book

Vulnerability Management, 2nd Edition

by Park Foreman

May 2019

Intermediate to advanced

330 pages

9h 58m

English

Auerbach Publications

Read now

Unlock full access

1.1 The Role of Risk Management1.2 Origins of VM1.3 Introducing the Security Industry and Its Flaws1.4 Challenges from Government and Industry1.5 Sources of Vulnerabilities1.6 Example of Flawed VM1.7 Why VM Is Important

2.1 Introduction2.2 The Vulnerability Creation Process2.2.1 Complexity2.2.2 Communication2.2.3 Interoperability2.3 Creating Vulnerabilities: An Example2.4 Rationale for a VM Program2.4.1 Overexposed Network2.4.2 No Standard for Secure Systems Configuration2.4.3 Risk of Major Financial Loss2.4.4 Loss of Revenue2.4.5 Lost Productivity2.5 VM Program Failure2.5.1 Case Study #1: Getting the Organization Behind You2.5.1.1 Events2.5.1.2 Analysis2.5.2 Case Study #2: Technology Integration Challenge2.5.2.1 Events2.5.2.2 AnalysisEnd Note
3.1 Introduction: Program Structure3.2 The VM Program and Technology Development3.3 Who Gets Involved?3.3.1 Operational Roles3.3.1.1 Vulnerability Manager3.3.1.2 Incident Manager3.3.1.3 Change Manager3.3.1.4 Compliance Manager3.3.2 Contributing Roles3.3.2.1 Asset Owners3.3.2.2 Security3.3.2.3 HR3.3.2.4 IT3.4 Policy and Information Flow3.4.1 Existing Policy3.4.2 New Policy3.4.2.1 Usage Policy3.4.2.2 Ownership and Responsibilities3.4.3 Compliance and Governance3.4.3.1 System Audit3.5 Summary
4.1 Introduction4.2 General Architecture4.2.1 Hardware: The Appliance Model4.2.2 User-Supplied Hardware and Virtualization4.3 Agents4.3.1 Agent Architecture4.3.2 Advantages and Disadvantages4.3.3 Detection Methods4.4 Passive Network Analysis4.4.1 Advantages and Disadvantages4.4.2 Detection Methods4.4.3 Physical Layer4.4.4 Data Link Layer4.4.5 Network Layer4.4.6 Layers 4 Through 74.5 Active Scanning Technology4.5.1 Advantages and Disadvantages4.5.2 Detection Methods4.5.2.1 Discovery4.5.2.2 Black Box Testing4.5.2.3 White Box Testing4.5.2.4 Web Application Testing4.6 Hybrid Approach4.7 Inference Scanning4.8 Common Vulnerabilities and Exposures (CVE)4.8.1 Structure4.8.2 Limitations of CVE4.9 The Standard for Vulnerability Test Data4.9.1 Definitions Schema4.9.2 System Characteristics Schema4.9.3 Results Schema4.9.4 Nuts and Bolts4.9.4.1 <Definitions>4.9.4.2 <Tests>4.9.4.3 <Objects>4.9.4.4 <States>4.10 The Standard for Vulnerability Severity Rating4.10.1 CVSS Nomenclature4.11 NVD4.11.1 CPE4.11.1.1 Encoding4.11.1.2 Examples of CPE Names4.11.2 XCCDF4.12 SCAP4.13 Nessus4.13.1 Advantages and Disadvantages4.13.2 Scan Modes4.13.3 Using NessusEnd Notes
5.1 General Requirements5.1.1 Division of Responsibilities5.1.2 Scheduling5.1.3 Standards5.1.4 Reports5.1.5 Advanced Reporting5.2 Automation5.2.1 Ticket Generation5.2.2 Process Integration5.2.2.1 Process and System Flexibility5.2.2.2 Patch Management Support5.3 Architecture5.3.1 Passive Architecture5.3.2 Agent-Based Architecture5.3.3 Active Scanning Architecture5.3.3.1 Determining the Number of Devices5.3.3.2 Select Locations Carefully5.3.4 Secure the Platform5.3.5 System Integration5.3.5.1 Change Management5.3.5.2 Incident Management5.3.5.3 Intrusion Prevention5.3.5.4 Security Event and Incident Management (SEIM)5.4 Application Programming Interface (API)5.5 Scoring Method5.6 Access Control5.6.1 Active Directory5.6.2 RADIUS and TACACS5.6.3 Authorization5.7 Deployment Methods5.7.1 Active Scanner Deployment—Physical5.7.2 Virtual Scanners5.7.3 Passive Analyzer Deployment5.7.4 Agent Deployment5.8 Summary
6.1 Introduction6.2 The VM Process6.2.1 Preparation6.2.2 Discovery6.2.3 Profile6.2.3.1 Evaluate6.2.3.2 Contextualize6.2.4 Audit6.2.5 Remediate6.2.6 Monitor and Adjust6.2.7 Govern6.3 Baselines6.4 ITIL-ITSM Processes6.4.1 Service Support6.4.2 Service Desk6.4.3 Incident Management6.4.3.1 Problem Management6.4.3.2 Configuration Management6.4.3.3 Change Management6.4.4 Service Delivery6.4.4.1 Service Level Management6.4.4.2 Capacity Management6.4.4.3 Availability Management6.4.5 Other Areas6.5 IAVA Process6.5.1 Managing the IAVA Process6.6 Data Classification6.6.1 Case Study: Big Tyre Corporation6.6.1.1 Analysis6.6.2 Data Classification Process6.7 Risk Assessment6.7.1 Information Collection6.7.2 Assess Security Controls6.7.3 Business Requirements6.7.4 Asset Valuation6.7.5 Vulnerability Assessment6.7.6 Control Effectiveness Assessment6.8 Summary
7.1 Introduction7.2 Discovery Reports7.3 Evaluation Reports7.4 Profile Reports7.5 Audit Reports7.5.1 Active Scanning Audit Reports7.5.1.1 Audit Status Report7.5.1.2 Audit Schedule Report7.5.2 Passive Scanning Audit Reports7.5.3 Audit Trend Analysis7.5.3.1 Vulnerability Trend Report7.5.3.2 Network Risk Trend Report7.6 Active Scanning: Scheduling and Resources7.6.1 Audit Parameters7.6.1.1 Bandwidth7.6.1.2 Protocols7.6.1.3 Ports7.6.1.4 Vulnerability Sets7.6.1.5 Authentication7.6.2 Scheduling7.7 Audit Trend and Performance Reports7.7.1 Basic Reports7.7.2 Advanced Reports: Control Charts7.7.3 Introducing Vulnerability Swarms: Controls Performance Report7.8 Compliance Reports7.8.1 System Compliance Report7.8.2 Compliance Executive Summary7.9 SummaryEnd Note
8.1 Introduction8.2 Charter Development8.2.1 Introduction: Business Value8.2.2 Goals and Objectives8.2.3 Scope8.2.4 Assumptions8.3 Business Case8.4 Requirements Document8.5 Security Architecture Proposal8.6 RFP8.7 Implementation Plan8.8 Operations Process Document8.9 Asset Valuation Guide8.10 VM Policies8.11 Deployment Strategies8.11.1 Basic Strategy8.11.2 Risk-Based Strategy8.11.3 Revised Schedule8.12 Deployment Metrics and Progress Reports8.13 SummaryEnd Note
9.1 Introduction9.2 Operating Environment9.3 Managing External Factors9.4 Controlling Internal Vulnerabilities9.4.1 Business Model9.4.2 Business Process9.4.3 Complexity9.4.3.1 Vulnerability Scenario9.4.3.2 Mitigation Strategy9.4.4 Response Scenario9.4.4.1 Vulnerability Scenario9.4.4.2 Mitigation Strategy9.4.5 Vulnerability Methodology and Change9.4.6 Complexity9.4.6.1 Centralization and Regionalization9.4.6.2 Standardization9.5 Principles of Mitigation9.6 Understanding the Enemy9.6.1 Weakness and Strength9.6.2 Real-World Events9.6.3 Goals versus Objectives9.6.4 Time Amplifies Impact9.6.5 Political Environment Enhances Attacks9.7 SummaryEnd Notes
10.1 Vulnerability Management in the Cloud10.2 Dimensions and Challenges of Cloud Service Vulnerabilities10.2.1 Risk Management Methodology10.2.2 The Data Center10.2.3 Infrastructure—Bare Metal10.2.4 Infrastructure—Virtualization10.2.5 Infrastructure (Limited Platform)—Containers10.2.6 Platform as a Service (PaaS)10.2.6.1 Other PaaS Risk Concerns10.2.7 Software as a Service (SaaS)10.2.8 Blurring the Lines—SDWAN10.3 Scanning and Remediation in Cloud10.3.1 Scanning Virtual Machines10.3.1.1 Network Scanning a Virtual Machine10.3.1.2 Scanning Containers10.4 Cloud Risk Management Strategies10.4.1 Service Diversity10.4.2 Contractual Agreement10.4.3 Vendor Risk Assessment Program10.4.4 Compensating Controls10.5 Cloud Security Assessments10.6 ConclusionEnd Notes
11.1 Introduction11.2 Cross-Discipline Opportunities11.3 Cross-Technology Opportunities11.3.1 Agents11.3.2 Patch Management11.3.3 Application Penetration Testing11.4 Process Deficiencies11.5 Changing Operating Environment11.5.1 Saving Time11.5.2 Power Conservation11.5.3 Distributed Computing11.6 Reporting11.7 Service Level Agreements11.8 ConclusionEnd Notes