Why Is Vulnerability Management So Hard?

By Jeff Schroeder • July 16, 2015

What is it about Vulnerability Management (VM) that proves so difficult for organizations to implement and maintain? We continuously see companies stumble over some of the most basic principles of applying patches on any sort of routine schedule, much less identifying misconfigurations, policy noncompliance, or other issues within the environment. Organizations continue to do ‘check the box’ security in which they can honestly say “we perform vulnerability scanning” yet when you look at a vulnerability report, it has thousands, if not tens of thousands of vulnerabilities dating back years (and in some cases a decade or more). They don’t have a program, they have a tool.

“99.9% of the exploited vulnerabilities had been compromised more than a year after the associated CVE was published.”

In the most recent Verizon Data Breach Investigation Report, they found that “99.9% of the exploited vulnerabilities had been compromised more than a year after the associated CVE was published.”  Let that sink in, 99.9% of the exploited vulnerabilities could have been potentially avoided had these organizations maintained a vulnerability management program. If I’m a CISO, those are metrics that matter. Security as a whole is notoriously difficult to measure, VM however, should be an easy sell.

The 3 Entities That Drive Successful VM Programs

1: Processes

Processes aren’t any good if you don’t have the people for implementation and people are useless when they have no direction. Security should work with the business to build a process with realistic expectations and goals. Don’t set yourself up for failure by being overzealous. Establish a process with the organization and work to mature it over time.

2: People

That maturity of the organization’s process will take people, dedicated people. Maybe it’s one, or maybe it’s ten. There is no magic number, but I do emphasize the word “dedicated”.  The Security Analyst, George, who monitors the SIEM and manages the IDS sensors can’t also be your sole VM resource. You have to staff appropriately.

3: Technology

The technology piece maybe the easiest of all three drivers. There is a slew of vendors and tools available, you just have to research and pick the one that fits your environment (and budget) the best.

How Can CyberSheath Help Your Organization?

Ultimately, these three entities work in unison and fail when any of the three go missing, but VM isn’t a lost cause. While we continuously see organizations that have failed in the past, those same organizations are now asking what they need to do to be successful in the future. While there’s no overnight, turnkey solution that fixes years of neglect, CyberSheath has successfully helped numerous organizations, both large and small, implement a successful VM program that produces meaningful metrics and helps reduce risk within the environment. Whether it’s vendor/tool selection, policy or process, and procedure documentation, or just assistance in providing those dedicated bodies in the form of a managed service, CyberSheath has experience in it all.

CyberSheath Blog

How to Safeguard Your Company from Phishing

Email is so ubiquitous in our everyday lives that it can be a challenge to always be on guard when receiving messages. Each day it’s not unheard of for each member of your team to have hundreds of messages land in their inbox. How do you make sure that none…

3 Tools to Help Defend Your IT Infrastructure from Threats

With the continually evolving threat landscape and the prevalence of team members working from home, it is more important than ever to be proactive with how your company is protecting itself from cyberattacks.  CyberSheath can help. We offer services to build on all the great work you have already done…

DNS Filtering for Additional Protection of IT Systems

Phase one of securing your IT infrastructure should include protecting your endpoints and safeguarding your employees from phishing attempts. After you have implemented these controls, the next logical step is to launch a DNS filtering solution.   What is DNS filtering and why do you need it? Domain name server…

Our Trusted Partners

Tenable Microsoft Siemplify KnowBe4 ConnectWise DUO