Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

6/21/2013
12:25 AM
50%
50%

Cloud Can Simplify Vulnerability Management For SMBs

Lacking security skills, most small and midsize businesses need help in locking down their information technology, including cataloging and triaging vulnerabilities

Even with a relatively small number of systems, tracking down and triaging vulnerabilities is a complex enough task that many small and midsize businesses (SMB) set their systems to automatically update software and rarely check the results.

For SMBs, finding an employee with the expertise and time to catalog the devices connected to the network and routine scan for vulnerabilities is tough, says Kiran Kumar, product manager at vulnerability management firm Qualys. Most often, companies do occasional vulnerability scanning as part of the requirements necessary to comply with security standards, such as the Payment Card Industry's Data Security Standard (PCI-DSS). But companies that want better security need to do more than that, he says.

"We all know they have very limited IT resources and time, but this is a key area that they need for security," Kumar says. "While some of them just do it for their quarterly scanning requirement, there are others that are building up a team, even with two people. They want to use this to reassure their customers and give them more security credibility."

Vulnerability and patch management are a critical part of keeping businesses and their networks safe. SMBs that rely on their firewalls and antivirus software to protect their servers and employees' systems are not doing enough: Continuously monitoring the vulnerabilities present in a company's network comes in at No. 4 on the SANS Institute's Top-20 list of critical security controls.

Enterprise-class vulnerability management is typically not well-suited for smaller businesses, but a wide variety of companies offer on-premise products that catalog a company's IT assets and then checks them for vulnerabilities. From GFI's LanGuard to VMware's vCenter Protect, and from Rapid7's Nexpose to Tenable's Nessus, the products and services run the gamut from barebones to a large feature set.

Yet a number of companies are specifically targeting SMBs and their lack of IT security knowledge with cloud services that audit networks, detect vulnerabilities, and helps companies remediate the issues.

[If the definition of insanity is doing the same thing over and over and expecting different results, then today's IT security departments may just be a little nutty about vulnerability management. See Is Vulnerability Management Broken?.]

In 2012, nCircle, now part of Tripwire, released its PureCloud offering that performs asset discovery and vulnerability assessment via a cloud service. IT management firm Kaseya has a full-features platform that includes vulnerability scanning and patch deployment. Vulnerability management firm Secunia adds patching as well, aiming to offer in a single service the ability to catalog issues and then patch the problems, according to Morten Stengaard, chief technology officer of the firm.

"We want to get to the point that, if you don't have a security team, then you can still secure your systems," Stengaard said during an interview at the RSA Security Conference earlier this year.

In July, Qualys will launch a SMB-focused version of its own vulnerability management tool, QualysGuard Express Lite. The service will scan for vulnerabilities inside the network, scan for Web application vulnerabilities externally, and product compliance reports, Qualys's Kumar says.

"Basically, we want to help them turn scanning into something that keeps on happening automatically," he says. "We want the SMBs to really focus on growing their business."

Kumar and others stress that companies should not treat vulnerability management as a compliance exercise. Recent reports suggest that companies that focus on their security -- and use the cloud to provide secure services -- have a higher level of security and more success. A study sponsored by Microsoft, for example, found that six out of 10 companies that do not use the cloud cite security concerns as a primary reason, but that 94 percent of SMBs that adopted the cloud say it improved their security posture.

In a study released this week, security firm Symantec found that 78 percent of the top-performing third of SMBs felt they were at least somewhat secure, compared to only 39 percent of the worst-performing third. In addition, losses from successful attacks were 51 percent lower than the poor performers, said Andrew Singer, director of product marketing for small business at Symantec, in an e-mail interview.

"While we didn’t ask specifically about how they deal with vulnerabilities and patch management, it stands to reason that the top-ranking SMBs who make IT a priority are better able to deal with vulnerability-related issues," he said.

In addition to taking advantage of the expertise incorporated into cloud services, SMBs should also apply patches as soon as possible and block access to all internal systems from outside the network, he said.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: He hits the gong anytime he sees someone click on an email link.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-29071
PUBLISHED: 2020-11-25
An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering of HTML files uploaded to the platform as attachments, when the -htmlview URL is directly accessed. The impact ranges from executing commands as root on the server to retrieving se...
CVE-2020-29072
PUBLISHED: 2020-11-25
A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client-side attack requires user interaction (opening a link) and successful exploitation could lead to encrypted e-mail content leakage via messages/sent?format=js and popup?format=js.
CVE-2020-26241
PUBLISHED: 2020-11-25
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. This is a Consensus vulnerability in Geth before version 1.9.17 which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth's pre-compiled dataCopy (at 0x00...04) co...
CVE-2020-26242
PUBLISHED: 2020-11-25
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.18, there is a Denial-of-service (crash) during block processing. This is fixed in 1.9.18.
CVE-2020-26240
PUBLISHED: 2020-11-25
Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on...