Computer Systems Security Planning for Success

It is not only good practice, but also a matter of law that information infrastructure be secured. In order to better understand what that legalities are and how vulnerabilities can and should be addressed, we need to make sure we understand the key terms used:

Vulnerability: a weakness or lack of countermeasure that can be exploited by a threat.

Vulnerability Management: the process of identifying, classifying, and remediating vulnerabilities.

Asset: something that we are trying to protect

Threat: The vulnerability being exploited

Risk: the impact of an exploit taking place.

Control/Countermeasure: actions taken/configurations to remediate vulnerabilities.

It may be helpful to discuss these in terms of an analogy. A vulnerability would be an unlocked door. Vulnerability management would be noticing the door and weighing the risk. This may involve looking at the crime rate of the area, determining the value of the items in the house, taking into account how difficult it would be to lock the door, and determining whether you want to lock the door and/or purchase an alarm system. An asset would be the things in the house, like a laptop of example. Risk would be the impact or a robbery, perhaps $800 for the lost laptop. Finally controls/countermeasures would be locking the door, getting a camera system, and/or and alarm system.

The first step in managing vulnerabilities is gathering information. The security team needs to collect:

This information can be gathered from endpoint management software, and a significant portion of it typically is. This step is part of inventory management, the process of keeping a centralized database of asset information. Using endpoint agents, network monitoring (often via simple network management protocol (SNMP)) and endpoint scripts, an inventory management system can keep track of the last date a user was logged in, the operating system being used, the applications installed and their install dates, and the network segment the device is on. Good inventory management is required for good vulnerability management.

Scans can also be used to find vulnerabilities. Vulnerability scans can be run internally and externally either under a privileged or an unprivileged account. Scans are typically scheduled and run per network segment at times when they will be least intrusive. These scans will generate reports or use dashboards to keep the security team notified if any vulnerabilities are found.

Scripts or third-party programs can also be used to monitor specific endpoints. These scripts may perform ICMP, SNMP, TCP/UDP, or HTTP checks. Often, they are specific to the device being monitored. For example, if we have an internal web server that has had a directory traversal vulnerability in the past, we might write a script to perform GET requests for vulnerable URLS and return an alert if they succeed. This kind of bespoke monitoring is a key aspect of vulnerability management.