Note: This blog is part of a three-blog series on Vulnerability Intelligence that accompanies the release of Digital Shadows’ latest whitepaper titled Vulnerability Intelligence: Do You Know Where Your Flaws Are?
The numerous roadblocks facing vulnerability management (VM) teams are one of the key points raised in our vulnerability Intelligence research. Whether you work for a multinational corporation or a small company with a handful of employees, patching likely represents one of your biggest headaches. Resources, organizational structure, management approval, and outright stubbornness can all cause vulnerability teams a nightmare in getting the job done. Despite these issues, patching vulnerabilities remains one of the most important tasks for security teams in securing your technology and lowering cyber risk.
The following blog details many of these pitfalls that security teams should avoid, in addition to what Digital Shadows considers the most efficient way to conduct vulnerability management.
Too many vulnerabilities, too little time
One of the most common sentiments regarding patch management is that there is far too much to fix and in too short a time. With new vulnerabilities discovered every day, even the most proactive and efficient security teams are likely to be spinning multiple plates.
Simply patching everything isn’t an option. An effective triage system needs to be introduced to prioritize which vulnerabilities to address first. This process ultimately requires a mentality shift; instead of trying to sort as many problems as possible, focus on fixing the vulnerabilities that would cause the biggest impact if successfully exploited. This might not necessarily be a critical vulnerability, it could be a medium severity bug affecting a large percentage of your assets, or one that affects your company’s mission critical assets.
The factors that need to be considered for triage are highly dependent on each organization; analysts typically need to factor the exploitability of a vulnerability, whether a working proof of concept (POC) exploit is available in open source, and the impact that can be caused by successful exploitation. Eliminating just the exploitable vulnerabilities—even if that only represents a small fraction of the total identified vulnerabilities—can reduce a significant percentage of cyber risk.
Asset registers are an absolute necessity
The importance of asset registers isn’t restricted to VM. Knowing what assets you have in your environment is also paramount for managing security controls, audits, and incident response.attackers can’t steal your network diagrams if you don’t have any, and you also can’t patch vulnerabilities on equipment that you don’t know exist. If you’re to have any hope in mounting a realistic defense against the abundance of malicious actors of 2021, you’ll need to know what you own and are responsible for managing.
Asset registers should detail the lifecycle of every corporate asset, starting from the day they are purchased, through to disposal. This enables organizations to ensure their assets are being managed in a safe manner that fits internal goals and security standards, but also that guidelines and policies for VM are being adhered to. For vulnerability management, asset registers provide the basis for ensuring available updates are applied and knowing where to scan for vulnerabilities. In the aftermath of any major vulnerability disclosure, the immediate question is always – “are we affected by this?” With an asset register you can answer this question with authority.
Support, time, and resources: You’ll probably need all three!
Your efforts towards remediating vulnerabilities will be particularly difficult without adequate management support and time to influence change. Administrators and system owners can sometimes be prickly about updating their devices, and as highlighted by a recent report from the Ponemon Institute, a lack of cohesion between operational and IT staff can result in a failure to achieve a unified security strategy. Many may believe that taking devices offline in order to update may lose valuable work time, or have suspicions regarding the validity or necessity of an update. Some may not have adequate backup systems or fallbacks in the case of a buggy patch. These are often valid concerns, but you’ll likely run into problems if you don’t have the hard side of the carrot and stick equation to wield when necessary.
When talking resources, there’s probably a few things to mention here. Firstly, resources need to be used for implementing an efficient vulnerability management platform and there are fantastic options for companies of all sizes. We suggest that any vulnerability program worth its salt should provide the following features.
- Automatic connection and detection of all network-connected assets
- Incorporation of the business value assigned to each asset
- Insights from a range of threat intelligence feeds to provide context about CVEs
- Options for in-depth reporting and filtering of results
- Prediction of likelihood that a CVE will be exploited, via Machine Learning modelling
- Production of accurate, risk-based analytical scores for all vulnerabilities, weighted by the organization’s risk appetite and likelihood of exploitation
Java and Flash: The problem children
Ok so we’ve covered risk triage, asset management and resourcing. I’m now going to throw a slight curveball: Java and Flash players. The majority of companies will have some version of Java and or Flash enabled on their network, however due to the constant churn of updates required for both services, many users are often using older or unsafe versions.
With fake Java and Flash updates often used as phishbait in malicious campaigns, it’s understandable that many users would be hesitant to update. This problem is further confounded when considering that Java and Flash are used across multiple operating systems, and as a result threat actors can exploit vulnerabilities affecting Java and Flash on different systems. The requirement to update can also be a persistent headache for security teams, resulting in a constant game of catch up or having a disjointed deployment.
Leaving older versions of these software in place can also be particularly risky; just last month, a critical Flash player vulnerability left Adobe users open to remote code execution (RCE). While Flash player will be retired from use at the end of 2021 and can be replaced with alternate systems, Java will continue to be a headache. One potential easy solution for this is to enable Java Auto Update, which is a feature that keeps your Windows computer up-to-date with the latest Java releases. When you have auto update enabled, your system periodically checks for new versions of Java. This does require permission from the end user, so awareness is required in order to spot what is a legitimate request, and which should be avoided.
Using a risk based vulnerability management (RBVM) is the way forward
So with all these roadblocks in your way, what’s the best route to take? Digital Shadows considers taking a risk based approach to vulnerability management (RBVM)—in which organizations prioritize remediation of software vulnerabilities according to the risk they pose to the organization—as the optimum method for tackling vulnerability remediation. A RBVM process uses asset management to scope every device requiring attention, considers business context, and importantly uses up to date vulnerability intelligence to provide context. This is by far the best way to shrink your overall attack surface and enhance cyber resilience, by focussing on the bigger problems first and tackling the less severe vulnerabilities later.
We’ve recently released a fabulous research paper discussing the plaudits of vulnerability intelligence and how they can contribute towards RBVM. This includes in depth case studies of how vulnerability exploitation occurs, how zero-days and exploits are thriving on the cybercriminal economy, and steps to avoid many of the pitfalls described in this blog.
If you’re curious about how intelligence can optimize your operations, you can take Searchlight for a 7-day test drive, or contact us to discuss your specific concerns and use cases to get a demonstration of Searchlight.