Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

12/4/2019
10:00 AM
John Worrall
John Worrall
Commentary
50%
50%

Application & Infrastructure Risk Management: You've Been Doing It Backward

Before getting more scanning tools, think about what's needed to defend your organization's environment and devise a plan to ensure all needed tools can work together productively.

To effectively manage cyber-risk, organizations need to gain visibility into existing application and infrastructure vulnerabilities while also learning how to manage them proactively. This can feel like an insurmountable task at times, but thankfully, the cybersecurity industry does a commendable job of sharing intelligence about the common bugs and vulnerabilities to watch.

In fact, there are organizations whose sole mission is to find zero-day vulnerabilities and other instances of malicious cyber activity, such as Google's Project Zero and the United States Computer Emergency Readiness Team (US-CERT), providing valuable resources for cyber-risk.

All this said, the reality is strikingly different. Rather than actually remediating vulnerabilities, organizations today end up spending the bulk of their time trying to make sense of conflicting and/or duplicate vulnerability data. From a risk management perspective, they are failing to establish the visibility they need. And from a financial perspective, organizations are racking up significant expenses trying to employ enough skilled people to manage these disparate tools and cover the various software licensing fees.

Consider this: Unpatched vulnerabilities remain a chronic and persistent problem; they are responsible for many of the high-profile global data breaches in recent years, with the 2018 Equifax hack and 2017 WannaCry disaster serving as prime examples. Research from the Ponemon Institute also indicates that about 60% of all organizations suffering from a data breach between 2016 and 2018 cited a known, unpatched vulnerability as the attack culprit. While these statistics should not be viewed with fear, it is worth remembering the far-reaching implications of a single vulnerability.

Wildfire-Like Growth of Vulnerability Scanning Tools Isn't All Good News
The reason unpatched vulnerabilities persist and continue to wreak havoc is relatively simple — organizations are managing their application and infrastructure risk backward. In other words, companies are focusing, first and foremost, on purchasing a slew of different tools to scan various areas of their network environment and identify problematic areas. While this may help to fill scanning gaps across the software development lifecycle (SDLC), the various tools deployed rarely produce results that are easily correlated, leaving companies with a huge pile of data that is extremely hard to take action upon.

To complicate things further, the vulnerability scanning technology market is exploding. For scanning web application vulnerabilities, just one possible component of an organization's entire environment, the Open Web Application Security Project (OWASP) lists more than 50 tools available. With this kind of aggressive market growth, organizations are overdosing on the number of vulnerability scanning tools they use—and it's not working.

Acquiring technology to shore up weak points seems like the responsible and admirable thing to do, but the sheer number of vulnerability scanning tools organizations are implementing makes keeping pace impossible. Remember, each scanning tool reports and scores risk factors differently, which means these tools may likely indicate the same vulnerability more than once. And because scanners also name or prioritize them differently, bugs and flaws can go unrecognized completely, leading to wasted resources spent investigating repeat issues.

Implementing to Ensure Tools Work Well Together Is Key
To realistically identify and remediate application and infrastructure vulnerabilities, organizations need to take a step back. Before putting any additional tools to work, assess your environment's footprint and review the ones you already have, including what they cover. Identify any vulnerability scanning overlaps, keeping in mind that every environment is unique. Only retain or implement tools your organization truly needs rather than hanging on to popular solutions that promise enviable results.

After taking stock of your environment's footprint and vulnerability scanning needs, it's important to develop a cohesive strategy for managing your scanning tools, one that is scalable and allows them to work well together. For example, to address the challenge of various tools scoring vulnerabilities differently, consider transcoding your tool output to the Common Vulnerability Scoring System (CVSS) , an industry-standard framework for ranking the characteristics of a vulnerability and its risk. To gain a more holistic view of risk, track software and infrastructure throughout their respective life cycles rather than using an individual discovery technique such as simply correlating static application security testing (SAST) and dynamic application security testing (DAST). Instead of consolidating the outputs of multiple vulnerability discovery tools in a single stream, try consolidating vulnerabilities in a view that allows developers to address a single "unit of work," such as focusing on the important issues in need of immediate remediation.

A Risk-Based Approach to Vulnerability Management Is Paramount
When organizations prioritize vulnerability scanning technology over mindfulness, they not only waste valuable resources, they also forfeit a solid understanding of their security posture. Without being able to clearly identify where they're most at risk or where they need to prioritize remediation across applications and infrastructure, it's no surprise that many organizations detect and remediate as little as 10% of vulnerabilities.

Businesses today must adhere to a risk-based approach to vulnerability management if they hope to continue the fight against perpetual cyber-risk. Before incorporating any additional scanning tools, think strategically about what's actually needed to defend your organization's unique environment and devise a plan to ensure all necessary tools can work together productively. In doing so, organizations can proactively manage their application and infrastructure risk by accurately prioritizing what's most critical and equipping themselves to take swift, decisive action every time.

Related Content:

John Worrall has more than 25 years of leadership, strategy, and operational experience across early stage and established cybersecurity brands. In his current role as CEO at ZeroNorth, he leads the company's efforts to help customers bolster security across the software life ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.