| 5 min read
Certainly, you are witnessing that technological environments are booming. On top of this, more and more malicious hackers are on the prowl, waiting to find holes in companies' or organizations' systems to generate damage and get benefits. For this reason, holes, flaws or vulnerabilities in your company should be detected and fixed as soon as possible. A vulnerability assessment solution can help you detect such security issues. But it is when a vulnerability assessment process is part of a broader program or solution called vulnerability management that the purpose of fixing them can be fulfilled.
At Fluid Attacks, where we offer you our Vulnerability Management solution, within our comprehensive Continuous Hacking service, we believe that every organization faithfully committed to its cybersecurity, its reputation and the welfare of its customers should implement a solution like this to root out its vulnerabilities or security issues. In this post, we give you some tips that you can take into account when choosing a vulnerability management solution since there are already plenty of them available in the market:
Asset discovery and inventory
Look for a solution that expeditiously applies an inventorying approach that allows you to have extensive knowledge of the assets of your company's digital ecosystem and the ability to monitor them. Devices, servers, operating systems, applications, containers, etc., all of them could be unexpected access points to threat actors within an attack surface. It is not enough to know which assets are present at a single moment. The discovery and inventory of assets is something that a solution should continuously do. The solution should allow you to list and manage all new assets or infrastructure that come to the environment. This way, you and your teams get complete visibility into where vulnerabilities may exist before starting to assess.
Speed coupled with accuracy
The solution to choose should offer you speed and accuracy in vulnerability detection. Refrain from assuming that vulnerability assessment is something that only automated tools should do. Vulnerability assessment can refer to both vulnerability scanning and pentesting (aka manual penetration testing). In other words, vulnerability assessment can be performed by both automated scanners and cybersecurity experts. (As we do at Fluid Attacks with our open-source scanning software and our ethical hackers.) For a comprehensive approach to your IT systems, the solution should have both assessment methods —don't stick with a solution that only involves scanners! Bear in mind that humans, namely pentesters or vulnerability analysts, are essential to keep false positive and false negative rates, which are still high for automated tools, to a minimum. Moreover, it will always be worthwhile to check that both the scanners and pentesters of the solution have specific recognitions, achievements and certifications.
Multiple and wide-ranging techniques
The cybersecurity vulnerability assessment within a proper vulnerability management solution should apply several techniques (e.g., SAST, DAST, SCA, CSPM, MPT, RE). The tool or scanner should have a well-stocked vulnerability database. In addition, there should be supporting pentesters and research teams for detecting zero-day vulnerabilities and nourishing the scanners frequently. Furthermore, human intervention would allow exploitation tests on simulated internal or external attacks to evaluate potential impacts not usually achieved by automated machines.
A single pane of glass
Your solution should allow you to define and control different assessment scopes according to your company's needs. Both assessment (with the scopes, test methods and results) and the remaining part of the management (review, prioritization, remediation and validation) should be handled from a single dashboard (e.g., Fluid Attacks' platform). Such a platform should be informative and user-friendly for both technical and non-technical personnel. It should also allow continuous risk analysis and vulnerability monitoring, with the help of multiple functionalities, details on findings, and ways of presenting and filtering information. Additionally, the platform should have well-defined access and usage privileges according to stakeholder roles.
Compliance
With the vulnerability management solution you choose, you should be able to comply with international security standards and guidelines (e.g., PCI DSS, HIPAA, GDPR, OWASP, NIST) related to, for example, appropriate security configurations, controls and testing. The solution should have as a bedrock a large number of sources in this regard. It should allow you to choose the most suitable requirements for your industry and even set your own policies. As with vulnerability databases, international security standards and guidelines should be constantly reviewed and updated as they are modified or new ones emerge. Ideally, from the dashboard mentioned in the previous tip, your company should be able to keep track of this compliance.
Continuity
Security testing is not to be done monthly, let alone quarterly. With a proper solution, you should be able to assess your systems continuously and safely, generating no disruption of services or operations. Your company's development teams keep making product modifications, improvements and updates. Also, new systems and apps are integrated into your networks as time goes by and sometimes unexpectedly and unauthorized by employees and even threat actors. New vulnerabilities arise due to all these changes, and new vulnerabilities are publicly reported in components that may be in use in your company, thus altering the threat landscape. Hence the need for continuous security testing. These guarantee up-to-date reports that facilitate remediation processes and reduce costs. Remember, it is not just a matter of listing vulnerabilities but also treating them straight away.
Prioritization
Get a solution that allows you to prioritize vulnerabilities for remediation according to their risk exposure, not only their CVSS scores or tags. These metrics come fraught with pitfalls, such as those in segmentation and aggregation (see why Fluid Attacks uses the modified metric CVSSF). For the right prioritization of security issues, historical data, exploitability, and current exploits and threats in the cyber environment should come into play. Moreover, there should be a clear contextualization, considering data, operations and technological resources at risk and possible impacts on the business concerned.
Remediation and support
The solution to choose should provide your teams with vulnerability remediation recommendations and guidelines, as well as constant support for resolving questions through various fast and effective communication channels. The support information should be delivered in terminology comprehensible to the people in charge of fixing the reported issues and be accompanied by references and even estimates, such as possible remediation time. The solution should also allow you to assign the remediation of each vulnerability to the corresponding person within your organization from the same platform where you examine, for instance, charts and figures related to the findings. Furthermore, it should offer you the possibility of temporary and indefinite acceptance of vulnerabilities that, according to your company's criteria, are not considered risky.
Remediation validation
An appropriate vulnerability management solution should allow you to validate that the remediation your team gives to a vulnerability is genuinely practical or effective. (This is something that, for example, at Fluid Attacks, we enable our clients with an unlimited supply of reattacks on vulnerabilities they report as closed or remediated). In addition, such a solution should integrate into your CI/CD pipelines an assessment mechanism that flags the presence of unaccepted vulnerabilities and even automatically interrupts their flow (i.e., break the build) to prevent such security issues from going into production.
Reports and progress
Look for a solution that allows you to easily view, customize (according to your company's needs) and download reports in various formats to share with your audiences, including development teams, security specialists, and boards of directors. Additionally, such a solution should allow you to evaluate and track your company's progress, including how it compares to other companies in risk exposure mitigation, vulnerability remediation times and other metrics relevant to your cybersecurity.
At Fluid Attacks, we always keep in mind all the aforementioned points, not just to implement them in our service but also to work on improving them, thinking about the welfare of our customers. Do you want to experience part of our Vulnerability Management solution (including our open-source scanner and platform) in a 21-day free trial? Follow this link. Do you want to be part of our clients? Just contact us.
Recommended blog posts
You might be interested in the following related posts.
