What is a vulnerability?

A vulnerability in our IT environment is a technical flaw that cybercriminals can use to gain access to the IT environment. This may involve many different vulnerabilities. They range from gaps in the security of IP camera software to bugs in the software version of a server. You can imagine that there are so many vulnerabilities these days that it is basically impossible to keep them all under control yourself. Environments cover many different locations, such as the cloud, your own IT platform, but also “Bring your own device” equipment. Giving a virus, malware or simply a hacker access to unsecured equipment that is not being managed by the organisation is something that happens every day.

CVSS

These vulnerabilities can be tested with the Common Vulnerability Scoring System (CVSS). This is a free and open industry standard for assessing the severity of vulnerabilities in the IT environment. CVSS assigns scores to vulnerabilities, allowing us to prioritise them based on the following aspects:

• How much effort is required to make use of the vulnerability?
• What is the impact if the vulnerability is used?
• What is the probability of this vulnerability being used?

CVSS assigns a score based on formulas. The score value depends on the impact on users and the possible effect of misuse. Scores vary from 0 to 10, whereby 10 is the most severe. The CVSS scores change along with the market, the standard is currently at version 3.1. CVSS provides an open standard in which almost all vulnerabilities are investigated and mapped out. This is one of the tools that we can use to obtain a clear picture of all the vulnerabilities to which the IT environment is being exposed. Every new vulnerability is also added to the CVSS database as quickly as possible, allowing the market to arm itself against them.

Penetration testing

A traditional way of checking whether there are any “leaks” in the security of the IT environment is to perform a penetration test (pen test). This is a rather labour-intensive project and includes many more angles, because IT environments have become much bigger over time. The fact that a cloud or a hybride cloud environment is often used in combination with a “Bring your own device” policy also makes it more complex to secure the environment and perform pen tests as a result. We have noticed a greater need for investigating which vulnerabilities are present prior to a pen test. The pen test is then used to validate this investigation.

You could view this as a security specialist who first carries out an inspection round on the site to be secured to map out the risks. He then determines where cameras and motion detectors should be installed and at which doors guards should be posted. A so-called “mystery guest” can then test whether he can gain access.
Vulnerability management

An increasing number of organisations have an active vulnerability policy. This is done for various reasons:

Staying abreast of the latest vulnerabilities.
A real-life check of whether/which vulnerabilities are actually present in the IT environment.
Full picture of all the equipment that connects to the network.
Project-related insight into eliminating vulnerabilities based on priority.
A great tool for the security department to check which targets have been achieved and which ones still need to be achieved.

You can imagine that manually checking the whole environment and performing all the cross-checks between software versions, equipment types and the CVSS database is a huge undertaking, even if the IT environment is not that large. So it is highly advisable to implement solutions that can do this automatically. These are vulnerability management solutions. Several of them are currently available, which really add a lot of value with the insights they provide.

Do you want more insight?

When our customers have questions about which solutions/measures should be prioritised and truly provide added value, we carry out a vulnerability assessment. This allows us to obtain an insight into the status quo of the environment in terms of vulnerabilities.

These facts provide a very clear picture of the steps to be taken and the associated investments in a financial and operational sense.

If you are curious about how this works exactly, feel free to contact me; I will be happy to tell you all about it.

Alwin Veen – Product specialist
a.veen@felton.nl
06-52869094