Application & Infrastructure Risk Management: You've Been Doing It Backward

To effectively manage cyber-risk, organizations need to gain visibility into existing application and infrastructure vulnerabilities while also learning how to manage them proactively. This can feel like an insurmountable task at times, but thankfully, the cybersecurity industry does a commendable job of sharing intelligence about the common bugs and vulnerabilities to watch.

In fact, there are organizations whose sole mission is to find zero-day vulnerabilities and other instances of malicious cyber activity, such as Google's Project Zero and the United States Computer Emergency Readiness Team (US-CERT), providing valuable resources for cyber-risk.

All this said, the reality is strikingly different. Rather than actually remediating vulnerabilities, organizations today end up spending the bulk of their time trying to make sense of conflicting and/or duplicate vulnerability data. From a risk management perspective, they are failing to establish the visibility they need. And from a financial perspective, organizations are racking up significant expenses trying to employ enough skilled people to manage these disparate tools and cover the various software licensing fees.

Consider this: Unpatched vulnerabilities remain a chronic and persistent problem; they are responsible for many of the high-profile global data breaches in recent years, with the 2018 Equifax hack and 2017 WannaCry disaster serving as prime examples. Research from the Ponemon Institute also indicates that about 60% of all organizations suffering from a data breach between 2016 and 2018 cited a known, unpatched vulnerability as the attack culprit. While these statistics should not be viewed with fear, it is worth remembering the far-reaching implications of a single vulnerability.

Wildfire-Like Growth of Vulnerability Scanning Tools Isn't All Good News
The reason unpatched vulnerabilities persist and continue to wreak havoc is relatively simple — organizations are managing their application and infrastructure risk backward. In other words, companies are focusing, first and foremost, on purchasing a slew of different tools to scan various areas of their network environment and identify problematic areas. While this may help to fill scanning gaps across the software development lifecycle (SDLC), the various tools deployed rarely produce results that are easily correlated, leaving companies with a huge pile of data that is extremely hard to take action upon.

To complicate things further, the vulnerability scanning technology market is exploding. For scanning web application vulnerabilities, just one possible component of an organization's entire environment, the Open Web Application Security Project (OWASP) lists more than 50 tools available. With this kind of aggressive market growth, organizations are overdosing on the number of vulnerability scanning tools they use—and it's not working.

Acquiring technology to shore up weak points seems like the responsible and admirable thing to do, but the sheer number of vulnerability scanning tools organizations are implementing makes keeping pace impossible. Remember, each scanning tool reports and scores risk factors differently, which means these tools may likely indicate the same vulnerability more than once. And because scanners also name or prioritize them differently, bugs and flaws can go unrecognized completely, leading to wasted resources spent investigating repeat issues.

Implementing to Ensure Tools Work Well Together Is Key
To realistically identify and remediate application and infrastructure vulnerabilities, organizations need to take a step back. Before putting any additional tools to work, assess your environment's footprint and review the ones you already have, including what they cover. Identify any vulnerability scanning overlaps, keeping in mind that every environment is unique. Only retain or implement tools your organization truly needs rather than hanging on to popular solutions that promise enviable results.

After taking stock of your environment's footprint and vulnerability scanning needs, it's important to develop a cohesive strategy for managing your scanning tools, one that is scalable and allows them to work well together. For example, to address the challenge of various tools scoring vulnerabilities differently, consider transcoding your tool output to the Common Vulnerability Scoring System (CVSS) , an industry-standard framework for ranking the characteristics of a vulnerability and its risk. To gain a more holistic view of risk, track software and infrastructure throughout their respective life cycles rather than using an individual discovery technique such as simply correlating static application security testing (SAST) and dynamic application security testing (DAST). Instead of consolidating the outputs of multiple vulnerability discovery tools in a single stream, try consolidating vulnerabilities in a view that allows developers to address a single "unit of work," such as focusing on the important issues in need of immediate remediation.

A Risk-Based Approach to Vulnerability Management Is Paramount
When organizations prioritize vulnerability scanning technology over mindfulness, they not only waste valuable resources, they also forfeit a solid understanding of their security posture. Without being able to clearly identify where they're most at risk or where they need to prioritize remediation across applications and infrastructure, it's no surprise that many organizations detect and remediate as little as 10% of vulnerabilities.

Businesses today must adhere to a risk-based approach to vulnerability management if they hope to continue the fight against perpetual cyber-risk. Before incorporating any additional scanning tools, think strategically about what's actually needed to defend your organization's unique environment and devise a plan to ensure all necessary tools can work together productively. In doing so, organizations can proactively manage their application and infrastructure risk by accurately prioritizing what's most critical and equipping themselves to take swift, decisive action every time.

Related Content: