There's Over 100,000 Identified Cybersecurity Vulnerabilities. Which Ones Are You Scanning For? Here's Some Best Practices:

Vulnerability scanning has become a tenant of any holistic security plan. It’s an excellent practice, inspecting potential weak spots in a system and identifying which pose the biggest threats. But as nice as it would be, you can’t scan for all all vulnerabilities, all the time. The US National Vulnerability Database lists over 112,000 CVEs (Common Vulnerabilities and Exposures).

Unfortunately, given the number of potential vulnerabilities and the complexity of modern systems, it isn’t as straightforward as conducting an assessment, identifying vulnerabilities, and addressing them. Performing vulnerability scans on an IT environment brings about system downtime and other disruptions to business services, making it an unrealistic goal to scan all vulnerable endpoints in servers, applications and databases. Historically, this conundrum has made it easy for businesses to justify forgoing vulnerability scans and security measures altogether. The thought process being, if we can’t tackle all of our threats, why bother wasting system downtime for the mere possibility that we might find some inconsistencies? While this may have worked in the earlier years of cybersecurity, the frequency and intensity of attacks have increased dramatically, to the point where neglecting to scan for vulnerabilities leaves your business at a serious chance of risk.

So if scanning all endpoints isn’t feasible, and not scanning is downright dangerous, what’s a business to do?

It’s a complex problem that merits an equally robust solution. But it’s not unsolvable - plenty of companies with high-profile data have clear security solutions in place to protect it - and it’s certainly worth it for security teams to invest in such a solution to mitigate their risks. To start off, it’s important to note that security assessments like vulnerability scans often lack a thorough understanding of the system being assessed - Info Security Magazine likens the process to eating wild mushrooms - to the uninitiated, you risk not knowing which are be edible delicacies, and which might be disastrously fatal. The same is true for scans: without proper research and understanding of your system, as well as your business, it can be almost impossible to know where to start with scans, and how to select the endpoints that represent potential risks.

Align Vulnerability Assessments with the Greatest Risks

To perform an effective vulnerability scan in an efficient time frame, a business must narrow down the number of endpoints, devices, and tests to be performed. When doing so, it’s only sensible to choose those endpoints that offer the biggest threat to the business. A few things to consider in this process:

• Set goals for the vulnerability scan. While scans often reveal a large number of vulnerabilities, organizations are often unequipped to remediate the majority of them. Deciding if a scan is assessing the overall health of a system for informative purposes (such as preparing for a new application implementation, or a more robust security solution,) versus searching for specific vulnerabilities that can be remediated by the business or service provider helps keep the scan realistic in scope and effective in practice.

• Define Key Performance Indicators (KPIs) and other metrics to understand the scan. Each business is unique to some degree in what they need from a security solution. Creating concrete metrics that help paint a clear picture of an organization’s security goals helps communicate to internal stakeholders and potential security service providers. Some useful metrics might include: Patches required, misconfiguration of devices, account compromises, or instances of malware.

• Consider Unique-to-Business Risks: Assess the root causes of the greatest risks to your business. Ignore the sensationalized security attacks published in the media, and look internally at your organization to understand where your biggest security priorities ought to be. It’s useful to consider this from a “Threat, Asset, Vulnerability” standpoint: risk can be defined as the intersection of these three things, but too often businesses focus on only one - typically the “Threat.” This can happen before or after a vulnerability scan. Before, as a way to dial in the scan to more specific, remediable risks, or after, as a way to prioritize which risks to address.

Vulnerability assessments are a process, and one part of an overall security plan. Some extra consideration of these issues at the beginning of the process can save organizations time and resources in the long run - and ultimately, could prevent a severely damaging security breach.