Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


10:00 AM
John Worrall
John Worrall

Application & Infrastructure Risk Management: You've Been Doing It Backward

Before getting more scanning tools, think about what's needed to defend your organization's environment and devise a plan to ensure all needed tools can work together productively.

To effectively manage cyber-risk, organizations need to gain visibility into existing application and infrastructure vulnerabilities while also learning how to manage them proactively. This can feel like an insurmountable task at times, but thankfully, the cybersecurity industry does a commendable job of sharing intelligence about the common bugs and vulnerabilities to watch.

In fact, there are organizations whose sole mission is to find zero-day vulnerabilities and other instances of malicious cyber activity, such as Google's Project Zero and the United States Computer Emergency Readiness Team (US-CERT), providing valuable resources for cyber-risk.

All this said, the reality is strikingly different. Rather than actually remediating vulnerabilities, organizations today end up spending the bulk of their time trying to make sense of conflicting and/or duplicate vulnerability data. From a risk management perspective, they are failing to establish the visibility they need. And from a financial perspective, organizations are racking up significant expenses trying to employ enough skilled people to manage these disparate tools and cover the various software licensing fees.

Consider this: Unpatched vulnerabilities remain a chronic and persistent problem; they are responsible for many of the high-profile global data breaches in recent years, with the 2018 Equifax hack and 2017 WannaCry disaster serving as prime examples. Research from the Ponemon Institute also indicates that about 60% of all organizations suffering from a data breach between 2016 and 2018 cited a known, unpatched vulnerability as the attack culprit. While these statistics should not be viewed with fear, it is worth remembering the far-reaching implications of a single vulnerability.

Wildfire-Like Growth of Vulnerability Scanning Tools Isn't All Good News
The reason unpatched vulnerabilities persist and continue to wreak havoc is relatively simple — organizations are managing their application and infrastructure risk backward. In other words, companies are focusing, first and foremost, on purchasing a slew of different tools to scan various areas of their network environment and identify problematic areas. While this may help to fill scanning gaps across the software development lifecycle (SDLC), the various tools deployed rarely produce results that are easily correlated, leaving companies with a huge pile of data that is extremely hard to take action upon.

To complicate things further, the vulnerability scanning technology market is exploding. For scanning web application vulnerabilities, just one possible component of an organization's entire environment, the Open Web Application Security Project (OWASP) lists more than 50 tools available. With this kind of aggressive market growth, organizations are overdosing on the number of vulnerability scanning tools they use—and it's not working.

Acquiring technology to shore up weak points seems like the responsible and admirable thing to do, but the sheer number of vulnerability scanning tools organizations are implementing makes keeping pace impossible. Remember, each scanning tool reports and scores risk factors differently, which means these tools may likely indicate the same vulnerability more than once. And because scanners also name or prioritize them differently, bugs and flaws can go unrecognized completely, leading to wasted resources spent investigating repeat issues.

Implementing to Ensure Tools Work Well Together Is Key
To realistically identify and remediate application and infrastructure vulnerabilities, organizations need to take a step back. Before putting any additional tools to work, assess your environment's footprint and review the ones you already have, including what they cover. Identify any vulnerability scanning overlaps, keeping in mind that every environment is unique. Only retain or implement tools your organization truly needs rather than hanging on to popular solutions that promise enviable results.

After taking stock of your environment's footprint and vulnerability scanning needs, it's important to develop a cohesive strategy for managing your scanning tools, one that is scalable and allows them to work well together. For example, to address the challenge of various tools scoring vulnerabilities differently, consider transcoding your tool output to the Common Vulnerability Scoring System (CVSS) , an industry-standard framework for ranking the characteristics of a vulnerability and its risk. To gain a more holistic view of risk, track software and infrastructure throughout their respective life cycles rather than using an individual discovery technique such as simply correlating static application security testing (SAST) and dynamic application security testing (DAST). Instead of consolidating the outputs of multiple vulnerability discovery tools in a single stream, try consolidating vulnerabilities in a view that allows developers to address a single "unit of work," such as focusing on the important issues in need of immediate remediation.

A Risk-Based Approach to Vulnerability Management Is Paramount
When organizations prioritize vulnerability scanning technology over mindfulness, they not only waste valuable resources, they also forfeit a solid understanding of their security posture. Without being able to clearly identify where they're most at risk or where they need to prioritize remediation across applications and infrastructure, it's no surprise that many organizations detect and remediate as little as 10% of vulnerabilities.

Businesses today must adhere to a risk-based approach to vulnerability management if they hope to continue the fight against perpetual cyber-risk. Before incorporating any additional scanning tools, think strategically about what's actually needed to defend your organization's unique environment and devise a plan to ensure all necessary tools can work together productively. In doing so, organizations can proactively manage their application and infrastructure risk by accurately prioritizing what's most critical and equipping themselves to take swift, decisive action every time.

Related Content:

John Worrall has more than 25 years of leadership, strategy, and operational experience across early stage and established cybersecurity brands. In his current role as CEO at ZeroNorth, he leads the company's efforts to help customers bolster security across the software life ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.
PUBLISHED: 2021-06-18
SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information.
PUBLISHED: 2021-06-18
SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information.
PUBLISHED: 2021-06-18
SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation.
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 85da504d2dc30188b89f44c3276fc5a25b31251f contains a buffer overflow which could allow attackers to obtain sensitive information.