AKIBIA'S PRACTICAL GUIDE TO ENTERPRISE TECHNOLOGY
Thursday, October 15, 2009
Improving Vulnerability and Patch Management
If you are a resource administrator, then you probably spend too much time responding to new vulnerability reports and patching systems. For the security folks, you probably spend too much of your time tracking down the status on remediation and trying to qualify new vulnerability notifications. So how can we manage this better?
The answer is to develop a risk model that takes into account the particulars of your environment. Most vulnerability notification services and scanners provide some kind of default rating for the findings, and the more sophisticated ones even include a confidence rating, but you need to rate these vulnerabilities for your own environment. I like to use the default or vendor supplied ratings as a way to narrow down your focus from hundreds or even thousands, down to a manageable number. Then you need to analyze the risks of each exposure to your organization, and adjust the rating accordingly.
A good place to start is by looking at just the "Critical" and "High" level risks, setting aside the "Moderate" and "Low" findings for now (assuming a four tier risk model). Hopefully, you will have very few in the "Critical" category, but it is likely you will have a good number of "High" risks.
Next you need to qualify each vulnerability for applicability. This will usually require some research on the part of your technical staff if you don't have a good asset inventory that includes software and operating system versions. If you do have a comprehensive asset inventory, then your job will be a lot easier and potentially the filtering can be automated.
Once you have a list of vulnerabilities that are either "Critical" or "High," and are definitely applicable to your environment, you need to re-rate them. This is where a formal risk model is crucial. You need to determine in advance how many risk levels you will have, what your risk formula will include, and which criteria you will use to categorize vulnerabilities at each level.
For example, how would you rate the likelihood of a cross-site scripting attack on an Internet-facing server versus an internal tools server? The scanning tool is going to rate that as a high regardless, but you know that for an attack to be successful, an attacker has to know the URL for that server, and get you to click on a link to exploit your client. That is going to be really hard for an outsider to pull off using your internal tools server, but much easier on an external website.
The recent Adobe Acrobat vulnerabilities are another good example. If your Domain Controller happens to have a vulnerable version running on it, a scanner might flag this as a high risk, but you know that most of these exploits require opening a specially crafted PDF file on the server to be successful. What are the chances that an administrator is going to download or get emailed a malicious PDF, and decide to open it on your Domain Controller? Probably not high. Looking at your desktops and laptops, however, the likelihood is high, so that's where you should focus your efforts.
These are just some of the factors that you need to consider and account for in your risk model. Armed with this knowledge, you can better focus your administrators' efforts. With limited time and resources, you can't patch everything on day 1, so how do you determine which alerts are actually critical for your environment?
On October 20, 2009 I am hosting a free Webcast with SANS that will address these very topics. In this session we will focus on how to take vendor and industry reports of new vulnerabilities in software/hardware, and analyze the risk to your own organization. I hope that you will check it out.
Post a Comment
-
- By Anders 02/08/2010
Well, there are known exploits. But arent the biggest challenge the 0-day exploits? The lack of security knowledge among developers are in my oppinion still the biggest threat.
-
- By iphone 5 release date 09/07/2011
The right software patch management product helps assess exposure and prioritize patches so as to stay compliant at all times. It is crucial to be mindful of these points in order to find the right fit. Utilizing an effective patch management system can keep your computer inventory running at peak performance and avoid costly down time.
