Cloud Can Simplify Vulnerability Management For SMBs

Even with a relatively small number of systems, tracking down and triaging vulnerabilities is a complex enough task that many small and midsize businesses (SMB) set their systems to automatically update software and rarely check the results.

For SMBs, finding an employee with the expertise and time to catalog the devices connected to the network and routine scan for vulnerabilities is tough, says Kiran Kumar, product manager at vulnerability management firm Qualys. Most often, companies do occasional vulnerability scanning as part of the requirements necessary to comply with security standards, such as the Payment Card Industry's Data Security Standard (PCI-DSS). But companies that want better security need to do more than that, he says.

"We all know they have very limited IT resources and time, but this is a key area that they need for security," Kumar says. "While some of them just do it for their quarterly scanning requirement, there are others that are building up a team, even with two people. They want to use this to reassure their customers and give them more security credibility."

Vulnerability and patch management are a critical part of keeping businesses and their networks safe. SMBs that rely on their firewalls and antivirus software to protect their servers and employees' systems are not doing enough: Continuously monitoring the vulnerabilities present in a company's network comes in at No. 4 on the SANS Institute's Top-20 list of critical security controls.

Enterprise-class vulnerability management is typically not well-suited for smaller businesses, but a wide variety of companies offer on-premise products that catalog a company's IT assets and then checks them for vulnerabilities. From GFI's LanGuard to VMware's vCenter Protect, and from Rapid7's Nexpose to Tenable's Nessus, the products and services run the gamut from barebones to a large feature set.

Yet a number of companies are specifically targeting SMBs and their lack of IT security knowledge with cloud services that audit networks, detect vulnerabilities, and helps companies remediate the issues.

[If the definition of insanity is doing the same thing over and over and expecting different results, then today's IT security departments may just be a little nutty about vulnerability management. See Is Vulnerability Management Broken?.]

In 2012, nCircle, now part of Tripwire, released its PureCloud offering that performs asset discovery and vulnerability assessment via a cloud service. IT management firm Kaseya has a full-features platform that includes vulnerability scanning and patch deployment. Vulnerability management firm Secunia adds patching as well, aiming to offer in a single service the ability to catalog issues and then patch the problems, according to Morten Stengaard, chief technology officer of the firm.

"We want to get to the point that, if you don't have a security team, then you can still secure your systems," Stengaard said during an interview at the RSA Security Conference earlier this year.

In July, Qualys will launch a SMB-focused version of its own vulnerability management tool, QualysGuard Express Lite. The service will scan for vulnerabilities inside the network, scan for Web application vulnerabilities externally, and product compliance reports, Qualys's Kumar says.

"Basically, we want to help them turn scanning into something that keeps on happening automatically," he says. "We want the SMBs to really focus on growing their business."

Kumar and others stress that companies should not treat vulnerability management as a compliance exercise. Recent reports suggest that companies that focus on their security -- and use the cloud to provide secure services -- have a higher level of security and more success. A study sponsored by Microsoft, for example, found that six out of 10 companies that do not use the cloud cite security concerns as a primary reason, but that 94 percent of SMBs that adopted the cloud say it improved their security posture.

In a study released this week, security firm Symantec found that 78 percent of the top-performing third of SMBs felt they were at least somewhat secure, compared to only 39 percent of the worst-performing third. In addition, losses from successful attacks were 51 percent lower than the poor performers, said Andrew Singer, director of product marketing for small business at Symantec, in an e-mail interview.

"While we didn’t ask specifically about how they deal with vulnerabilities and patch management, it stands to reason that the top-ranking SMBs who make IT a priority are better able to deal with vulnerability-related issues," he said.

In addition to taking advantage of the expertise incorporated into cloud services, SMBs should also apply patches as soon as possible and block access to all internal systems from outside the network, he said.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.