Vulnerability management is something all businesses need to consider within their IT strategy, but the majority don’t.
When software companies push new updates, there are often weaknesses in the code that hackers can find and exploit.
Software makers then address the vulnerabilities with a security patch.
This cycle continues with each new software or hardware update that is released.
It’s estimated that about 93% of corporate networks are susceptible to external penetration, and assessing and managing these weaknesses isn’t always a priority for organisations.
Many suffer breaches because of poor vulnerability management.
“The sort of things we’ve seen over the last six to nine months like the big vulnerabilities and the big incidents, a lot of them come down to people not patching properly. And I know it’s really boring, but it is really important.” – Ian Levy, Technical Director – UK National Cyber Security Centre
Many types of attacks take advantage of unpatched vulnerabilities in software code. This includes ransomware attacks, account takeover, and other common cyberattacks.
Whenever you see the term “exploit” when reading about a data breach, that’s an exploit of a vulnerability.
Malicious individuals and sometimes state sponsored criminal groups write malicious code to take advantage of these
“loopholes.”
That code can allow them to elevate privileges, or to run system commands to perform other dangerous network intrusions.
Putting together an effective vulnerability management process can reduce your risk and protect your valuable data, systems,
and people.
It doesn’t have to be complicated.
Just follow the steps we’ve outlined below to get started, and if you need any help at all then please, just ask!
A Simple But Effective Vulnerability Management Process
Step 1. Identify Your Assets
Identifying all the devices and software that you have on your network is key to making sure you have all bases covered. You’ll want to include all devices that connect to your network, including:
- Computers
- Smartphones
- Tablets
- IoT devices
- Servers
- Cloud services
- Printers
- Machinery
- Door Access Systems
- CCTV Cameras & Equipment
- IP Phones
Vulnerabilities can appear in many places such as the code for an operating system, a cloud platform, third-party software, or in device firmware such as printers and desk-phones, so you’ll want a full inventory of all systems and endpoints within your network.
This is an important first step so you will know what you need to include in the scope of your assessment.
Step 2: Perform a Vulnerability Assessment
The next step will be to perform a vulnerability assessment scan which can be done on an ad-hoc, manual basis by an IT professional using dedicated assessment software, or automatically using a SIEM (Security Information & Events Management) system that includes Vulnerability Detection features.
During the assessment, the software scans your systems for any known vulnerabilities and the assessment tool matches found software versions against known vulnerability databases.
For example, a database may note that a particular version of Microsoft Windows Server has a vulnerability, and that you have a server running that same OS version. It will highlight and make note that it as a found weakness in your security.
Our existing clients already have vulnerability scans taking place automatically on a regular basis, which alerts our teams as soon as a vulnerability is detected. At this point remedial action can be taken on the device, or a risk assessment performed and managed accordingly.
Step 3: Prioritise Vulnerabilities by Threat Level
The assessment results provide a roadmap for mitigating network vulnerabilities.
There will usually be several, and not all are as severe as others.
You will next need to rank which ones to address first.
At the top of the list should be those experts consider severe.
Many vulnerability assessment tools will use the Common Vulnerability Scoring System (CVSS). This categorises vulnerabilities with a rating score from low to critical severity.
You’ll also want to rank vulnerabilities by your own business needs.
If a software is only used occasionally on one device, you may consider it a lower priority to address. While a vulnerability in software used on all employee devices, you may rank as a high priority.
Step 4: Remediate Vulnerabilities
Remediation often means downloading and applying an issued update or security patch, but it may also mean upgrading hardware that may be too old for you to update, and out of support with the vendor/manufacturer.
Another form of remediation may be ringfencing.
This is when you “wall off” an application or device from others in the network.
A company may do this if a scan turns up a vulnerability for which a patch does not yet exist.
Increasing advanced threat protection settings in your network can also help and once you’ve remediated the weaknesses, you should confirm the fixes by running a further scan.
Step 5: Document Activities
It’s important to document the vulnerability assessment and management process. This is vital both for cybersecurity needs and compliance.
You’ll want to document when you performed the last assessment and document all the steps taken to remediate each vulnerability.
Keeping these logs will be vital in the case of a future breach.
They can also help and inform when performing the next vulnerability assessment.
Step 6. Schedule Your Next Vulnerability Assessment Scan
Once you go through a round of vulnerability assessment and mitigation, you’re not done, as vulnerability management is an ongoing process.
As mentioned above we can perform these scans automatically taking out the burden of remembering to do them on a regular basis and our teams can alert you should anything be discovered.
In 2022, there were over 22,500 new vulnerabilities documented, and developers continue to update their software continuously. Each of those updates can introduce new vulnerabilities into your network.
It’s a best practice to have a schedule for regular vulnerability assessments.
The cycle of assessment, prioritisation, mitigation, and documentation should be ongoing which protects your network against cyberattacks and removes one of the main enablers of hackers.
Get Started with a Vulnerability Assessment
Taking the first steps towards effective vulnerability management can be daunting, but hopefully the above six steps give you a clearer understanding of what’s involved.
We are here to help strengthen your network against many types of vulnerabilities, including taking away the burden and hassle of managing this process.
If you would also like to have an understanding of your current cybersecurity position, we can help you work through a series of questions provided by the UK Government backed Cyber Essentials program, with a view to achieving Cyber Essentials Certification.
Give us a call today to learn more about vulnerability management, schedule a vulnerability assessment, or to answer any concerns or queries you may have around Cyber Security.
