How do you update the scope of a vulnerability assessment over time?

I would also add to utilize a VA for cyber/IT...to look at the physical aspect of a VA....can a bad actor gain access to the physical system...wherever that system may be housed_JJR

It might be helpful to think of vulnerability management as a coordinating function, while vulnerability assessment is the technical execution of the task. Vulnerability management is concerned with identifying scope and coordinating multiple related tasks (asset, patch, secure config management, maintenance), whereas assessment is primarily concerned with assuring that the task is executed on time, on target, and producing the expected quality results, e.g. 98% hit rate using a credentialed scan.

Updating VA scope includes: >Set regular assessments which are in order to the current state of the security needs and threat landscape. Include lessons from previous assessments in the updating scope. >Monitor changes in newly created assets and systems, configurations within the systems brought in new vulnerabilities. >Monitor emerging threats and update the scope in respect of assessments for newly identified threats and vulnerabilities. >Monitor changes in regulations and refer compliance audits to assess and change the scope. >Have frequent meetings to gain opinions on possible changes in the scope. >Update all documents detailing any scope changes and communicate such changes to every client.

Evaluate the organization's risk profile. Consider factors such as stored data types, potential threats, and regulatory requirements. This assessment helps in identifying areas that need more attention.

I would start with the CIA Triad and begin to breakdown all possible events that pertain to each section of the triad along with the probability, criticality, and severity of outcome and assign an overall level of risk low, moderate, high, extremely high. Then I would identify mitigation strategies. Once i have all of these, I gather metrics based on these factors to identify how many times per quarter they have occurred and develop controls to prevent them from occurring moving forward. Monthly checks and quarterly reviews for possible variations and evolutions of current threats. Risk Management is cyclic in nature, so you have to continuously monitor and adjust your position to account for new and unexpected threats.

You can start with a few assets first and scale as you progress. For example, consider your exposure to threats and assurance of business continuity. With that, you may consider scanning assets that are exposed to the internet + critical/sensitive servers. You may consider including a few workstations too (not all, perhaps VIP users and IT/system administrators). If you are able to remediate at least critical and high severity vulnerabilities within the first 12 months, just ask the vendor to add more IPs into your subscription; or just wait for the renewal

As you progress on remediating vulnerabilities based on exposure and risks to your organization, you may consider expanding to less critical servers/systems. Remember, a single vulnerable asset is enough for a threat actor to exploit it, gain access and move freely within your network

This documentation could also be a form of policy, so set rules on what should be part of your scope. For example: all servers in production must be scanned against vulnerabilities on a weekly basis. This way, if something is planned to go to production, the project team must involve you on that and add this into scope. Although, make sure you also implement measures to monitor the environment with discovery scans, so you can detect possible policy violations while you keep your environment compliant

Having a routine of discovery scans is a good way to validate if all devices in your defined scope truly are. For missing devices, you could cross with the CMDB to confirm of check with your internal teams. Remember this is also a good source to detect possible rogue devices in your environment.

Once you reach an acceptable maturity level, expand your scope to non-production environment, such as QA and Development which can help your teams to prepare internal applications to the most up-to-date version without the need to re-code as patches needs to be applied in production. Additionally consider adding workstations as users are the most targeted for cyber attacks, and vulnerable workstations just support artifacts to expand and make a mess