Vulnerability Management: Build Strong CyberSecurity Defense

Asset discovery and mapping scans

What are the benefits of vulnerability management?

• Provides threat context for vulnerabilities

• Empowers teams to reduce the greatest amount of risk with least amount of effort

• Provides comprehensive visibility into all vulnerabilities across your entire attack surface

• Aligns cyber risk with business risk so you can make more informed business and cybersecurity decisions

• Facilitates benchmarking and reporting about program success

• Helps communicate cyber risk to key stakeholders in business context

• Reduces reactive security measures

• Eliminates blind spots created by legacy vulnerability management processes

• Enables teams to focus on the 3% of vulnerabilities that pose greatest organizational risk

Differences between internal and external scans

How is vulnerability management different from risk-based vulnerability management?

Traditional vulnerability management practices give you a high-level view of vulnerabilities and risks. They uncover threats a vulnerability could introduce. However, legacy processes don’t give you true insight into your threat landscape.

If your teams don't understand risk in context, they may waste time on vulnerabilities that aren't a threat. They can miss finding and fixing risky vulnerabilities more likely to negatively impact your organization.

Credentialed and non-credentialed scans

What is a vulnerability scanner?

A vulnerability scanner is an automated tool that discovers vulnerabilities across your attack surface.

Types of vulnerability scans:

• Credentialed scans use login credentials to discover detailed information about security issues within an asset, system or network.

• Non-credentialed scans do not need credentials and target open ports, protocols and exposed host services.

• Internal vulnerability scans performed inside your organization discover how attackers can move through your network, including gaining an initial foothold in Active Directory to facilitate lateral movement through your environments.

• External vulnerability scans performed outside your network discover security weaknesses.

• Network-based scans are for devices such as firewalls, routers, servers and network applications.

• Web app scans find security weaknesses in apps.

• Cloud-based scans evaluate cloud environments like AWS, GCP and Azure for security issues.

• Host-based scans check single devices or hosts for vulnerabilities.

Active and passive scanning methods

What is asset discovery and how can it mature my vulnerability management program?

Asset discovery identifies and tracks hardware, software, network devices and cloud resources. It helps teams:

• Identify critical assets and understand their role in mission-critical operations

• Know which assets are most vulnerable to cyberattacks

• Expose overlooked or missed vulnerabilities that create security gaps

• Prioritize remediation

• Find and assess shadow assets IT teams may not be aware of

• Ensure compliance to legal, regulatory and contractual requirements

Popular vulnerability scanning tools (Nessus, OpenVAS)

What is vulnerability assessment?

A vulnerability assessment is a way to know, expose and close vulnerabilities across your enterprise. It uses a variety of scanning tools and techniques to find security weaknesses such as missing patches, misconfigurations and out-of-date operating systems, software and firmware.

These assessments go beyond identifying vulnerabilities. They provide context and threat intelligence to prioritize and develop remediation strategies. This is a proactive approach to decrease the likelihood of a cyberattack.

Scheduling, Operations, Performance, Sensitivity levels, Segmentation, Regulatory requirements

Vulnerability scoring and prioritization

Vulnerability prioritization and scoring work together to inform remediation. Scoring assesses each vulnerability based on impact potential. Prioritization draws on scoring but goes further and also considers if the exploit exists in the wild, how likely an attacker may exploit the vulnerability in the near term and business impact. These prioritization factors can help teams plan which security issues to focus on first because they have the greatest chance of directly impacting your organization. Used together, vulnerability scoring and prioritization can reduce risk.

Differences, advantages, and disadvantages between agent-based and agentless scanning.

Why is vulnerability prioritization important?

Vulnerability prioritization, or risk prioritization, is important because it helps teams get their arms around which vulnerabilities need attention immediately and which ones can be delayed until later. Without it, teams don’t have context to understand which of the thousands of potential vulnerabilities they should fix first.

Without prioritization, security teams spin their wheels in a constant loop of reactive security. Approaching vulnerability management without prioritization is inefficient, gobbles up resources and funds, and does little to reduce risk.

Comparison of static and dynamic analysis methods, usage scenarios.

What are common challenges of vulnerability prioritization?

• Too much vulnerability data with too little context

• Too many alerts

• Too many false positives and false negatives

• Poor scoring makes it difficult to know which vulnerabilities are high-risk and which aren’t pressing

• Lack of understanding how cyber risk relates to business risk

• Issues identifying all assets and understanding which are critical to operational resilience

• Challenges hiring skilled security professionals

• Budget constraints

• Disparate vulnerability management tools that silo data

• Rapidly evolving threat landscape

Analysis of vulnerability assessment tools

What are the benefits of prioritizing vulnerabilities for remediation?

• Targeted, more efficient remediation processes

• Actionable risk reduction using fewer resources and expenses

• Faster remediation of critical vulnerabilities

• Decreased chance of cyberattacks

• Increased operational effectiveness

• Increased compliance confidence

• Ability to align cyber risk with business risk tolerance and organizational goals

• Improved cyber hygiene

• Stronger security posture

Network scanning and mapping tools (Nmap, Angry IP Scanner, Maltego)

What are common vulnerabilities and exposures (CVEs) and how are they used?

Common vulnerabilities and exposures (CVEs) are industry recognized identifiers for known security vulnerabilities that MITRE identified and listed in its CVE database. MITRE assigns each CVE a year and corresponding CVE number. Each CVE also includes other important information such as a name, description and potential exploit impact. There are more than 264,000 CVEs in the database.

A CVE standardizes how organizations track vulnerability data across multiple tools and technologies. Vulnerability scanners, for example, can use CVE data to elaborate on a vulnerability and guide remediation efforts.

Web application scanners (Burp Suite, ZAP, Arachni, Nikto)

What is VPR?

A VPR, or vulnerability priority rating, is a Tenable-based vulnerability scoring tool. Unlike the Common Vulnerability Scoring System (CVSS), VPR takes into consideration real-time threat intelligence, asset criticality, exploit activity in the wild and other factors to guide which vulnerabilities pose the greatest threat based on risk profile and attack surface. VPRs are not static. Tenable updates the VPR systems as new threat intelligence emerges.

Compared to VPR, CVSS returns a mountain of vulnerabilities listed as critical or high. Yet, security teams don’t actually need to find and fix every one. Not every vulnerability poses an actual risk. The key to VPR is understanding which vulnerabilities attackers may most likely exploit based on your attack surface and other factors.

Vulnerability scanners (Nessus, OpenVAS)

What is a network monitor and how does it help manage vulnerabilities?

A network vulnerability monitor discovers vulnerabilities and other security issues within your traditional IT infrastructure, including:

• Networks

• Servers

• Operating systems

• Applications

Web application scanners are similar, but work with third-party applications and to test in-house apps.

Multipurpose tools (Metasploit, Recon-ng)

Nessus Network Monitor

Nessus Network Monitor (NNM) passively analyzes network traffic to eradicate blind spots. NNM is a safe and non-intrusive way to manage sensitive systems.

Tenable Vulnerability Management and Tenable Security Center include Nessus Network Monitor as a sensor.

Cloud infrastructure assessment with tools such as Scout Suite, Prowler, Pacu.

What is patch management?

Patch management is a process to update systems and software to reduce cyber exposures.

Challenges for patch installation prioritization:

• The volume of systems and applications within your attack surface

• Vendors constantly releasing new patches

Patching priorities should align with a vulnerability risk rating. If your scoring system ranks a vulnerability high or critical, start there. Then, work your way through lower-ranking vulnerabilities.

Use of debugging tools such as Immunity Debugger, GNU Debugger (GDB).

What is vulnerability management in the cloud?

Vulnerability management in the cloud involves identifying, prioritizing and remediating security risks within cloud environments. The cloud is dynamic. Resources are constantly provisioned and deprovisioned so traditional security practices don’t always work.

To ensure effectiveness of your cloud vulnerability management program, use cloud-native tools like a CNAPP, to help security teams maintain visibility, detect misconfigurations and quickly respond to potential threats in public, private and hybrid cloud environments.

CVSS scoring and classification of vulnerabilities(Attack vectors, Attack complexity, Privileges required, User interaction, Scope)

What are common vulnerabilities in cloud environments?

Cloud environment vulnerabilities often contain misconfigurations, unpatched software and insecure APIs. Other common cloud vulnerabilities include overly permissive storage access, exposed services and improper identity and access management (IAM) configurations.

Vulnerability validation processes (True/False Positives-Negatives)

How do cloud vulnerabilities differ from on-prem vulnerabilities?

Unlike static on-prem systems and software, the cloud often has frequent changes in configurations, instances and services. This makes traditional vulnerability management practices, like periodic manual scans, insufficient for the cloud.

Context awareness and exploitability potential(Internal, External, Isolated)

Vulnerability management in AI environments

AI applications and services introduce new and complex security risks, including adversarial attacks, where threat actors manipulate data to mislead AI models into producing incorrect outputs.

AI security attacks can distort machine learning models so they behave unpredictably.

Prioritizing vulnerabilities and risk management(Confidentiality, Integrity, Availability)

How do I manage vulnerabilities in AI systems?

To manage vulnerabilities in AI systems, use a vulnerability management tool that continuously monitors these environments. Conduct risk assessments to find AI security issues.

Assessing how easily the vulnerabilities can be exploited (exploitability) and used as an attack tool (weaponization)

How does AI affect vulnerability management?

AI systems can automate vulnerability scanning, prioritize risks and suggest remediation based on threat intelligence. However, they must be secure to prevent them from becoming attack vectors.

Leveraging AI to enhance security controls can improve program efficiency, but requires careful attention to secure AI models and infrastructure.

Asset value evaluation and its impact on vulnerability management.

Which AI vulnerability management tools are available?

AI tools such as Tenable Vulnerability Management provide comprehensive solutions for vulnerability management in AI environments. They include features like API security assessments and machine learning risk analysis. Tenable can help manage vulnerabilities across the entire AI lifecycle, from development to deployment.

Methods to mitigate software vulnerabilities (Cross-site scripting: Reflected, Persistent - Overflow vulnerabilities: Buffer, Integer, Heap, Stack)

Common attack vectors and control measures (XSS, Injection Flaws, cryptographic failures, and compensating controls)

Patch management and configuration processes (Patching processes such as testing, implementation, rollback, and validation)

Principles of risk management in vulnerability handling(Risk management principles, Attack surface management)

Data poisoning attacks and protection methods.

Common attack types such as Broken Access Control, Directory Traversal, Cross-Site Request Forgery (CSRF).

Security vulnerabilities that may arise from incorrect configuration of systems

Security risks created by systems that are not updated(End-of-life or outdated components)

Vulnerabilities caused by authentication and identification errors

In this lesson we will talk about Security vulnerabilities that may occur on the server and client side

Remote code execution vulnerabilities, Privilege escalation attacks

Zero-day vulnerabilities and attack methods

Vulnerability management in cloud environments (Security Baseline Scanning and Industry Frameworks)

Payment Card Industry Data Security Standard (PCI DSS), Center for Internet Security (CIS) benchmarks, Open Web Application Security Project (OWASP), International Organization for Standardization (ISO) 27000 series

Vulnerabilities in industrial control systems and SCADA(Critical infrastructure: Operational technology (OT), Industrial control systems (ICS), Supervisory control and data acquisition (SCADA))

Vulnerability response process and steps

Post-vulnerability assessment reporting

Managerial, Operational, Technical, Preventative, Detective, Responsive, Corrective

This lesson covers maintenance windows and managing exceptions.

This course covers vulnerability management topics related to policies and service level objectives.

It covers vulnerabilities prioritization and emergency response processes.

Security measures and vulnerability management in the software development process

Input validation, Output encoding, Session management, Authentication, Data protection, Parameterized queries

In this lesson we will talk about threat modeling

What is vulnerability management?

Vulnerability management, a subdomain of IT risk management, is the continuous discovery, prioritization and resolution of security vulnerabilities in an organization’s IT infrastructure and software.