04 September 2022
اخبار انگلیسی
Therefore, the first step to ensure the organization's protection is to create a Vulnerability Management program that includes searching and cataloging all digital assets, assessing the security level of network infrastructure and web applications, upgrading suggestions for troubleshooting, and reviewing and implementing all these suggestions.
The Nature of Vulnerability Management
Undoubtedly, controlling vulnerabilities is necessary. Experts believe that over 50% of web applications contain serious vulnerabilities that allow hackers to steal confidential data and control system performance. Companies' systems and applications must constantly be updated to fix bugs and issues. Still, some vulnerabilities may be ignored, which can cause these issues to persist with each release and, as a result, provide an excellent opportunity for attackers (such as BlueKeep and DejaBlue vulnerabilities).
Problems are found in almost every part of the infrastructure, so they should all be covered by vulnerability management:
- Processes (for example, some applications running on the network may have interconnected interfaces)
- Web applications (enterprise portals, CRM, etc.)
- Network infrastructure (local area networks)
- Software distribution
Today, several options can be used to implement vulnerability management. Telecommunications vendors may offer a wide range of services (including reporting, vulnerability scanners, surveillance systems, etc.) and place them in the organization's cloud or IT infrastructure.
IT Infrastructure or Cloud?
In general, there are two ways to deploy and implement vulnerability scanners:
1. IT infrastructure
2. Cloud
The first way ensures complete control of access (to hardware and software) and no need for third parties. However, the organization must purchase the scanner and related licenses and pay for the training, development, and maintenance of the scanner and the person working as the scanner results analyst in the organization.
In contrast, with the deployment and implementation of scanners in the cloud, there is no need to spend a lot of resources to develop and maintain them. It also offers high fault tolerance due to its virtualization, load balance, and many benefits. However, having an outside provider can be risky. Therefore, choosing a reliable partner is very important.
Does The Scanner Need an Agent?
1. With an agent
2. Without an agent
Remember that both are related to deployment and implementation in the cloud or the IT infrastructure.
Agents are hosted on scan endpoints (hosts) as a service or software. They collect information about these hosts and send it to the primary scanner. This approach allows the organization to monitor devices outside the network environment (such as laptops of employees who work from home). However, receiving information about scan results is only possible if the device is connected to the Internet. In addition, installing agents on laptops that are not on the network (such as employees working remotely) is a challenge.
On the other hand, some factors may not be compatible with specific operating systems. An organization may have computers running a specialized operating system.
Agent-free scanners allow organizations to scan local host assets and IT infrastructure without compatibility requirements. As a result, the organization does not incur additional costs for setting up an operating network and supporting and purchasing a license.
Scanners and Vulnerability Management
Today, the information security market can offer many tools related to vulnerability management. However, some vendors and security service providers offer different definitions of this service. They serve as vulnerability management services such as:
- Comprehensive information security services that include vulnerability management
- Vulnerability management services
- Software for self-scanning
When an organization buys self-scanning software, it is purchasing a self-service tool. This incurs costs for the company, which include:
- When implementing vulnerability scanners in the infrastructure, costs should be spent on purchasing, installing, and supporting equipment and licenses. On the other hand, IT security professionals should be paid.
- Maintenance costs and licenses should be considered when implementing vulnerability scanners in the cloud.
Another option that organizations can take advantage of is vulnerability management as part of a comprehensive cybersecurity solution that is usually cheaper than a self-service solution. The performance of vulnerability management in such complex solutions is usually severely reduced.
For example, you can often find complex offers such as information security audits, including vulnerability management. But auditing is a one-time activity and cannot bring much use. In contrast, the effectiveness of scanning is achieved only by doing it regularly and continuously because otherwise, it is almost impossible to monitor emerging vulnerabilities and develop a strategy to eliminate them.
The last option that organizations have is a vulnerability management service. In this case, the scanner is placed in the cloud. Not only does it provide an easier way for maintenance, but it also allows experts to process and analyze the data collected.
If a service provider provides quality service, this approach will be highly productive for several reasons and will bring good profitability to the company:
1. You can get better technology by paying less.
2. The experts of the service company have access to the vulnerabilities of the database on a large scale, and the information is up-to-date.
3. This service is more flexible than customized software because new hosts can be connected to it without re-reconfiguring the software or purchasing additional licenses.
4. If an organization wants to do all the work, it will delegate the task of analyzing the results to a security expert with other duties. But a service provider allows the organization to make better use of time by providing a brief report and shortening its preparation time. So in some cases, outsourcing may be the best option.
How Scanners Detect Vulnerabilities?
Various databases (such as CVE) can be used to have a bank of vulnerabilities. Most vendors do not consider the regional specifications of the scanned items. As a result, they have virtually no information about software vulnerabilities created by, for example, Chinese companies. Conversely, regional vendors, by accessing databases, take into account all the features of the software used in the region.
Of course, it should be noted that the scanner can use local and international databases simultaneously, but it is challenging to synchronize with various sources constantly. Regulatory agencies in different countries must agree on multiple issues, adapt additional resources technically, and set budgets to keep many databases up to date. Therefore, it can be concluded that it is easier and more profitable for a vendor to operate only in a specific region or globally.
Conclusion
As mentioned, there are many options for implementing vulnerability management. The organization must consider several factors such as IT infrastructure, regional features, budget, number of remote hosts, and availability of experts to maintain and repair the scanner to ensure that information security processes are appropriately performed.
