ASD Essential Eight: Patching and Vulnerability Management – How to get it right

The Australian Signals Directorate’s (ASD) Strategies to Mitigate Cyber Security Incidents was published back in February 2017  – The ASD Essential Eight.  Two of those eight strategies relate to (i) application patching to prevent malware running and; (ii) operating system patching to reduce the damage an incident can cause and help recover data. Both patching strategies fall into the larger field of vulnerability management, although there is some misunderstanding between the meaning of vulnerability management and vulnerability assessment. It’s important to know the difference to ensure any patch deficit is managed as effectively as possible.

Vulnerability Management vs Vulnerability Assessment – confusion in these terms leads to unprotected businesses and unmanaged risks. So what is Vulnerability Management?

In its most basic form, vulnerability management is the process shown in Figure 1, where vulnerabilities are somehow discovered, then through assessment, to remediation so the process verifies the fixes before proceeding on to the discovery phase again. This is a continual process that requires scanning and assessing vulnerabilities on an ongoing basis to understand exactly where the weaknesses are, what’s being done about them and detecting any new ones that may become known.

Figure 1 The Vulnerability Management Process

Vulnerability Scanning in the Discovery Stage

There are a variety of tools on the market that can perform the vulnerability scans that are required in the discovery stage. One such product is Tenable’s Nessus which is often used by consultants to assess the current security posture of an enterprise. But here’s the problem – the point in time scanning and reporting activities represent only half of the overall Vulnerability Management Process in Figure 1. The information is quickly out of date as new vulnerabilities are discovered.

The importance of completing every phase of the Vulnerability Management Process

Linking this back to Figure 1, patching applications and operating systems are part of the “remediate” step in the process i.e. with the patch deficit being a subset of the total number of vulnerabilities needing to be fixed in the organisation. To be successful in managing vulnerabilities, and ASD Essential Eight compliance, security teams must focus on completing every phase of the vulnerability management process and not just assessment.

There are a number of enterprise ready vulnerability management tools on the market that can assist in initiating the full process. Real-time scanning tools that ingest the latest exploitation and vulnerability information and then scan your systems to report any risks are a key element of the process. This allows the security team to prioritise what is to be remediated while at the same time acknowledging that compensating controls and network architecture can affect that contextualisation and the resulting risk prioritisation.

How Protective Monitoring helps manage weaknesses

So, what does effective monitoring look like? The ASD Essential Eight omits protective monitoring from its advisory, but a well implemented monitoring capability is the feedback system that measures the success of your mitigation efforts. By feeding vulnerability notifications into the SOC as Threat Intelligence, the monitoring team can identify weaknesses and as necessary increase vigilance on any given device until it’s been patched.

If a vulnerability is discovered in an Oracle database, for example, the SOC knowing about it ensures their attention is focused on who is accessing it, what kind of data is being exfiltrated and any other unusual characteristics. If someone tries to exploit that vulnerability, the SOC team can instantly pick it up and prevent an attack.

Bruce Schneier, the internationally renowned security technologist, continually repeats the mantra that security is a continual process; and he’s absolutely right. Cyber security is not – set and forget.

Use Protective Monitoring to safeguard your business.  Check out our  infographic