Security Bloggers Network Vulnerabilities

Vulnerability Management: Myths, Misconceptions and Mitigating Risk
Vulnerability Management: Myths, Misconceptions and Mitigating Risk

by Joe Pettit on April 4, 2019

Vulnerability Management is a much-talked-about practice in the IT security industry. Whether it is the debate on vulnerability scoring, how to implement a suitable vulnerability management program based on your own resources or even trying to convince leadership a vulnerability management solution alone won’t solve all your cybersecurity issues, the debate is still strong.

To try to understand vulnerability management in more detail, we asked a range of people in the industry a couple of questions:

What’s the one common myth or misconception around vulnerability management?

Tyler Reguly | Manager, Software Development, Tripwire VERT

@treguly

I’m torn between two myths, so I’m going to touch on both of them.

First, we have the belief that vulnerability management and patch management are the same. This is a myth in itself, but it is perpetuated by a second myth: the idea that patches always fix vulnerabilities. Many vulnerabilities are only resolved by a configuration change, (Oracle’s TNS Listener Poisoning vulnerability comes to mind.) or they require a patch and a configuration change. Oftentimes, these configuration changes are overlooked, leaving a system vulnerable. This is why a mature vulnerability management program is so important for enterprises.

The second myth may be more detrimental than the first. Patching with no consideration for additional steps that may be required is itself a misstep, but assuming you can tackle every vulnerability immediately is a critical mistake. It is important to realize that vulnerability resolution should be prioritized and tackled with a plan. Applying patches haphazardly can lead to improperly ordered patch installations, events which create needless work and further strain already taxed operations teams. It is important to apply strategy to the application of patches and develop a prioritization process that works for the organization.