Endpoint
6/21/2013
00:25 AM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Cloud Can Simplify Vulnerability Management For SMBs

Lacking security skills, most small and midsize businesses need help in locking down their information technology, including cataloging and triaging vulnerabilities

Even with a relatively small number of systems, tracking down and triaging vulnerabilities is a complex enough task that many small and midsize businesses (SMB) set their systems to automatically update software and rarely check the results.

For SMBs, finding an employee with the expertise and time to catalog the devices connected to the network and routine scan for vulnerabilities is tough, says Kiran Kumar, product manager at vulnerability management firm Qualys. Most often, companies do occasional vulnerability scanning as part of the requirements necessary to comply with security standards, such as the Payment Card Industry's Data Security Standard (PCI-DSS). But companies that want better security need to do more than that, he says.

"We all know they have very limited IT resources and time, but this is a key area that they need for security," Kumar says. "While some of them just do it for their quarterly scanning requirement, there are others that are building up a team, even with two people. They want to use this to reassure their customers and give them more security credibility."

Vulnerability and patch management are a critical part of keeping businesses and their networks safe. SMBs that rely on their firewalls and antivirus software to protect their servers and employees' systems are not doing enough: Continuously monitoring the vulnerabilities present in a company's network comes in at No. 4 on the SANS Institute's Top-20 list of critical security controls.

Enterprise-class vulnerability management is typically not well-suited for smaller businesses, but a wide variety of companies offer on-premise products that catalog a company's IT assets and then checks them for vulnerabilities. From GFI's LanGuard to VMware's vCenter Protect, and from Rapid7's Nexpose to Tenable's Nessus, the products and services run the gamut from barebones to a large feature set.

Yet a number of companies are specifically targeting SMBs and their lack of IT security knowledge with cloud services that audit networks, detect vulnerabilities, and helps companies remediate the issues.

[If the definition of insanity is doing the same thing over and over and expecting different results, then today's IT security departments may just be a little nutty about vulnerability management. See Is Vulnerability Management Broken?.]

In 2012, nCircle, now part of Tripwire, released its PureCloud offering that performs asset discovery and vulnerability assessment via a cloud service. IT management firm Kaseya has a full-features platform that includes vulnerability scanning and patch deployment. Vulnerability management firm Secunia adds patching as well, aiming to offer in a single service the ability to catalog issues and then patch the problems, according to Morten Stengaard, chief technology officer of the firm.

"We want to get to the point that, if you don't have a security team, then you can still secure your systems," Stengaard said during an interview at the RSA Security Conference earlier this year.

In July, Qualys will launch a SMB-focused version of its own vulnerability management tool, QualysGuard Express Lite. The service will scan for vulnerabilities inside the network, scan for Web application vulnerabilities externally, and product compliance reports, Qualys's Kumar says.

"Basically, we want to help them turn scanning into something that keeps on happening automatically," he says. "We want the SMBs to really focus on growing their business."

Kumar and others stress that companies should not treat vulnerability management as a compliance exercise. Recent reports suggest that companies that focus on their security -- and use the cloud to provide secure services -- have a higher level of security and more success. A study sponsored by Microsoft, for example, found that six out of 10 companies that do not use the cloud cite security concerns as a primary reason, but that 94 percent of SMBs that adopted the cloud say it improved their security posture.

In a study released this week, security firm Symantec found that 78 percent of the top-performing third of SMBs felt they were at least somewhat secure, compared to only 39 percent of the worst-performing third. In addition, losses from successful attacks were 51 percent lower than the poor performers, said Andrew Singer, director of product marketing for small business at Symantec, in an e-mail interview.

"While we didn’t ask specifically about how they deal with vulnerabilities and patch management, it stands to reason that the top-ranking SMBs who make IT a priority are better able to deal with vulnerability-related issues," he said.

In addition to taking advantage of the expertise incorporated into cloud services, SMBs should also apply patches as soon as possible and block access to all internal systems from outside the network, he said.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Robert Lemos is a veteran technology journalist of more than 16 years and a former research engineer, writing articles that have appeared in Business Week, CIO Magazine, CNET News.com, Computing Japan, CSO Magazine, Dark Reading, eWEEK, InfoWorld, MIT's Technology Review, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web