nothing will ever get done.

Vulnerability management is repetitive: we analyze new data, prioritize remediation tasks, implement remediation actions, and verify that the change was successful – over and over again. Along the way, we need to document information, create various reports for all the different stakeholders we deal with, and measure our process performance to determine what to optimize to increase our efficiency. Employees’ time is not spent well on repetitive tasks, such as manually comparing scan results between two different points in time with spreadsheets or the like has no value for the company. It is just busy work. To be successful in vulnerability management while on a budget means that busy work has to be cut out or, rather, automated. Every task an employee managing vulnerabilities has to manage should either be entirely automated to save costs and time or facilitated to the level that the employee can quickly get it done. (Here I’d like to point out that Arvato Systems can provide you with software meant for the job – VAREDY is our vulnerability management platform, a custom-tailored tool that helps companies to close vulnerabilities faster and to reduce costs attached. Feel free to contact us if you want to learn more!)

Vulnerability management is an ongoing process, not a one-time event. We should continuously monitor our risks and adjust the process as necessary to ensure that we effectively mitigate our company's most important risks. Continuously managing risks across the organization also means, in practical terms, that we should strive for the single-pane-of-glass approach that quickly provides us with the relevant data, reports, KPIs, etc., and allows us to manage vulnerabilities in a standardized way, vendor-agnostic. Unquestionably, switching between different tools and data sets is busy work in itself, so might as well cut it out too.

In summary, a certain level of preparation is required to succeed with risk-based vulnerability management. It takes a defined policy and process to steer vulnerability remediation efforts and minimize the attack surface sustainably. Automation is key when faced with a large, distributed IT landscape. And last but not least, discipline and perseverance to continuously optimize the process are essential to excel. If done right, vulnerability management can be a cost-effective measure to reduce the likelihood or potential impact of costly security incidents!