5 steps to an effective vulnerability management program
Post on 02-Jul-2015
288 Views
Preview:
DESCRIPTION
TRANSCRIPT
Foundational Intelligence
Network Situational Awareness
Confidence and Trust
20% Gap in Network Visibility
“You can’t defend what you don’t know.”
Mark Orndorff, Director of Mission Assurance and Network Operations
Defense Information Systems Agency
Network Element Government Manufacturing Financial Technology
Assumed Device Count ~150,000 ~60,000 ~800,000 ~100,000
Discovered Devices ~170,000 89,860 842,400 ~114,000
Visibility Gap ~12% ~33% ~5% ~12%
Unknown Networks 3,278 24 771 433
Unauthorized Devices 520 n/a n/a 2,026
Non-Responding Networks 33,256 4 16,828 45
Established VM Program Yes Yes Yes Yes
Network change and complexity outpacing policy and procedures
Organizations can only manage and secure what they know
How much risk does this gap introduce?
An effective Vulnerability Management strategy must incorporate
comprehensive Network Situational Awareness, in order to
actively reduce overall risk
Network Situational Awareness represents the foundation of comprehensive
vulnerability management
DISCOVER
Networks & Devices
Edge & Boundaries
Profiles & Vulnerabilities
COMPREHEND
Assess & Score
Prioritize & Trend
Visualization & Reporting
MITIGATE
Reduce Risk
Minimize Threat Surface
Prevent Intrusion
“Organizations that operationally implement applicable IT controls
through a vulnerability management program will achieve the
strongest security posture.”
Step Goal
1 Validate Network
Address Space
Discover entire scope of IP address space in use with the environment
2 Determine Network
Edge
Understand the boundary of the network under management
3 Discover & Profile
Endpoints
Understand the presence of all devices on the network
4 Identify
Vulnerabilities
Evaluate and comprehend network vulnerabilities for remediation
5 Mitigate
Risk
Remediate risks in priority order with patches/changes or accept lesser risks.
•
Inventory of Authorized and Unauthorized
Hardware and Software
•
•
•
•
INFO
INFO
LOW
LOW
LOW
MEDIUM
MEDIUM
MEDIUM
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
HIGH
Executive Audit & Compliance
Security IT Operations
DISCOVER
Networks & Devices
Edge & Boundaries
Profiles & Vulnerabilities
COMPREHEND
Assess & Score
Prioritize & Trend
Visualization & Reporting
MITIGATE
Reduce Risk
Minimize Threat Surface
Prevent Intrusion
• Dollars & resources are being spent on things that don’t increase security
• Outdated (10 yrs old) security regulations require manual testing every three years on systems
• Diverse tool sets implemented across the civil landscape
What is the challenge?
• Refocus dollars and resources on what increases security
• CDM stops 85% of cyber attacks by: Searching for, finding, fixing, and reporting the worst cyber problems first in near-real time
• Understand networks, devices, software and people’s interaction with the network in real time
What can be done?
• In 2010, OMB assigns Cybersecurity responsibility to DHS
• In FY 2013, DHS proposes to deploy proven continuous monitoring technology across the .gov network
Who is responsible?
Source: http://www.verisgroup.com/2014/07/17/ongoing-authorization-and-near-real-time-risk-management/
Source: https://www.us-cert.gov/sites/default/files/cdm_files/training_materials/Overview%20Modules.pdf
• Control of HW assets through visibility
• Unauthorized/unmanaged HW discovery
• ID, block, or manage vulnerable assets
• Group assets based on risk profiles
Hardware Asset Management (HWAM)
• Unauthorized/unmanaged SWCI discovery
• Remove and/or block vulnerable SWCI
• Dynamic, complete, and accurate inventory
• Timely response to malware vulnerabilities
Software Asset Management (SWAM)
• Increased control through visibility
• Establishment of trusted “Gold Builds”
• Reduce and avoid misconfigurations
• Improved security patch asset maintenance
Configuration Management
(CM)
• Perform threat and vulnerability analysis
• Discover vulnerabilities
• Support remediation
• Automate response to known threats
Vulnerability Management
(VUL)
Continuous Monitoring•Maps to risk tolerance•Adapts to ongoing needs•Actively involves
management
Dynamic 360 degree CDM and CMaaS capability defending against asymmetric cyber threats
Continuous Asset Evaluation, Situational Awareness, Risk Scoring
• DHS DAA ATO• Agency DAA updates ATO for CDM sensors• DHS DAA establishes ESSA/EISA
Innovation Targets: Enhanced Analytics, DAD, Global Threat Intelligence and Process Optimization
CMaaS System
6-Monitor Security
State 2-SelectSecurity Controls
3-ImplementSecurity Controls
5-AuthorizeInformation
System
• Operate CDM tools internally to ID malware and prevent propagation
• Share CDM outputs to support ongoing A&A for CMaaS, ESSA/ISA and agency systems containing CDM sensors, agency dashboards
• Support SP 800-137 D/A ISCM strategy development and
maintenance, including CyberScope alignment
• Match outputs to governance training, mentoring, and change management
• Support DHS critical control review• Conduct site security assessment to identify differences impacting
A&A baseline• Provide outputs to DHS and Agency DAAs to Develop POA&Ms
• Apply NIST SP 800-53 High and SSH
4300 Baseline for TS Systems
• Develop Pre-Populated Templates and
Artifacts for SO Agencies
4-AssessSecurity Controls
• Apply Type Accreditation Strategy.o Unclass CMaaS System High
Categorization and Tools Selection Promotes Maximum Scalability and Tools Inheritance.
• Classified CMaaS System is classified at Top Secret.
1-CategorizeInformation
System
http://www.csc.com/public_sector/ds/11237/107249-cdm_cmaas?ref=ls
https://engage.csc.com/groups/cmaasbpa
http://www.gsa.gov/portal/content/176671?utm_source=FAS&utm_medium=
print-radio&utm_term=cdm&utm_campaign=shortcuts
http://www.dhs.gov/cdm
http://www.us-cert.gov/cdm
CMaaS@csc.com
Contact Phone Email
Josh Canary, BPA Program Mgr 703-908-7030 jcanary@csc.com
Eliminate Gaps in Network Intelligence
Maximize Visibility and Control
Enhance Security
Reduce Risk
tripwire.com | @TripwireInc
top related