Vulnerability Management as an Improvement Loop

Emerging threats are overwhelming security teams. New vulnerabilities can be identified reasonably fast with the common approach of platforms that run scans across your assets, and teams can still bank on their strong change approval boards and the rollout of patches. But that is where the pressure often stops, and where the danger exists.

We have increased risks with AI-driven capabilities for identification and exploitation. Both sides of the law are leveraging capabilities. However, operational teams have often stopped where patches are rolled out, and not focused on a key metric, which is to ensure the patch is deployed and reporting back with a healthy state. With remote workers, large organisations often gave a patience level, a window of grace, for the possibility of people on vacation, or computers simply not used and stored in storage for a while.

Starting With the Assets

A strong asset management process will answer questions about assets within minutes. There should be no guesswork about the status of an asset, and getting this optimised is the key input to a robust vulnerability management capability. Who, and in what role, has access to it, the privileges of that role, what is on it and where it is, and how the data on it is secured, are examples of what should be under control, with the capability to isolate and remote wipe those assets.

Raising the Patch Confidence Level

With a good vulnerability management operation, teams will not stop at pushing a patch. They will use a metric-driven dashboard to track how long it takes for a vulnerability to leave their estate, so a new vulnerability is not still lingering around for 30 to 60 days because it has not been installed.

Constant Improvement

These confidence levels of an organisation's capability are facts that drive security teams' brand value up in the board room. Knowing your operation, and being able to true up to its negative, positive and future better state with objective and key result focused delivery plans, is going to ensure you're supporting your organisation to look strong in the supply chain, and your board of directors will have the answers they are advised to obtain, potentially before they even ask for it.