Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

12/4/2019
10:00 AM
John Worrall
John Worrall
Commentary
50%
50%

Application & Infrastructure Risk Management: You've Been Doing It Backward

Before getting more scanning tools, think about what's needed to defend your organization's environment and devise a plan to ensure all needed tools can work together productively.

To effectively manage cyber-risk, organizations need to gain visibility into existing application and infrastructure vulnerabilities while also learning how to manage them proactively. This can feel like an insurmountable task at times, but thankfully, the cybersecurity industry does a commendable job of sharing intelligence about the common bugs and vulnerabilities to watch.

In fact, there are organizations whose sole mission is to find zero-day vulnerabilities and other instances of malicious cyber activity, such as Google's Project Zero and the United States Computer Emergency Readiness Team (US-CERT), providing valuable resources for cyber-risk.

All this said, the reality is strikingly different. Rather than actually remediating vulnerabilities, organizations today end up spending the bulk of their time trying to make sense of conflicting and/or duplicate vulnerability data. From a risk management perspective, they are failing to establish the visibility they need. And from a financial perspective, organizations are racking up significant expenses trying to employ enough skilled people to manage these disparate tools and cover the various software licensing fees.

Consider this: Unpatched vulnerabilities remain a chronic and persistent problem; they are responsible for many of the high-profile global data breaches in recent years, with the 2018 Equifax hack and 2017 WannaCry disaster serving as prime examples. Research from the Ponemon Institute also indicates that about 60% of all organizations suffering from a data breach between 2016 and 2018 cited a known, unpatched vulnerability as the attack culprit. While these statistics should not be viewed with fear, it is worth remembering the far-reaching implications of a single vulnerability.

Wildfire-Like Growth of Vulnerability Scanning Tools Isn't All Good News
The reason unpatched vulnerabilities persist and continue to wreak havoc is relatively simple — organizations are managing their application and infrastructure risk backward. In other words, companies are focusing, first and foremost, on purchasing a slew of different tools to scan various areas of their network environment and identify problematic areas. While this may help to fill scanning gaps across the software development lifecycle (SDLC), the various tools deployed rarely produce results that are easily correlated, leaving companies with a huge pile of data that is extremely hard to take action upon.

To complicate things further, the vulnerability scanning technology market is exploding. For scanning web application vulnerabilities, just one possible component of an organization's entire environment, the Open Web Application Security Project (OWASP) lists more than 50 tools available. With this kind of aggressive market growth, organizations are overdosing on the number of vulnerability scanning tools they use—and it's not working.

Acquiring technology to shore up weak points seems like the responsible and admirable thing to do, but the sheer number of vulnerability scanning tools organizations are implementing makes keeping pace impossible. Remember, each scanning tool reports and scores risk factors differently, which means these tools may likely indicate the same vulnerability more than once. And because scanners also name or prioritize them differently, bugs and flaws can go unrecognized completely, leading to wasted resources spent investigating repeat issues.

Implementing to Ensure Tools Work Well Together Is Key
To realistically identify and remediate application and infrastructure vulnerabilities, organizations need to take a step back. Before putting any additional tools to work, assess your environment's footprint and review the ones you already have, including what they cover. Identify any vulnerability scanning overlaps, keeping in mind that every environment is unique. Only retain or implement tools your organization truly needs rather than hanging on to popular solutions that promise enviable results.

After taking stock of your environment's footprint and vulnerability scanning needs, it's important to develop a cohesive strategy for managing your scanning tools, one that is scalable and allows them to work well together. For example, to address the challenge of various tools scoring vulnerabilities differently, consider transcoding your tool output to the Common Vulnerability Scoring System (CVSS) , an industry-standard framework for ranking the characteristics of a vulnerability and its risk. To gain a more holistic view of risk, track software and infrastructure throughout their respective life cycles rather than using an individual discovery technique such as simply correlating static application security testing (SAST) and dynamic application security testing (DAST). Instead of consolidating the outputs of multiple vulnerability discovery tools in a single stream, try consolidating vulnerabilities in a view that allows developers to address a single "unit of work," such as focusing on the important issues in need of immediate remediation.

A Risk-Based Approach to Vulnerability Management Is Paramount
When organizations prioritize vulnerability scanning technology over mindfulness, they not only waste valuable resources, they also forfeit a solid understanding of their security posture. Without being able to clearly identify where they're most at risk or where they need to prioritize remediation across applications and infrastructure, it's no surprise that many organizations detect and remediate as little as 10% of vulnerabilities.

Businesses today must adhere to a risk-based approach to vulnerability management if they hope to continue the fight against perpetual cyber-risk. Before incorporating any additional scanning tools, think strategically about what's actually needed to defend your organization's unique environment and devise a plan to ensure all necessary tools can work together productively. In doing so, organizations can proactively manage their application and infrastructure risk by accurately prioritizing what's most critical and equipping themselves to take swift, decisive action every time.

Related Content:

John Worrall has more than 25 years of leadership, strategy, and operational experience across early stage and established cybersecurity brands. In his current role as CEO at ZeroNorth, he leads the company's efforts to help customers bolster security across the software life ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16029
PUBLISHED: 2020-01-26
A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service (DoS) condition of the web interface. Th...
CVE-2020-3115
PUBLISHED: 2020-01-26
A vulnerability in the CLI of the Cisco SD-WAN Solution vManage software could allow an authenticated, local attacker to elevate privileges to root-level privileges on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabi...
CVE-2020-3121
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplie...
CVE-2020-3129
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Unity Connection Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker c...
CVE-2020-3131
PUBLISHED: 2020-01-26
[CVE-2020-3131_su] A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to exploit this vulnerability. The vulnerability i...