Participants in Vulnerability Management

Table of Contents:

Usually, there are four participants identified in vulnerability management (Carnegie Mellon University Software Engineering Institute 2016)

1. The claimant: A person who researches and identifies the vulnerability in the organization.
2. The vendor: The person or organization who has developed the product and is responsible for maintaining the product.
3. The adjudicator: The person who mediates disputes between the claimant and the vendor.
4. The supervisor: The person who checks the vulnerability from the vendor’s side in addition to the claimant.

When a vulnerability is investigated and confirmed, a remedy must be made by the team to rectify the vulnerabilities with required measures.

Vulnerability Analysis Tools

The following are the types of vulnerability analysis (VA) tools identified (Qualys 2008).

1. Host-based VA tools: These tools find and identify the operating system running on a particular host computer and test the system for any deficiencies. These search for common applications and services of the system.
2. Application layer VA tools: These tools check for the deficiencies in web servers and the databases.
3. Scope assessment tools: These tools check for the application and operating system deficiencies.
4. Depth assessment tools: These tools find the unidentified vulnerabilities in a system. These check the depth by inducing a software code that checks the security vulnerabilities by giving random input. These kinds of programs are called fuzzers or fault injectors.
5. Active tools: Active tools perform vulnerability checks over the network that consumes the system’s resources.
6. Passive tools: These tools observe systems data and perform data processing in a separate machine.

Tools may be classified based on the data examined or the location of the vulnerability identified. New vulnerabilities are born every day and new tools are needed to handle those vulnerabilities. The following is the list of tools currently available:

1. Cycorp CycSecure Scanner
2. ISS Network Scanner
3. Saint Vulnerability Scanner
4. Symantec NetRecan Scanner
5. SPIKE Proxy
6. Foundstone's Scanline
7. Cerebus Internal Scanner
8. Shadow Security Scanner

Many more tools are available.

Some of the free scanners available are listed below:

1. Nmap
2. Nessus
3. Whisker
4. Enum
5. Firewalk

With a diverse variety of vulnerabilities, there is much need for research activities in identifying the vulnerabilities and taking the necessary actions in vulnerability management.

The vulnerability management solution you select needs to allow your security team to think like a hacker because it uses the scanning technology to identify and fix vulnerabilities inside and outside the firewall.

Best Practices for Vulnerability Management

The following are a few best practices that need to be incorporated in the organization to improve vulnerability management (Qualys 2008).

• Discover network assets: Discovering the network assets helps to determine the areas that are more susceptible to attacks. Network mapping detects all network devices, which helps to discover widespread network assets.
• Classify the assets: Most of the networks in organizations have between 10 and 20 different categories of network assets.
• Run scans: Run accurate scans on the assets based on the ranking that is given in the vulnerability pre-assessment phase. This gives you full visibility on the level of risk associated with your assets. Efficient scanning helps to find out the vulnerabilities easily and perform further tasks intelligently. Prioritizing the scans play a major role.
• Technical reports: The reports need to be generated by the technical team with all the instructions to be followed to remediate the vulnerabilities. A proper instructed doc- ument/report helps in better identification and remediation of the vulnerability.
• Management reports: After the technical team has given the instruction report that is to be followed to remediate the vulnerability, the management report is generated to identify the vulnerability trends and mitigate the areas that cause these vulnerabilities. The management report is given by the senior management of the organization.
• Prioritize patching: Patches are the codes that are generated to resolve any problem. The patches are generated to fix the bugs with critical importance first, and later moving on to the ones with lower priority.
• Tracking remediation progress: Once the vulnerability is identified, it is called a trouble ticket. Once a ticket is generated, the vulnerability management system starts to resolve the issues and keeps track of all the remediation process step by step. The best practice is to keep track of the different patches that are released by the product-based organization at regular intervals and update the system to avoid the vulnerabilities.

Now, with the help of a case study, let us see how an organization can follow vulnerability management techniques during a breach (Thomas 2019).

A Case Study in Vulnerability Management: Equifax

Equifax is a global organization and is the largest consumer reporting agency. On September 8,2017, the organization released a note stating that it was attacked by a major cyber-attack compromising all the data of the users and also that the credit card numbers were leaked.

FIGURE 2.4

Attackers' exploitation.

Figure 2.4 shows how attackers exploited Equifax. The organization maintains many of the United States population's personal and financial data. The data stored by Equifax contains personal credit history, which includes account numbers, addresses, credit card statements, etc. When someone wants to borrow money, the lender first checks the borrower's financial history with Equifax and then lends money.

2.10.1 Identifying/Discovering the Vulnerability

Equifax uses Apache Struts as its application framework for one of its web applications. The attackers found a breach in the network and exploited the web application, leading to a security vulnerability CVE-2017-5639. This vulnerability takes over the exception handling issues when the user tries to upload files. They took over the servers and exploited around 143 million records. This led to the loss of confidential information.

2.10.2 Assessment of the Vulnerability

To resolve this problem, assessment was performed by the organization's internal security team. The team first identified the cause of the vulnerability. It performed different types of scans on the system, and after performing the rigorous vulnerability scans they identified two breakdowns. One was a failure to patch, and the other was a failure to identify the application as vulnerable. The patch update that was to be made that week had been missed and that led to a failure in an application. The solution to these two issues was provided by the technical team report followed by the management report.

The assets were identified, which included the software that is used in the organization network nodes, servers, and other peripherals connected via a network. The notifications that were sent from the vendors were analyzed. The internal security staff self-guided research on all possibilities to identify the vulnerability

2.10.3 Reporting the Vulnerability

A report consisting of the major area where the breach had occurred was generated by the people assigned for the task. In this case study, the vulnerability allowed attackers from a remote location to execute arbitrary commands that can be created remotely using a crafted Content-Disposition, Content-Type, or Content-Length HTTP header with a Content-Type header containing the characters #cmd=string.

2.10.4 Remediating and Verifying

The remedy for the vulnerability was finally given, by installing the missed patch with the security enhancements in the application, and the issue was tracked for its progress. It is observed that the security team conducted a scan to see if the vulnerability existed in the system (Marinos and Clements 2018).It is also observed that the scan did not detect the vulnerability Apache Struts CVE-2017-5638. Finally the organization came out of the breach. From then on, the security mechanisms were enhanced and also the vulnerability management process was performed at frequent intervals to avoid major havocs.

Thus, with the help of this case study, we can say that the security of an organization depends upon incorporation of proper vulnerability management mechanisms to maintain cybersecurity.

References

Ali, Assad, Pavol Zavarsky, Dale Lindskog, and Ron Ruhl. 2012. "A New CVSS-Based Tool to Mitigate the Effects of Software Vulnerabilities." International journal for Information Security Research 2(3): 178-182.

Carnegie Mellon University Software Engineering Institute. 2016. "CRR Supplemental Resource Guide Vulnerability Management Version 1.1." 4. https://www.us-cert.gov/sites/default/ files/c3vp/crr_resources_guides/CRR_Resource_Guide-VM.pdf., accessed on Feb 24,2020.

Christey, S. 2007. "Unforgivable Vulnerabilities." Black Hat Briefings.

Dondo, Maxwell G. 2008. "A Vulnerability Prioritization System Using a Fuzzy Risk Analysis Approach." IFIP International Federation for Information Processing 278:525-539.

Edwards, Chandra Estelle, 2020. "Finding Trust in Relational Vulnerability: Interpersonal and Intrapersonal Influences on the Intimacy Process" (Doctoral dissertation). Retrieved from ProQuest database. (Accession No.1552969396).

Gonda, Tom et al. 2018. "Analysis of Attack Graph Representations for Ranking Vulnerability Fixes." EPiC Series in Computing 55(September): 215-228.

IEEE. 2012. "Defining and Assessing Quantitative Security Risk Measures Using Vulnerability Lifecycle and CVSS Metrics" 2012 (1). d:%5Cdaten%5CPromotion%5CLiteraturver waltung%5CPromotion-EconomicsOfITSec (Citavi 4)%5CCitaviFiles%5C12Defining andAssessingQuantitativeSecRiskMeasuresUsingVulnerabilityLifecycle&CVSSMetrics.pdf.

ISO. 2020a. "ISO/IEC 27032:2012—Information technology — Security techniques — Guidelines for cybersecurity. https://www.Iso27001security.com/html/27032.html, accessed on March 23, 2020.

ISO. 2020b. "Vulnerability Management and Scanning." https://www.Rapid7.com/Fundamentals/ Vulnerability-Management-and-Scanning/Le, accessed on March 22,2020..

ISO/IEC. 2020. "Information Technology - Security Techniques - Code of Practice for Information Security Management/' ISO/IEC 27002. https://www.iso.org/committee/45306/x/cata- logue/, accessed on March 24,2020

Marinos, Nick, and Michael Clements. 2018. "Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach." United States Government Accountability Office (August): 40. https://www.hsdl.org/?abstract&did=815269.

Nanda, Sameer and Umashankar Ghugar. 2017. "Approach to an Efficient Vulnerability Management Program." International Journal of Innovative Research in Computer and Communication Engineering 5(6): 11241-11244.

Njogu, H. W., L. Jiawei, J. N. Kiere. January 2013. "Comprehensive Vulnerability Based Alert Management Approach for Large Networks." Future Generation Computer System 29(1), 2013: 27-45.

Peter, Mell, Karen Scarfone, and Sasha Romanosky. A. 2007. Forum of Incident Response and Security Teams (FIRST) Complete Guide to the Common Vulnerability Scoring System Version 2.0.

Qualys. 2008. "Vulnerability Assessment for Dummies," 66.

Thomas, Jason. 2019. "A Case Study Analysis of the Equifax Data Breach 1 A Case Study Analysis of the Equifax Data Breach." (December), https://www.researchgate.net/publication/337916068.

Tripathi, Anshu and Umesh Kumar Singh Singh. 2011. "Analyzing Trends in Vulnerability Classes across CVSS Metrics." International Journal of Computer Applications 36(3): 38-44.

Williams, A. and Nicollet, M 2020. "Improve IT Security With Vulnerability Management Title."

Zhang, Su, Doina Caragea, and Xinming Ou. 2011a. "An Empirical Study on Using the National Vulnerability Database to Predict Software Vulnerabilities An Empirical Study on Using the National Vulnerability Database to Predict Software Vulnerabilities." (August).

Zhang, Su, Xinming Ou, Anoop Singhal, and John Homer. 2011b. "An Empirical Study of a Vulnerability Metric Aggregation Method." The Defense Technical Information Center, DTIC Online, USA. http://oai.dtic.mil/oai/oai?verb=getRecord&metadata Prefix=html&identifier= ADA557504.