On Guard

AN INCONVENIENT TRUTH FACED BY ENTERPRISES TODAY IS THAT THE GROWTH OF CYBER-ATTACKS ISN’T SLOWING DOWN AND HACKERS ARE CONSTANTLY FINDING NEW WAYS TO EXPLOIT WEAKNESSES IN IT ENVIRONMENTS. EXPERTS SHARE INSIGHT ON WHY VULNERABILITY MANAGEMENT IS A VITAL PROCESS IN STRENGTHENING AN ORGANISATION’S SECURITY POSTURE.

- Hadi Jaafarawi & Morey Haber

Major cybersecurity breaches that took place across the globe highlight how crucial vulnerability management is for any organization.

WannaCry, NotPetya, the Equifax breach, and other well-publicized cyber-attacks took advantage of vulnerabilities that could have been easily patched and secured.

Vulnerabilities are like holes in a suit of armor - while they do not instantly pose a problem, it’s only a matter of time before they do. Global enterprises have an average of between 18 million and 24 million vulnerabilities across 60,000 assets, according to a study by Cynthia.

However, as vulnerabilities alone are not active threats, it becomes a big challenge for organizations to pinpoint what needs to be addressed and prioritized. More often than not, organizations face a plethora of vulnerabilities at any given time. Almost anything can become a vulnerability and a liability to network security such as unpatched operating systems, programmes running old software versions as well as siloed applications plugged into a new network. In addition, attackers may exploit “holes in the armor” that are unknown.

An effective vulnerability management programme starts with giving your organization the tools needed to understand its security weaknesses, assess the risks associated with those weaknesses, and put protections in place to prevent a breach.

To be truly effective amid the growing number and sophistication of threats, enterprises are increasingly adopting new ways to address security vulnerabilities.

“Traditional vulnerability technologies that perform a scan and report, are obsolete by current standards,” says Morey Haber, CTO, BeyondTrust. “These solutions often only present a snapshot in time that does not cover runtime vulnerabilities and intermittent changes that can create transient vulnerabilities; especially in the cloud.”