Why Is Vulnerability Management So Hard?

By Jeff Schroeder • July 16, 2015

What is it about Vulnerability Management (VM) that proves so difficult for organizations to implement and maintain? We continuously see companies stumble over some of the most basic principles of applying patches on any sort of routine schedule, much less identifying misconfigurations, policy noncompliance, or other issues within the environment. Organizations continue to do ‘check the box’ security in which they can honestly say “we perform vulnerability scanning” yet when you look at a vulnerability report, it has thousands, if not tens of thousands of vulnerabilities dating back years (and in some cases a decade or more). They don’t have a program, they have a tool.

“99.9% of the exploited vulnerabilities had been compromised more than a year after the associated CVE was published.”

In the most recent Verizon Data Breach Investigation Report, they found that “99.9% of the exploited vulnerabilities had been compromised more than a year after the associated CVE was published.”  Let that sink in, 99.9% of the exploited vulnerabilities could have been potentially avoided had these organizations maintained a vulnerability management program. If I’m a CISO, those are metrics that matter. Security as a whole is notoriously difficult to measure, VM however, should be an easy sell.

The 3 Entities That Drive Successful VM Programs

1: Processes

Processes aren’t any good if you don’t have the people for implementation and people are useless when they have no direction. Security should work with the business to build a process with realistic expectations and goals. Don’t set yourself up for failure by being overzealous. Establish a process with the organization and work to mature it over time.

2: People

That maturity of the organization’s process will take people, dedicated people. Maybe it’s one, or maybe it’s ten. There is no magic number, but I do emphasize the word “dedicated”.  The Security Analyst, George, who monitors the SIEM and manages the IDS sensors can’t also be your sole VM resource. You have to staff appropriately.

3: Technology

The technology piece maybe the easiest of all three drivers. There is a slew of vendors and tools available, you just have to research and pick the one that fits your environment (and budget) the best.

How Can CyberSheath Help Your Organization?

Ultimately, these three entities work in unison and fail when any of the three go missing, but VM isn’t a lost cause. While we continuously see organizations that have failed in the past, those same organizations are now asking what they need to do to be successful in the future. While there’s no overnight, turnkey solution that fixes years of neglect, CyberSheath has successfully helped numerous organizations, both large and small, implement a successful VM program that produces meaningful metrics and helps reduce risk within the environment. Whether it’s vendor/tool selection, policy or process, and procedure documentation, or just assistance in providing those dedicated bodies in the form of a managed service, CyberSheath has experience in it all.

CyberSheath Blog

CyberSheath Opens Registration For CMMC CON 2022

RESTON, Va. — June 8, 2022 — Federal contractors have been searching for direction after seeing a flood of messaging about the future of Cybersecurity Maturity Model Certification (CMMC). The nation’s largest CMMC conference has returned to help contractors navigate their course through the evolving compliance landscape.   Hosted by…

5 Reasons to Partner with CyberSheath

The threat landscape is only becoming more complex. Offload the responsibility of navigating cybersecurity issues for your customers by taking advantage of CyberSheath’s new Partner Program.   As a pioneer and industry leader in the managed security service provider space, our new offering helps you achieve rapid results and deliver…

CMMC Compliance Training: How to Earn Your Black Belt

Contractors in the Defense Industrial Base (DIB) are looking for direction as Cybersecurity Maturity Model Certification (CMMC) 2.0 nears. Compliance with CMMC and Defense Federal Acquisition Regulation Supplement (DFARS) is your key to doing business with the Department of Defense (DoD) and we can help you navigate those requirements and…

Our Trusted Partners

Tenable Microsoft Siemplify KnowBe4 ConnectWise DUO