What is Vulnerability Management?

Vulnerability management is a technical practice that maps the “output of information security technology to define the risk priorities for organizations.” Mapping and managing vulnerabilities requires several processes, including:

• Assessing threats and vulnerabilities.
• Knowing acceptable configurations and policies.
• Identifying deviations from those accepted practices.
• Determining risk levels.
• Offering remediation and mitigation recommendations.

Limitations of Traditional Vulnerability Management Tools

As more unmanaged devices — Industrial Internet of Things (IIoT) sensors, connected medical equipment, operational technology (OT) and industrial control systems (ICS) devices, smart TVs, and other devices — become part of an organization’s connected environment, the number and variety of potential vulnerabilities increases. At the same time, these kinds of devices often don’t appear on traditional security scans, and scans can impede unmanaged device function or cause them to stop working altogether.

With so many connected devices coming online all the time (56 billion worldwide by 2025), attackers are increasingly focused on device vulnerability identification and exploitation. Traditional scans not only miss or potentially disrupt unmanaged devices, but traditional scanning schedules may also overlook the emergence of newly identified vulnerabilities, creating a time gap during which attacks can proliferate. In order to keep the enterprise secure, identifying and managing vulnerabilities at scale and at speed is more important than ever.

Continuous Vulnerability Management Best Practices

Device discovery, OS and software identification, and vulnerability assessment are still critical elements for effective vulnerability management, but traditional agent-based scans can’t fully deliver those capabilities.

Today, enterprises need an agentless platform that can discover all devices in the environment without disrupting their functions, and that can continuously monitor those devices for known or new vulnerabilities. That approach requires the ability to compare discovered devices to a database of similar devices to get a baseline for firmware, software, and normal (or abnormal) device behavior.

Device behavior monitoring is critical because anomalous behavior is an early indicator of a vulnerability, threat, or incident. A comprehensive solution will learn each device’s communication profile, such as its position within the network or environment, which devices it communicates with, which protocol it uses, and communication frequency and volume. When a device behaves outside its normal range, the solution can alert the security team, enforce automated policies, and isolate or disconnect the device.