The Cyber Files: Proactive Vulnerability Management

In a world not so dissimilar to the shadowy, cryptic realms of "The X-Files," where the unknown lurks behind every digital corner, the imperative for proactive vulnerability management has never been more acute. Imagine, if you will, an unseen digital landscape teeming with vulnerabilities—each one a potential doorway for adversaries whispering "Trust no one," especially not your unpatched software or outdated systems. In this realm, the truth is not out there; it's buried in the code and configurations that run our digital lives. As Mulder and Scully tirelessly sought to unveil hidden truths amidst a sea of conspiracy, so too must organizations embark on their quest to uncover and remediate vulnerabilities before they manifest into cyber threats of potentially extraterrestrial proportions.

Yet, as we navigate this digital X-File, a strategy as dynamic and elusive as the show's shape-shifting antagonists is required. Proactive vulnerability management is not merely a task for the IT department; it's a critical mission for the survival and resilience of the modern enterprise, a mission where humor is our flashlight in the dark, guiding us through the complexities and challenges with a knowing smile. After all, in the fight against vulnerabilities, one must remember that a day without laughter (or a patched system) is a day wasted in the eyes of cyber adversaries.

So, buckle up, dear reader. We're not just closing security loopholes; we're embarking on a thrilling adventure, one that demands our wits, courage, and perhaps a fondness for sunflower seeds. Let's decode this mystery together, with all the seriousness it demands and the wit it deserves, because, in the end, the future of our digital universe may well depend on our ability to manage the unmanageable.

My infatuation with the X-Files aside, I will also use Sun Tzu quotes sprinkled throughout the article because I think at the heart of Vulnerability management is the first part that Sun Tsu spoke about, “Know Thy Self” So that means diving deep into asset management and overall data life cycle.

It starts with Asset Identification and Classification

Before we delve into the fundamentals and strategic implementation of your Vulnerability Management Team (VMT), it is crucial to revisit a fundamental question. Although I have touched upon this topic in previous articles, its significance warrants ongoing emphasis. Let’s keep the explanation straightforward.

What exactly is an asset? An asset could be a physical entity like your building, or digital such as laptops, mobile phones, or proprietary software. It's important to recognize that not all assets are created equal; the impact of losing or damaging some can be much more severe than others. This is why classifying each asset is essential. You must maintain near-perfect accountability of all your assets, including procedures. Without this, your security posture is compromised. After all, how can you protect what you are unaware of? To simplify, effective asset management and classification are not just operational necessities; they are the cornerstones of a robust security program.

The next foundational component is the Early Stages of Risk Management

In this step, it's critical to recognize that key pillars within your cybersecurity program should fall under the leadership of a single individual or a designated organizational structure. We'll explore this further later, but for now, let’s discuss risk management terms:

• Cyber Threat Actors (CTA): These can include cybercriminals, nation-states, hacktivists, insiders, or a hybrid of these groups.
• Threats: Any danger that arises from CTAs.
• Vulnerabilities: Weaknesses in systems, procedures, people, or processes that CTAs can exploit.

Risk Equation: Risk = Vulnerability × Threat

Note: While the impact and probability of vulnerabilities and threats are also crucial, for simplicity, we are focusing on just two variables. Remember, threats can also be external, including natural disasters.

With this framework, you have compiled a complete inventory of your assets and classified them accordingly. You also have a deep understanding of the cyber threat actors relevant to your organization, along with detailed knowledge of their techniques, tactics, and procedures. Now, you have a solid foundation to initiate your vulnerability management program.

Understanding Vulnerability Management

Let’s start with a basic definition. According to Destination CISSP, “Vulnerability Management is the cyclical process of identifying, classifying, prioritizing, and mitigating vulnerabilities within a cybersecurity framework.” But what exactly does this mean in practice?Consider this scenario: your organization’s primary payment processing software was recently exploited due to a coding flaw. Fortunately, the vendor responded promptly, addressing the vulnerability with an update to rectify the exploit. This incident highlights the importance of staying vigilant and responsive to software vulnerabilities.

How to Detect Vulnerabilities

To uncover vulnerabilities, organizations commonly employ automated tools known as vulnerability scanners. These tools come in various forms, but let's focus on two primary types of vulnerability scans:

1. Credential Scans: These scans require user credentials (username and password) to access and assess the system more thoroughly, minimizing false positives.
2. Non-Credential Scans: These identify more obvious vulnerabilities or weaknesses in systems or applications but carry a higher risk of generating false positives.

For particularly sensitive systems, manual scans might be necessary to avoid disrupting operational integrity.

Responding to Vulnerabilities

When vulnerabilities are detected, automated scanners can quickly pinpoint new security risks. Additionally, it’s crucial for your Cyber Threat Intelligence (CTI) Team to determine whether prominent threat actors are exploiting these vulnerabilities in their attacks.

Types of Scanning Technologies

To comprehensively manage vulnerabilities, organizations utilize various scanning technologies:

1. Network-Based Scanning: Focuses on identifying vulnerabilities in the network infrastructure.
2. Host-Based Scanning: Scans individual devices or hosts within your network for vulnerabilities.
3. Wireless Network Scanning: Targets vulnerabilities specific to wireless networks, which can be particularly prone to security breaches.

This overview is an extremely high-level perspective of VM. But by understanding and implementing these different scanning methods, organizations can ensure a robust defense against potential cyber threats, maintaining the integrity and security of their systems.

Report and Scoring

Before diving into vulnerability scoring systems, it's crucial to understand Common Vulnerabilities and Exposures (CVEs). CVEs provide a standardized identifier for known vulnerabilities, enabling vendors and network defenders to communicate more effectively. This contrasts with the varied naming conventions used by cybersecurity vendors for Cyber Threat Actors (CTAs), which are often driven by marketing strategies and creates more problems than it solves.

Key Scoring Systems for Vulnerabilities

There are primarily two recognized systems for scoring or ranking the severity of vulnerabilities identified by scanners:

1. Common Vulnerability Scoring System (CVSS): This industry-standard system assesses the severity of security vulnerabilities, assigning scores from 0 to 10. These scores help network defenders prioritize actions based on the potential impact of each vulnerability.
2. Exploit Prediction Scoring System (EPSS): EPSS estimates the likelihood of a vulnerability being exploited in the wild, using a percentage scale from 0% to 100%. This helps organizations assess the exploitability risk of vulnerabilities.

In my posts, I strive to remain vendor- and framework-agnostic, recognizing that there are multiple scoring systems available beyond CVSS and EPSS. Ultimately, the choice of a vulnerability scoring framework should align with your organization’s existing policies, standards, and procedures. Select a system that addresses your specific security needs and enhances your defensive posture.

Dealing with High Volumes of Vulnerabilities

Ranking vulnerabilities is crucial, but it's equally important to incorporate your CTI team into this process. Remember, while your Vulnerability Management Team focuses on the "know thyself" aspect, reminiscent of Sun Tzu’s philosophy, your CTI team is tasked with understanding external threats or “know thy enemy”.

In today’s dynamic cyber threat landscape, every new headline about vulnerabilities or data breaches adds to an already overwhelming pile of data. It's impossible to address everything, and when everything seems like a priority, effectively, nothing is. This is where your CTI team plays a critical role—they help filter out the noise, enabling you to focus on the threats that pose a real risk to your network.  Consider the case of Stuxnet, a cyber weapon targeted specifically at the Iranian network within the Natanz Nuclear facility. While it caused a global paranoia among CEOs and security professionals, a well-informed CTI team would recognize that the specific nature of Stuxnet posed no threat to other networks, advising focus elsewhere on more pertinent threats.

Moreover, the process of reviewing, testing, and deploying patches through effective patch management, under the broader umbrella of Configuration Management, is crucial. Accountability is key—without responsible teams dedicated to timely patch updates, the entire security infrastructure risks collapse.

Given the dual necessity of understanding both internal capabilities and external threats, I believe that your VMT should ideally fall under the leadership of your CTI function. This structure ensures that your organization effectively embodies Sun Tzu’s strategy: “Know Thyself + Know Thy Enemy = 100% victory on the battlefield.”

Reporting and Metrics

It’s interesting to note that Mulder and Scully never seemed to spend time documenting their paranormal investigations for their leadership to review and assess the value of their work. Similarly, in the realm of cybersecurity, it is essential to not just conduct activities but also to report on the effectiveness of your VMT.

Too often, both in government and private sectors, I have witnessed a deluge of data and complex diagrams presented to senior executives. These are usually as unintelligible as if they were detailing encounters with the supernatural:

Instead of focusing on the sheer volume of remediated vulnerabilities—which can sometimes number in the millions—it's more impactful to consider the significance of the vulnerabilities addressed. Quality over quantity is the philosophy that should guide these efforts.

Furthermore, Asking “So what?” becomes essential. For example, if your team remediated 2 million vulnerabilities last year, how many of those were high-risk issues actively exploited by threat actors of concern? This perspective shifts the focus from overwhelming numbers to strategic impact, emphasizing that less can indeed be more.

Effective documentation and communication about the value and impact of the VMT's work are as crucial as the technical remediation efforts themselves. This approach ensures that senior leadership can appreciate and support the cybersecurity efforts based on their strategic importance, not just their operational output.

Closing

This article primarily discusses the cybersecurity measures large corporations should implement to protect both our data and their own sensitive information. Small to medium-sized businesses (SMBs), however, often face distinct challenges due to limited resources. Unlike large corporations, SMBs typically do not have the capability to establish dedicated CTI or VMTs. Instead, these responsibilities usually fall to the few IT personnel they might have.

Nevertheless, it is critical for SMBs to develop formal procedures for regularly updating all their computer software, mobile applications, and network equipment, such as routers and modems. While many computer and mobile devices automatically handle updates, it is essential for SMBs to actively manage this process. Conduct a comprehensive inventory of all your software programs, and institute a routine check every Monday for new updates. Once a process is established, make it a consistent habit.

Moreover, SMBs should embrace the somewhat pessimistic yet pragmatic motto from the X-Files: "Trust No One." This means maintaining a healthy skepticism about network access and privileges, ensuring that security is not just a technical task but a fundamental aspect of the business culture.

#Cybersecurity #VulnerabilityManagement #ThreatIntelligence #CTIRevolution #Assetmanagement #Patchmanagement #configurationmanagement #SMBs #thetruthisoutthere #trustnoone #Xfiles

Benjamin Edelen Dewayne Hart CISSP, CEH, CNDA, CGRC, MCTS Will Salha Patricia Philippeaux 🔒Ivette B. Juan M. Vasquez Sherry P. Caroline Sanchez Crozier Donald Wong Ben Ouano Mark Davenport, M.S., CISSP Isabella Stoufer Andrea Borrego