As we roll back 2019, now is a good time to think about your vulnerability management plans for next year. 5N1K can help guide your actions as you decide to improve your digital security for the coming new year.
What?
Vulnerability assessments are helpful in detecting security issues in your environment. By identifying potential security vulnerabilities, your assessments help you reduce the risk of digital criminals infiltrating your systems.
However, not all vulnerability assessments are the same. Using network-based vulnerability assessments that scan the entire network for security vulnerabilities is very helpful. However, more focused assessments can be used to evaluate servers, workstations, applications, and databases for potential security issues. In addition, it is an important action not to ignore a penetration test performed by white-hat hackers by obtaining permission to question your systems and defense line while conducting a security vulnerability assessment.
Vulnerability management aims to establish a security program that formalizes the cyclical and continuous application of such testing. To set up such a program, it is necessary to assess the criticality of each asset, identify the owner of each asset, decide on the frequency of scanning and set a timeline for improvement. Discovering and inventorying the assets in the network, finding the vulnerabilities in the assets, reporting the vulnerabilities found, and determining the actions and controls to be taken against these vulnerabilities are the main steps to be followed.
Why?
You already know that vulnerability assessments are a good idea, but many organizations are required to perform periodic and ongoing vulnerability assessments and penetration testing due to regulatory or standards-based requirements. For example, organizations subject to the Payment Card Industry Data Security Standard (PCI DSS) require 6 monthly penetration and segmentation tests to maintain compliance. Additionally, Health Insurance Portability and Accountability Act (HIPAA) compliance regulations require annual risk analysis and verification of security checks. Similarly, the General Data Protection Regulation (GDPR) and the Personal Data Protection Law (KVKK) require regular security testing and evaluation.
Failure to comply with any of the regulations and frameworks mentioned above causes organizations to face heavy penalties. This is especially true when organizations are found to have not implemented appropriate security measures before being exposed to a data breach, including regular vulnerability assessments and penetration testing.
When?
You have the power to set a specific time or frequency for your audits after you have identified your standards or compliance-based requirements for the stages of the vulnerability management program outlined above, and have discovered all the assets you want to evaluate. It is desirable for organizations to have an understanding of "as often as possible" as the best goal; however, annual testing should be strictly considered the minimum. We can choose to scan for vulnerabilities semi-annually, quarterly, monthly, even continuously, so that we can decide on the scanning procedure accordingly.
Where?
A good vulnerability management program includes testing on both your internal and external networks. Differences in network architecture and security controls can have very different effects on vulnerabilities discovered. That's why it's important to understand your attack surface area for both internal and external attackers. These are the types that vulnerability assessments and penetration testers can help you find. For an even more proactive stance, you may want to consider partnering publicly with security researchers as part of your own Bug Bounty programs.
Who?
Similar to the concept of internal and external network scanning, a good vulnerability management program uses both corporate and external resources. While you may employ security personnel in your organization, in some regulations, penetration testing and vulnerability assessments must be performed by third party groups that adhere to a certain standard. Having more than one perspective in your assessment results also has a great advantage, as it helps to avoid bias and errors. Therefore, a mature vulnerability management program should include cyclical and ongoing vulnerability scanning and penetration testing with both internal and external sources. External evaluations by an unbiased third party can verify that unbiased testing has been performed and results have been interpreted correctly.
How?
We must remember that vulnerabilities and threats are constantly evolving. Therefore, we must ensure that we continually configure our vulnerability management programs to take into account our evolving security needs. One of the ways organizations can keep their vulnerability management programs flexible, changeable, and evolving is by investing in a scalable solution that provides enterprise-wide visibility. Vulnerability and risk management is an ongoing process and must continually adapt to the ever-evolving cybersecurity threat landscape. Therefore, the process should be reviewed regularly and staff should be kept informed of the latest threats and trends. Continuous improvement for people, processes and technologies will ensure the success of the enterprise vulnerability and risk management program.
