Vulnerability Management Is Critical To Preventing Cyberattacks — What You Need To Know

It only takes one unpatched vulnerability to result in a costly data breach, ransomware or malware attack. The National Institute of Standards and Technology (NIST)  logged more than 18,000 vulnerabilities in 2020, and more than half were critical or of high severity. ¹ This is the highest number of vulnerabilities NIST has seen to date. 

Software vulnerabilities are one of the main sources of cyberattacks, such as REvil ransomware’s supply chain attack against Kaseya Ltd. and the Accellion vulnerability that affected healthcare data. Organizations are under a lot of pressure to stay secure and compliant while cyberattacks are increasing. When managing vulnerabilities and the alerts that come with them, how do you know which ones pose the biggest risk? And which should you prioritize first? 

What is a vulnerability?

A vulnerability is a weakness that can be exploited by a threat actor. The actor uses any means possible to gain unauthorized access or privileged control to an application, network, service, endpoint, or server. Examples include exploiting communication ports open to the internet and  unsecure configurations of either outdated software or operating systems (OS). Attackers scour systems to find these vulnerabilities, gain access, and infect systems with malware or encryption that leads to severe ransomware attacks. 

Vulnerabilities that are abused by attackers often result in:

• Theft of sensitive data.
• Harm to systems and applications.
• Ransomware and/or malware infection (along with ransom demands).
• Regulatory violations.
• Damage to an organization’s reputation and negative media exposure.

It’s critical to patch vulnerabilities to reduce risk but with a large number of daily alerts, it’s hard to understand which to prioritize first.

How are vulnerabilities defined?

The National Vulnerability Database (NVD), maintained by the NIST, is the most popular repository of vulnerability information.  This is  an open, standards-based effort using the security content automation protocol (SCAP) standard, which has a few components:

Common vulnerabilities and exposures (CVE) – Each CVE enumerates and defines a specific vulnerability that could be subject to an attack for public knowledge.

Common configuration enumeration (CCE) – A CCE is a list of system security configuration issues used to improve workflow by facilitating fast and accurate connecting configuration data across multiple information sources and tools.

Common platform enumeration (CPE) – CPE is a standardized method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprise’s computing assets. They are used to describe what a CVE or CCE applies to.

Common vulnerability scoring system (CVSS) – CVSS is an open standard scoring system to assign scores to a vulnerability that indicates its severity. It offers visibility into prioritizing remediation efforts and resources according to the threat. Scores range from 0 to 10, with 10 being the most severe.

Many public sources of vulnerability definitions exist and are freely available, such as Microsoft’s security updates. Additionally, several vendors offer access to private vulnerability databases via paid subscription.

What is vulnerability management?

Vulnerability management is the process of identifying, categorizing, prioritizing, and resolving vulnerabilities in digital assets such as applications, servers, endpoints, cloud infrastructure, servers, etc. Vulnerability management is one of the most proactive methods to identify weaknesses within your digital assets. These weaknesses can pose a threat to your digital ecosystem and, if addressed early, can reduce risks to your digital ecosystem.

Every year, new vulnerabilities are discovered and require skilled security analysts to prioritize, patch, or reconfigure these weaknesses and proactively address vulnerabilities before they are utilized for a cyberattack. Organizations serious about the security of their environment should implement vulnerability management into their cybersecurity strategies to provide the highest levels of security posture possible.

While mitigating threats is a reactive process where the threat must be actively present, vulnerability management is proactive, identifying and prioritizing potential threats to close the security gaps that exist before attackers take advantage of them.

What is the vulnerability management process?

Every new vulnerability introduces risk to the organization. So, a defined process is often used to provide organizations with a way to identify and address vulnerabilities quickly and continually. At a high level, the processes below make up vulnerability management—each with its own subprocesses and tasks.