Best Practices to Cybersecurity Vulnerability Management

Access the Recorded Session here!

Importance of threat data and intelligence

Introduction to vulnerability management activities

Common vulnerability assessment tools

Implementation of security measures

WHY VULNERABILITY ASSESSMENT?

• A vulnerability assessment is designed to identify unpatched and exploitable vulnerabilities, giving the organization the opportunity to remediate these deficiencies before they are discovered by a bad actor.

• The evolving tools, tactics and procedures used by cybercriminals to breach networks means that it's important to regularly test your organization's cyber security.

• Vulnerability assessment helps to protect your organization by providing visibility of security weaknesses and guidance to address them.

• It helps with greater security insights, ongoing risk management, and the ability to meet regulatory obligations.

VULNERABILITY ASSESSMENT VS. VULNERABILITY MGMT.

• Vulnerability management is different from vulnerability assessment.

• Vulnerability management is an ongoing process, while a vulnerability assessment is a one-time evaluation of a host or network.

• Vulnerability assessment is part of the vulnerability management process, but not vice versa.

CYBER THREAT INTELLIGENCE

• Collection and analysis of information about threats and adversaries- drawing patterns- provide an ability to make decisions – for preparedness, prevention, response- against various cyber attacks.

• Identify and mitigate various business risks- Implementing various advanced and proactive defense strategies.

• CTI is Collecting information about presumed attacks to understand their motive behind attacks- the approach they must follow- analyze this information for securing IT infrastructure of an organization in advance.

Data

Raw, huge, no context, un processed (Structured/ Unstructured)

Information

Meaningful

Intelligence

Analyzed, interpreted, In depth knowledge Supports Decision making & Response Actions

IMPORTANCE OF THREAT DATA AND INTELLIGENCE

• Threat intelligence is data that is collected, processed, and analyzed to understand a threat actor’s motives, targets, and attack behaviors.

• Threat intelligence enables us to make faster, more informed, data-backed security decisions and change their behavior from reactive to proactive in the fight against threat actors.

• Threat intelligence is evidence-based about existing or emerging menaces or hazards to assets.

• Threat intelligence benefits organizations of all shapes and sizes by helping process threat data to better understand their attackers, respond faster to incidents, and proactively get ahead of a threat actor’s next move.

• Ensure you stay up to date with the often-overwhelming volume of threats, including methods, vulnerabilities, targets and bad actors.

• Reducing risk

• Preventing financial loss

BENEFITS OF

VULNERABILITY SCORING SYSTEMS AND DATABASES

• Common Vulnerability Scoring System (CVSS)

CVSS provides an open framework for communicating

characteristics and impacts of

vulnerabilities

Its quantitative model ensures repeatable accurate measurement, while enabling users to view

vulnerability characteristics

• Common Vulnerabilities and Exposures (CVE)

• A publicly available and free-to-use list or dictionary of standardized identifiers for common software vulnerabilities and exposures

• National Vulnerability Database (NVD)

• A U.S. government repository of standards-based vulnerability management data represented using the Security Content Automation Protocol (SCAP)

• These data enable the automation of vulnerability management, security measurement, and compliance

• The NVD includes databases of security checklist references, security-related software flaws, misconfigurations, product names, and impact metrics

• Common Weakness Enumeration (CWE)

• A category system for software vulnerabilities and weaknesses

• It is sponsored by the National Cybersecurity FFRDC, which is owned by The MITRE Corporation, with support from US-CERT and the National Cyber Security Division of the U.S. Department of Homeland Security

• It has over 600 categories of weaknesses, which enable CWE to be effectively employed by the community as a baseline for weakness identification, mitigation, and prevention efforts.

VULNERABILITY

TYPES OF VULNERABILITY ASSESSMENT

Active Assessment

Passive Assessment

Assesses

Internal Assessment

Scans the internal

Host-based Assessment

Conducts a configuration-level

Network-based Assessment

Determines

Application Assessment

Tests and analyzes

network security

elements

Database Assessment

Focuses on testing

systems,

content,

TYPES OF VULNERABILITY ASSESSMENT

• Wireless Network Assessment

• Determines the vulnerabilities in

• Distributed Assessment

• Assesses the distributed organization assets,

and server applications, simultaneously through

• Credentialed Assessment

• Assesses the network by obtaining

• Non-Credentialed Assessment

machines

in the network

• Assesses the network without acquiring any credentials of the assets present in the enterprise network

• Manual Assessment

• In this type of assessment, the ethical hacker manually assesses the vulnerabilities, vulnerability ranking, vulnerability score, etc.

• Automated Assessment

• In this type of assessment, the ethical hacker employs various vulnerability assessment tools, such as Nessus, Qualys, GFI LanGuard, etc.

VULNERABILITY

TOOLS

VULNERABILITY

TOOLS

CHOOSING A VULNERABILITY ASSESSMENT TOOL

IMPLEMENTATION OF SECURITY MEASURES

• Develop a cybersecurity strategy for your organization, A cybersecurity strategy is a high-level plan for how your organization will secure its assets during the next three to five years.

• Create a detailed cybersecurity policy, A cybersecurity policy sets the standards of behavior for activities such as the encryption of email attachments and restrictions on the use of social media.

• Backup and encrypt your data.

• Use multi-factor authentication.

• Create secure passwords and keep them safe.

• Use the principle of least privilege.

• Know who is accessing your data.

• Educate and train your employees.

• Keep all software and apps up to date.

• Don’t underestimate hackers.