Threats and vulnerabilities shall be identified.
Guidance
- A vulnerability refers to a weakness in the organization’s hardware, software, or procedures. It is a gap through which a bad actor can gain access to the organization’s assets. A vulnerability exposes an organization to threats.
- A threat is a malicious or negative event that takes advantage of a vulnerability.
- The risk is the potential for loss and damage when the threat does occur.
A process shall be established to monitor, identify, and document vulnerabilities of the organisation's business critical systems in a continuous manner.
Guidance
- Where safe and feasible, the use of vulnerability scanning should be considered.
- The organization should establish and maintain a testing program appropriate to its size, complexity, and maturity.
To ensure that organization's operations are not adversely impacted by the testing process, performance/load testing and penetration testing on the organization’s systems shall be conducted with care.
Guidance
Consider validating security measures after each penetration test.
The organization has defined a process for addressing identified technical vulnerabilities.
Some vulnerabilities can be fixed directly, but vulnerabilities that have a significant impact should also be documented as security incidents. Once a vulnerability with significant impacts has been identified:
Static scans on code are the first step in detecting risky vulnerabilities. However, once a service has been deployed, it is vulnerable to new types of attacks (e.g., cross-site scripting or authentication issues). These can be identified by penetration testing.
We have defined the rules for responding to identified vulnerabilities. The rules may include e.g. the following things:
Vulnerabilities related to high-risk data systems are always of high severity and are addressed first.
The organization regularly conducts a vulnerability scan, which searches for vulnerabilities found on computers, workstations, mobile devices, networks or applications. It is important to scan even after significant changes.
It should be noted that vulnerable source code can be from operating system software, server applications, user applications, as well as from the firmware application as well as from drivers, BIOS and separate management interfaces (e.g. iLo , iDrac). In addition to software errors, vulnerabilities occur from configuration errors and old practices, such as the use of outdated encryption algorithms.
Vulnerabilities in third-party or open source libraries must be monitored, scanned, and reported in the same style as other vulnerabilities.
The organization must define policies to identify required updates in applications that use external libraries. Surveillance scans can be automated with specialized tools.
It also makes sense for an organization to monitor overall communication about vulnerabilities.
The technical vulnerability management process is regularly monitored and evaluated to ensure its effectiveness and efficiency.
In Cyberday, all frameworks’ requirements are mapped into universal tasks, so you achieve multi-framework compliance effortlessly.
.png)
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
