Is there really value in Vulnerability Management?

For almost the last 10 years now, I’ve worked for companies that sell Vulnerability Assessment and Management products as part of their portfolio. I’m very familiar with most of the VM products out there and what their capabilities are.

SC Magazine recently did reviews on most of the major VM products. This got me thinking about VM and it’s place in the customer’s network. Is there really value in VM? Is one VM product better than another? Should security administrators be using VM? My answer is yes to all of the above, but with certain conditions.

I remember about 5 or 6 years ago I got a call from a very well known book and music retailer, someone that most of you have probably used before. They were interested in evaluating our VM product up against a few competitors. I worked with this customer for the next 4 months learning about their network and current state of security, why they wanted a VM product, what they wanted out of a VM product, etc. After an evaluation period, the customer chose our product for purchase. This was going to be a huge rollout costing them quite a bit of money, therefore I was asked to take a meeting with some of the higher-level people in this company to explain the benefits and costs of using our VM product. I had been in plenty of these meetings before so I was expecting more of the same. What was about to happen shocked me.

I had my laptop connected to the projector and started off by introducing myself and the company I worked for, giving a little background on the work we had done over the past several months and what the goals of the meeting were. That took about 5 minutes. The next slide I had prepared was a graphical representation of the companies’ external customer network and the critical level vulnerabilities we had found on it. That slide was on the screen for about 1.8 seconds before the CTO literally reached over and yanked the projector cord from my laptop. Everyone just looked at him in shock. He jumped up and said “If we’re made aware of all of these issues on our customer network, we’re now responsible for fixing them!” His lead security guy said “Ummm, yeah. That’s why I was given this project in the first place, to make our customer network more secure.” The CTO stuck to his guns and told everyone else that they wouldn’t be spending ANY money on a product that exposed their liabilities and vulnerabilities. At this point he not so kindly asked me to leave.

Vulnerability Management is a tricky space to sell into and an even trickier product for a customer to get use out of. I can’t tell you how many times I’ve seen a phonebook sized vulnerability report printed out and sitting on some security admin’s desk collecting dust. You can run all the vulnerability scans you want, print out as many reports as possible, create nice executive level reports with tons of pretty graphics and charts, but unless you actually DO something with these results, they’re not helping you much. VM vendors have made pretty good strides in making results more actionable and readable, but they’re still pretty overwhelming for most short staffed companies.

So what is the best way to get value out of a VM product?

Prioritizing vulnerabilities and systems to be scanned is a great start. Don’t scan every system for every vulnerability known to man.

Task different people or groups with different vulnerability groups. For example, break up your scans into categories like “databases”, “web servers”, “desktops”,  “network devices”, then assign those scans and results to the corresponding owners.

Tie your results into a ticketing system in order to track results. If you have an existing ticketing system, make sure the VM products you’re looking at can feed in and out of those systems. If you don’t have a ticketing system, make sure the products you’re looking at include one.

The bottom line is that VM has its place in most networks and can add huge value, you just need to learn its place in your network.

…josh