The evolution of the cyber threat landscape highlights the emerging need for organizations to strengthen their ability to identify, analyze and evaluate cyber risks before they evolve into full-fledged security incidents. When it comes to cyber risk mitigation, the terms “patch management” and “vulnerability management” are used as if they are interchangeable. This is absolutely not the case; in fact, they are confused because applying patches is one of the many ways to mitigate cyber risks.
The decision to either roll out, unroll or disregard a specific patch falls within the larger context of vulnerability management. Defined as “a security practice specifically designed to proactively mitigate or prevent the exploitation of IT vulnerabilities,” vulnerability management is not a stand-alone scan-and-patch function. It’s a holistic function that takes a proactive view of managing the daunting task of addressing identified vulnerabilities in deployed hardware devices and software. Simply put, vulnerability management is a superset of patch management.
Vulnerability management is more than just getting alerts whenever your infrastructure needs a patch applied. Vulnerability management is about making informed decisions and properly prioritizing what vulnerabilities to mitigate and how. This is achieved by embedding internal hooks for telemetry into all systems of interest as well as external hooks for threat intelligence from all sources.
Vulnerability management has to be backed up by good threat intelligence that provides a deeper understanding of how and why threat actors are targeting certain vulnerabilities and ignoring others. Intelligence on vulnerability exploitability prepares your organization to strike the correct balance between patching vulnerable systems and interrupting business operations. A risk-based approach to vulnerability management makes it much easier to communicate the danger of a vulnerability across your security and operations teams up through senior managers and even to the board. This level of visibility (Read more...)
*** This is a Security Bloggers Network syndicated blog from The State of Security authored by Anastasios Arampatzis. Read the original post at: https://www.tripwire.com/state-of-security/vulnerability-management/build-mature-vulnerability-management-program/