To prevent exploitation of technical vulnerabilities, organizations should proactively identify, evaluate, and address potential vulnerabilities in their information systems. This can be done for example by maintaining an accurate inventory of assets, including software versions and responsible personnel and utilising various resources to identify vulnerabilities, such as vulnerability scanning tools and penetration tests.
The organization has defined a process for addressing identified technical vulnerabilities.
Some vulnerabilities can be fixed directly, but vulnerabilities that have a significant impact should also be documented as security incidents. Once a vulnerability with significant impacts has been identified:
Static scans on code are the first step in detecting risky vulnerabilities. However, once a service has been deployed, it is vulnerable to new types of attacks (e.g., cross-site scripting or authentication issues). These can be identified by penetration testing.
Information sources for software and other technologies have been consciously identified to identify and maintain information about technical vulnerabilities that are relevant to us (e.g. authorities or hardware and software manufacturers). Data sources are evaluated and updated as new useful sources are found.
Vulnerabilities can be found directly in the vendor systems we exploit or in the open source components exploited by many of our systems. It’s important to keep track of multiple sources to get the essential information obtained.
We have defined the rules for responding to identified vulnerabilities. The rules may include e.g. the following things:
Vulnerabilities related to high-risk data systems are always of high severity and are addressed first.
The organization regularly conducts a vulnerability scan, which searches for vulnerabilities found on computers, workstations, mobile devices, networks or applications. It is important to scan even after significant changes.
It should be noted that vulnerable source code can be from operating system software, server applications, user applications, as well as from the firmware application as well as from drivers, BIOS and separate management interfaces (e.g. iLo , iDrac). In addition to software errors, vulnerabilities occur from configuration errors and old practices, such as the use of outdated encryption algorithms.
The technical vulnerability management process is regularly monitored and evaluated to ensure its effectiveness and efficiency.
Software updates should have a management process in place to ensure that the latest approved patches and application updates are installed on all approved software. Earlier versions of software should be retained as a precaution.
Once a vulnerability is identified, suppliers often have significant pressure to release patches as soon as possible. Therefore, the patch may not adequately address the issue and may have harmful side effects.
In evaluating patches, e.g. the following things should be taken into account:
In Cyberday, all frameworks’ requirements are mapped into universal tasks, so you achieve multi-framework compliance effortlessly.
.png)
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
