How do you balance vulnerability assessment with performance and usability?

由人工智能和领英社区提供技术支持

Vulnerability assessment is a crucial process for identifying and prioritizing security risks in your systems and applications. However, it can also have an impact on the performance and usability of your assets, especially if you conduct frequent or intrusive scans. How do you balance vulnerability assessment with performance and usability? Here are some tips to help you achieve an optimal trade-off.

此文章中的业界达人

由社区从 9 条内容中精选。了解更多

1 Plan and scope your assessment

Before you start scanning, you need to define the goals, scope, and schedule of your assessment. This will help you focus on the most relevant and critical assets, avoid unnecessary or redundant scans, and minimize the disruption to your normal operations. You should also consider the potential impact of your assessment on the performance and usability of your assets, such as network bandwidth, system resources, availability, and functionality. You can use tools like threat modeling and analysis to identify the most likely and severe threats, and prioritize your assessment accordingly.

添加您的观点

Ajay Upadhyay

Information Security Expert / Cyber Security Enthusiast CISSP, CISM, CRISC, CCSP, CEH, CISA
举报内容
Balancing vulnerability assessment with performance and usability: >Focus on critical system scanning to minimize performance impact. >Scan during off-peak hours to further minimize user impact. >Systems should not be overburdened through scanning to maintain usability without compromising for security. >User feedback provides basis for optimizing scanning strategy. >Enough resources are allocated to avoid system overwhelm due to scanning. >Process automates and prioritizes critical vulnerabilities balancing overall assessment while ensuring system usability.

已翻译

赞
john riotte

Meta Global Security, Data Center Area Manager at META, Author of: "Your Range Card for Life", Performance Testing, Adversary Task/Timeline Analysis, Physical Security, Red Team/OPFOR, Threat/Risk Analysis
举报内容
IMHAOWO...I always believe the start point should be "the goal"...what is it we really want to do here??? Even if the VA is a quick decktop exercise to ID potential exploitable vulnerabilities.

已翻译

赞

加载更多内容

2 Choose the right tools and methods

There are different types of vulnerability assessment tools and methods, such as active or passive, authenticated or unauthenticated, black-box or white-box, and so on. Each one has its own advantages and disadvantages, depending on the context and objectives of your assessment. You should choose the tools and methods that best suit your needs, while minimizing the impact on the performance and usability of your assets. For example, you can use passive or unauthenticated tools to scan for external or visible vulnerabilities, without affecting the internal operations or functionality of your assets. You can also use white-box or code analysis tools to scan for internal or hidden vulnerabilities, without requiring access to the live system or application.

添加您的观点

Felipe Mafra

CISO Americas and Asia-Pacific at Hitachi Rail
举报内容
If you are concerned with performance consider deploying scanning appliances on each network zone (most vendors provides unlimited virtual scanning appliances without extra charges). You should also consider scanning agents deployed on each device (servers and workstations where most vendors usually do not charge extra); usually scanning agents consumes minimal processing and memory from the devices, sharing results once scan is complete through a single port and specific URL, also not impacting bandwidth. If you consider manual tests (a.k.a penetration tests), make sure the tester do not perform anything that could generate unavailability of systems (if it's an external party, consider adding this in the contract)

已翻译

赞

3 Configure and customize your scans

Once you have chosen the tools and methods for your assessment, you need to configure and customize them to match your specific requirements and preferences. This will help you reduce the false positives and negatives, avoid unnecessary or harmful scans, and optimize the accuracy and efficiency of your assessment. You can configure and customize your scans by adjusting the parameters, such as the scan frequency, intensity, depth, speed, timeout, and so on. You can also customize your scans by selecting the appropriate scan profiles, policies, rules, plugins, and so on, depending on the type and nature of your assets.

添加您的观点

Felipe Mafra

CISO Americas and Asia-Pacific at Hitachi Rail
举报内容
You may want to consider automated weekly scans on your critical environment utilizing a default set of ports. Most vulnerability scanners have preset a list of ports which most vulnerabilities are identifiable, and one full scan to be performed monthly. Although, this are usually heavy and may overwhelm your network; to minimize this risk, you may consider deploying virtual scanner appliances on each network segment or agents. I'd also consider full monthly scans (ideally a day or two post "patch Tuesday" as usually several zero-days are disclosed), so you can have metrics and new findings addressed right away

已翻译

赞

4 Monitor and manage your scans

During your assessment, you need to monitor and manage your scans to ensure that they are running smoothly and effectively, without causing any significant or unexpected impact on the performance and usability of your assets. You can monitor and manage your scans by using tools like dashboards, reports, alerts, logs, and so on, to track the progress, status, results, and issues of your scans. You can also manage your scans by using tools like pause, resume, stop, cancel, and so on, to control the execution and termination of your scans. You can also use tools like feedback, ratings, comments, and so on, to collect and share your opinions and experiences about your scans.

添加您的观点

Felipe Mafra

CISO Americas and Asia-Pacific at Hitachi Rail
举报内容
As scans are performed, review results and compare progress of vulnerabilities that are remediated. Now, in order to keep your progress rolling you have two options: either you go and enable auto-patch, or work with asset owners on a very collaborative and #teamplayer approach otherwise you won't progress much.

已翻译

赞

5 Analyze and act on your findings

After your assessment, you need to analyze and act on your findings to improve the security and resilience of your assets. You can analyze your findings by using tools like charts, graphs, tables, metrics, and so on, to visualize and summarize the data and insights from your scans. You can also use tools like filters, sorting, grouping, and so on, to organize and prioritize your findings according to the severity, impact, likelihood, and urgency of the vulnerabilities. You can also use tools like recommendations, remediation, patches, and so on, to fix or mitigate the vulnerabilities in your assets.

添加您的观点

Felipe Mafra

CISO Americas and Asia-Pacific at Hitachi Rail
举报内容
One simple advise is to not just share automated reports with system owners, indicate the ones that are most risky (like sensitive to business or storing/processing sensitive information and exposed to threats, like web applications/DMZ servers) compared with criticality of the vulnerability and exploit availability. As you start seeing progress, share the good news and keep your team motivated. A few metrics that helps to visualize progress: - Aging vulnerabilities (below 30 days, between 31 an 60 days, etc.) - New, recurrent and mitigated comparison - Number of critical and high severity etc.

已翻译

赞

6 Review and improve your assessment

Finally, you need to review and improve your assessment to ensure that it is aligned with your goals, scope, and schedule, and that it is delivering the expected value and benefits. You can review and improve your assessment by using tools like feedback, ratings, comments, and so on, to evaluate and measure the effectiveness and efficiency of your assessment. You can also use tools like lessons learned, best practices, tips, and so on, to identify and implement the improvements and enhancements for your assessment. You can also use tools like benchmarks, standards, guidelines, and so on, to compare and comply with the industry norms and expectations for your assessment.

添加您的观点

Don P.

CISO | vCISO | Board Advisor | Security Executive | Speaker | Mindset Coach
举报内容
Another item to consider is using a native scanner for say Azure or AWS clouds. Using native scanners in cloud can showcase different results then traditional scanners. Running both a native cloud scanner and a more traditional scanner gives you added insight and assurance.

已翻译

赞
Felipe Mafra

CISO Americas and Asia-Pacific at Hitachi Rail
举报内容
This is a continuous effort and a lifecycle that should be based on the following: - Detect/discover: Perform vulnerability and discovery scans. So you can keep up with weaknesses introduced into your environment not just via vulnerabilities but also with new assets or rogue assets; - Review and prioritize: identify vulnerabilities that should be remediated first. Use a risk based approach where you will look to the asset exposure to threats and risks to the business against exploitability - Remediate: based on your analysis, communicate with asset owners and provide support on this activity as it's the most challenging part of this program. - Report: review findings, check progress and let everyone know the good work the team is doing

已翻译

赞

Vulnerability Assessment

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How do you balance vulnerability assessment with performance and usability?

1

2

3

4

5

6

1 Plan and scope your assessment

2 Choose the right tools and methods

3 Configure and customize your scans

4 Monitor and manage your scans

5 Analyze and act on your findings

6 Review and improve your assessment

Vulnerability Assessment

给文章评分

感谢您的反馈

更多Vulnerability Assessment相关文章

更多相关阅读内容