Containing vulnerabilities

Your vulnerability-assessment software is working great, churning out loads of information on your security soft spots. The problem is, it's working a little too well. You've got so much data from network scans, you can't figure out which security concerns are the most pressing, let alone how to address those quickly and effectively.

Enter the emerging field of vulnerability management. Vulnerability-assessment and other security vendors, such as Foundstone, Qualys, Symantec and Vigilinx, offer new products, feature upgrades or services that help you figure out what to do after the scan. These offerings typically identify which vulnerabilities can affect your network and which need immediate attention.

The ability to manage vulnerabilities, not just scan for them, comes none too soon. The number of vulnerabilities is skyrocketing, according to CERT. It reports the number of computer vulnerabilities for the first half of this year at 2,148 compared to 2,437 for all of 2001.

"Companies need to prioritize the application of security fixes based on the risk to the business," says Michael Rasmussen, a research director at Giga Information Group.

Services, software combo

State Employees Credit Union, a Lansing, Mich., provider of financial services, has found the coupling of an outsourced service with vulnerability-management software an effective way to manage increasing network threats. Because it has extended its network in recent years with wireless automated teller machines and Web-based home banking applications, the credit union has watched potential vulnerabilities rise.

Worried that conventional vulnerability-assessment tools couldn't keep up with new threats, and knowing that he couldn't afford to devote a staff member to full-time vulnerability scanning, Alan Darbe, vice president of IS at the credit union, says he decided to try Digital Defense's Frontline service and vulnerability-management tool. With Digital Defense's help, Darbe quickly evaluates reported vulnerabilities to determine the financial and operational risk to the firm. Then, using the vulnerability-management software, he and his team immediately address high-risk threats. The software also updates the fixes as needed.

Previously, the credit union had "no formal way of assessing vulnerabilities" to stop attacks, Darbe says. "Now we're taking a more proactive approach."

For example, a Digital Defense scan showed that an intruder could get access to internal passwords. Needless to say, the credit union fixed that problem.

The credit union spends about $50,000 per year for the vulnerability-management service, which Darbe says has greatly eased and speeded up the process of tracking and fixing security soft spots.

The money on vulnerability management is well spent, he adds, because information security is a priority for the firm, which holds hundreds of millions of dollars of members' savings.

Making the impossible, possible

If you're looking for a stand-alone vulnerability-management tool, expect to spend in the tens-of-thousands of dollars range. Base prices range anywhere from $10,000 to $50,000, with additional charges per IP address, or device, to be scanned (see chart).

The reporting capabilities are worth the investment in vulnerability-management tools, some users say. At Lancaster General Hospital in Pennsylvania, IS Security Manager Terry Grogan relies on PentaSafe Security Technologies' VigilEnt Security Manager vulnerability-management tool to guard against attacks to its mixed network of Unix and Windows NT servers.

The software continuously audits networks and systems for vulnerabilities, recommends corrective action and generates detailed reports nightly across computing platforms.

The hospital uses the product mostly for its reporting capabilities, Grogan says. "It lets me know user activity levels and alerts me to any significant security events, weak passwords or other concerns. In the past I had to read 110 network logs a day to see if there was any suspicious activity. It was an impossible chore. I looked at only our most critical servers because l didn't have the time to look at anything else," she explains.

At Motorola, security managers had relied on sporadic reports from division-level operations staff for its vulnerability assessments. "In some cases, they did a really good job; in others they were not as diligent. So we had wide disparities in our degree of visibility," says Bill Boni, chief information security officer at the Schaumburg, Ill., company. Now Motorola uses Foundstone's FoundScan software to centralize vulnerability scanning on its global network, which operates in 47 countries and connects 200,000 devices, and to assess the risk of found vulnerabilities, he says.

Using the software, Motorola scans its internal network for vulnerabilities every month and its network perimeter every other week, Boni says. The Foundstone software identifies what threats are the biggest risks, he adds. Motorola used to scan the network only several times each year; it was prohibitively costly to scan more often because of the network's vast size, he notes.

With vulnerabilities identified and prioritized, you will also need firm procedures for applying needed fixes quickly (see story, "Practical patch management"). The team approach works for some. Cincinnati Children's Hospital in Ohio has a 10-person incident response team, with individuals specializing in areas such as virus protection, Internet security, intrusion detection, firewalls and various operating systems. Team members are notified whenever a vulnerability is found, and gather when an exploited vulnerability would have high impact on the company.

"Our policy is if there's any kind of vulnerability — whether it comes in from the help desk or anywhere else — it goes to the [security] team," says Mike Belmont, associate director of IS security at the hospital.

No doubt, as the number of security threats rises, vulnerability management will become a standard part of corporate security strategy.

Violino is a freelance writer covering business and technology. He can be reached at bviolino@optonline.net.

Buyer's Guide: Vulnerability-assessment tools
Vulnerability-assessment tools edge toward usefulness in large networks.
Network World, 02/04/02

Defending the extended enterprise
Are firewalls enough? Should you invest in a bundled security product? What type of security planning should you undertake? We explore what it takes to secure your changing enterprise in this special report.
Network World, 07/29/02

Security research center
Get the latest news, alerts, opinions, reviews and more.