VULNERABILITY

MANAGEMENT
A HYBRID FRAMEWORK
APPROACH
Vishwanath P.R Yogesh B S
ABSTRACT
In this paper, we propagate the idea of a
framework for vulnerability management to
meet the Infrastructure security and
compliance requirements standards of an
organization.

Vulnerability management is the integral

component of a security program which
includes detection, assessments,
remediation and tracking.

This white paper provides an overview of

how to approach and manage a vulnerability
in the infrastructure until remediation.

The importance of this study is to promote

best practices on how to approach the
different categories of vulnerability in the IT
Infrastructure and ease the efforts of
security professionals in implementing a
good security program.
 VULNERABILITY MANAGEMENT 03

TABLE OF CONTENTS
Introduction 04

Vulnerability management program 04

Vulnerability Management is BAU (Business, As Usual) 04

Vulnerability Management Life cycle 05

Discover 06

Classification 06

Assessment 06

Report 06

Remediate 07

Verify 07

Vulnerability Management Process 07

Preparation 07

Vulnerability scan 07

Define remediating actions 08

Implement Remediating actions 08

Rescan 08

Key Features of Vulnerability management system 09

Security configuration management 09

Web server hardening 09

High risk software audits 09

Port audits 09

Zero-day vulnerabilities mitigation 09

Security Vulnerability life cycle 10

Traditional Framework 11

How vulnerability management is an upgrade from legacy IT ops processes 11

Patch Management 12

Patching Approach do's and don'ts 13

Demerits of traditional approach 13

Hybrid Framework 13

Glossary 14

Conclusions 16

References 16
 VULNERABILITY MANAGEMENT 04

INTRODUCTION
Vulnerability Management
Program
Every organization needs a Vulnerability Management for its assets connected to the
internet. Many industries are striving hard to be compliant with regulations. Most of the
attacks which are resulted in data loss are often caused due to usage of known,
unpatched vulnerabilities. Vulnerability Management comes handy for those assets on
your network that is not regularly monitored for patches.

Vulnerability Management is fundamental to Computer Security and Network Security,

which helps in identifying the vulnerability and takes necessary action whether to
eliminate, mitigate or tolerate vulnerabilities based on its risk and cost. Vulnerability
Management consists of several specific steps such as Discover, Classification, Assess,
Reporting, Remediation and Verification. This is a continuous process that monitors
closely and provides a feedback loop on the ongoing Network Threat Management.

Vulnerability Management is
BAU (Business, As Usual)
Vulnerability management is a continuous process that ideally helps organizations
better manage their Infrastructure vulnerabilities in the persistent future. A good
Security program is constituted from a matured model implementation which is an
ongoing process, and to protect organization and data, Vulnerability Management is
recommended as the best practice.
The Center for Internet Security (CIS) Top “20 Critical Security Controls”, like Basic CIS
Controls, Foundational CIS Controls and Organizational CIS Controls. Implementing the
CIS Top 20 critical security controls is a great way to secure and strength the
Organization network.

An effective list of Critical Security Controls for an

Organization security posture
Basic CIS Controls:

01 Inventory of Authorized and

Unauthorized Devices 02 Inventory of Authorized and
Unauthorized Software 03 Secure Configurations for
Hardware and Software

04 Continuous Vulnerability
Assessment and Remediation 05 Controlled Use of
Administrative Privileges 06 Maintenance, Monitoring, and
Analysis of Audit Logs
 VULNERABILITY MANAGEMENT 05

Foundational CIS Controls:

Email and Web Browser Limitation and Control of

Protections Malware Defenses Network Ports

Secure Configurations for

Data Recovery Capability Boundary Defense
Network Devices

Controlled Access Based on Wireless Access Control

Data Protection
the Need to Know

Account Monitoring and

Control

Organizational CIS Controls:

Security Skills Assessment

Application Software Incident Response and
and Appropriate Training
Security Management
to Fill Gaps

Penetration Tests and Red

Team Exercises

VULNERABILITY MANAGEMENT
LIFE CYCLE
Verification Discovery

Vulnerability
Remediation Management Classification
Life Cycle

Reporting Assessement

Figure 1: Vulnerability Management Life Cycle

 VULNERABILITY MANAGEMENT 06

The steps in the Vulnerability Management

Life Cycle are described below.
Discover
To discover assets in the organization, usage of automated tools which can help us identify IP based
devices to keep an accurate account of assets. Need for discovery process is a must to ensure inclusion
of all IP based devices. To do this, we need to prepare and keep track of hardware and software
inventory, and to identify all IP’s scanners should be able to scan the entire subnets or agent-based
approach. It is crucial to review and configure discovery scan settings at each cycle. Finally, credential
scan or authenticated scan reveal more information than just IP’s such as software installed,
databases, open ports, protocols, and services.

Classification
In this stage, we need to prioritize the assets by categorizing the business unit based on the criticality
to business operation. The main goal is not to attend the low priority assets while keeping the
high-impact assets vulnerable.

Assessment
The assessment stage includes identifying vulnerabilities through automated scans and credentialed
scans. In order to run a vulnerability management program, we must continuously reiterate the
configuration changes which provides breadth and depth of scanning range. Breadth is achieved by
scanning every asset in the environment. Depth is achieved by providing credentials. Ensure the
scanners are updated to the latest versions before running the scans, and all the non-intrusive checks
are enabled. One of the main challenges in the authenticated scans is credentials supplied in the policy
are not successful due to account lockouts, lack of permissions or ports such as 22, 139, and 445.
Note: All the scheduled scans are to be run in the window after the close of business, so that the
network congestion does not impact the network bandwidth.

Report
In this stage, the report generated should reflect the audience. There are different types of reports,
such as executive report, technical report, summary report, and remediation report. Knowing our
audience, we can generate reports in a different format. The security professionals refer the technical
reports, executive reports are generated for technical managers, and remediation report are generated
for the patch management team.
The Information security team needs information about the success of scanning strategies to track
remediation efforts.
 VULNERABILITY MANAGEMENT 07

Remediate

In this stage, the remediation efforts are tracked based on the plan of actions such as patches from
vendors (OS or applications), configuration changes like registry changes, version update, or upgrade.
Keep a rollback plan for any impact. When creating the plan of action’s, one must keep in mind the order
of preference like Prioritize and mitigate the vulnerabilities based on the business risk.

The number of counts the

vulnerability exists in the Age of the vulnerability Criticality of assets
infrastructure

Ease of exploitation Severity of vulnerability Zero days

Verify

Finally, to cross-check whether all the remediation efforts were successful or not initiating rescan with
the same configuration ensures that no vulnerability are present in the environment. Tickets need to be
closed after this step and keeping it as a reference for the future if any justifications required for
accepted vulnerabilities such as no patch for zero-days, business justification for legacy applications,
database or protocol in use should be documented.

VULNERABILITY MANAGEMENT
PROCESS
Vulnerability Management is the process of identifying, evaluating, treating and reporting on security
vulnerabilities in systems and software that runs on them. The Vulnerability Management Process
Involves five phases.

Preparation
The first phase in Vulnerability Management is the preparation phase. Instead of considering
thousands of vulnerabilities together, it is always recommended to start with a smaller number or by
limiting the number of vulnerabilities identified by the vulnerability scanner.
The Information Security Team handles all the responsibility of this preparation phase in an
organization. The very first step of the Vulnerability Management Process is defining its scope.
Obtaining an agreement is very important and to analyze which system to be included or excluded from
the Vulnerability Management Process. Besides the in-scope systems, an organization should also
determine the type of scans. The Scan performed might be from the perspective of an external
attacker on the external network or from the perspective of an internal attacker on the internal
network.

Vulnerability scan
Once the preparation phase is complete, the next phase of the process begins, and the initial
vulnerability scans are performed. Any issues which occur during the scans must be recorded as it
might happen again in the future like unavailability or poor application response. By recording this
information, it reduces the impact of future scans over the performance or stability of the target
systems. Most of the vulnerability scanning tools offer a wide range of reporting options to visualize
scan results, and it is necessary to use these tools to create numerous reports.
 VULNERABILITY MANAGEMENT 08

Management and Information Security team shows more involvement to know the risk organization is
currently facing that includes the rate of vulnerabilities detected and its severity of the detected
vulnerabilities. The owner of the assets wants to get an overview of vulnerabilities in the systems that
they are responsible.

The IT department will want an overview (per technology) of technical information about detected
vulnerabilities as well as recommendations for mitigation and improvement.

Define remediating actions

In the next phase, the asset owners, along with the Information Security team and the IT department,
will define remediating actions. The Information Security Team provides the input on risk remediation
by analyzing the vulnerabilities and identifying its associated risk.

After analyzing the vulnerabilities from a technical perspective, the IT department suggest on the
availability of the patches or whether to harden the configuration needs. The IT team also recommends
on the feasibility of the possible remediating action like whether they can avail the same support from
the vendor after updating patches.

The Information Security Team should set clear deadlines on the remediating action implementation in
order to ensure enough priority is given to remediation. Asset owners must have a timeline in their
action plan when to implement these remediating actions, and the timeframe should be in line with the
level of risk detected.

Implement Remediating actions

According to the agreed timeframe, remediating actions should be executed based on the plan. It is
always recommended to record if any problems occur and the asset owner should define an alternative
action based on recommendations by the Information Security Team and IT Department. Then these
new remediating actions should be implemented, and the Information Security Team should track the
status of remediating actions.

Rescan
Rescan must be scheduled to verify whether remediating actions have been successfully implemented.
Like the initial scan even this scan will be performed using the same vulnerability scanning tools and
identical configuration settings. This is a very important step to prevent inaccurate results due to
configuration errors. Generally, for implementing remediating actions, rescan is scheduled after the
deadline. Like the initial scan reports even for these the same types of reports are created.
The management and asset owners will be interested to know whether the remediating actions have
been effectively implemented and whether any residual risk remains. The IT department will be
interested in how effective the remediating actions have been implemented.
The security team will analyze the vulnerabilities throughout the vulnerability management process,
determine the associated risks and provides input on risk remediation. Further, from a technical
perspective, the team will analyze the vulnerabilities and provides information on the availability of
patches or whether to harden the configuration. This ongoing process has resulted in eliminating most
vulnerabilities that cybercriminals use to breach an organization.
 VULNERABILITY MANAGEMENT 09

KEY FEATURES OF THE VULNERABILITY

MANAGEMENT SYSTEM
Your vulnerability management system should be able effectively identify existing security and
software misconfigurations, high-risk software, web server misconfigurations, and other vulnerabilities
in your network.

Features to evaluate in a vulnerability

management program include:

Security configuration management

Detection of antivirus enablement, ensuring secured password policy, ensuring authorized administra-
tive share access, updated antivirus definitions, enabling MS Windows Firewall, folder share permis-
sions, browser configurations, checking elevation of user privileges, and more.

Web server hardening

Security hardening of web-facing servers is essential. Your vulnerability management program must be
powerful enough to secure communications via SSL to prevent attacks gated via the server. This will
help to prevent denial of service and brute-force attacks.

High-risk software audits

Keeping the EOL (End of Life) Software or Legacy Software within the business operation, which makes
them extremely vulnerable to exploits. Upgrade the EOL software, decommission the legacy software
and the application should be scanned and defined permission for use or blockade. This will help to
prevent the creation of new vulnerabilities that can invite attacks.

Port audits
Your Vulnerability Management program must have the capacity of controlling the firewall ports to
determine which applications require the firewall ports to be open or closed, especially on internet
servers. In case if inactive ports are open, then it might lead to exploitation by injecting trojans or other
malware.

Zero-day vulnerabilities mitigation

Zero-day vulnerabilities are barely exploited in the wild and do not come with patches. Vendors strive
hard to release timely patches before proof of concept is implemented. In such cases, a vulnerability
management program must help execute custom scripts in the form of tweaking registry key settings
or disable legacy protocols.

Did you know the ransomware WannaCry, which wreaked havoc in 2017 to businesses worldwide,
came with a simple fix for disabling the SMB (Server Messaging Block) V1 and closing port 445? A lack
of awareness led to widespread ransomware attacks.
 VULNERABILITY MANAGEMENT 10

SECURITY VULNERABILITY LIFE CYCLE

Vendor
Issue Patch
Vulnerability
Announced
Vulnerability
Discovered

Figure 2: Security Vulnerability Life Cycle

There are four stages in the security vulnerability life cycle:

Vulnerability Discovered Vulnerability Announced

This stage is when someone This is when websites designed for
discovers a vulnerability. announcing new vulnerabilities
post a warning about the new hole
discovered. At this stage, the
attacker is also checking these
websites to search for new
exploits.

Vulnerability Popularized Patch Released

In this stage, malware for The final phase of vulnerability is
this vulnerability is written when the vendor affected by the
and attackers would exploit vulnerability releases a patch to
them. protect against the attacks.
 VULNERABILITY MANAGEMENT 11

TRADITIONAL FRAMEWORK
Whenever a vulnerability is disclosed to the public through the CVE database, by the usage of
automation tools like Nessus, Qualys Guard, Rapid7 Insight VM network scans are performed to
discover, assess and report these vulnerability findings. When the vendor releases the patches for
vulnerabilities, the patch management team use patching tools to deploy monthly patches, cumulative
patches without the regard for impact analysis coverage. Without the proper process defined, it would
be a tedious task to align or synchronize different teams to manage vulnerabilities with ever-growing
CVE database. A lack of awareness of the impact of vulnerabilities among IT engineers leads to failure
of such traditional frameworks.

With considerations of the cons of traditional frameworks, adopting a hybrid framework was much
needed to implement a VM program.

How vulnerability management is an upgrade

from legacy IT ops processes
Vulnerability management is an upgrade from the conventional IT management processes and provides
an array of functionalities:

Inventory scanning Vulnerability assessment:

Taking inventory of the various Discovering all possible known
software assets and creating vulnerabilities that can lead to
custom groups based on OS and attacks.
applications.

Vulnerability mitigation Risk and threat prioritization

Providing remedial advice to Defining the risks based on the
thwart the vulnerabilities. severity and accordingly acting.

Most importantly for patch management, if patches are available for the known vulnerability, a built-in
patch manager solution can resolve the vulnerabilities quickly.
 VULNERABILITY MANAGEMENT 12

PATCH MANAGEMENT
New Patch
Release

Clean UP Prioritize

Audit (VM) Test/Deploy

Report

Figure 3: Patch Management

Patch management makes the process simple and easy to manage the patches and helps to acquire
the patches, installing and then testing them. It helps to keep the system updated on all the security
patches available. It also decides which patch should be used or which shouldn’t be.
The software companies carry patch Management in order to detect any software bug and then
release a patch for the same. A lot of difference has been seen since the inception of patches. Initially,
the patches were sent over the external media devices and that too as individuals stand-alone code
modules. It used to be based on traditional fee-licensing systems. But today in this digital era of web-
delivered systems and cloud computing, the delivery system has undergone a sea change. Now
patches are applied to programs over a global IP.

Eight easy steps that are used to implement

Patch Management:

Security & Automatic System Prioritization and

Patch Information Sources Discovery Scheduling

Testing Change Management Installation and

Deployment

Audit & Assessment Consistency and

Compliance
 VULNERABILITY MANAGEMENT 13

Patching Approach do's and don'ts

DO: Adopt regular patching cadence, Chase remediations and utilize risk score.
Don’t: Patch only when on fire, Chase Vuln Counts and Don’t prioritize CVSS
It is important to generate granular reports once the vulnerabilities are discovered and remedied to
help document for further purposes and security auditing. Enterprises need not have to worry about
cyber threats if the right vulnerability management program is in place and hence focus on other areas
of business.

DEMERITS OF TRADITIONAL APPROACH

With considerations of demerits of traditional frameworks, adapting a hybrid framework was much
needed to implement an effective VM program. We can indicate some demerits with the traditional
approach like complete removal of False Positive & False-Negative. False positive materializes when
the scanner, Firewall or Intrusion prevention system quotes the vulnerability is present in the
infrastructure whereas with False negative is the opposite, this quotes the vulnerability is not present
in the infrastructure.

Does not update or maintain All the vulnerabilities are

01 hardware and software asset
inventory
02 approached in a similar type.

03 Do not comprise of specific

skillset personnel in a team. 04 No residual cleans up.

05 Removal of old software’s. 06 No monitoring of updates.

07 Impact analysis. 08 No synchronization among

teams about the program.

With the above significant points in mind, we here propagate a hybrid approach with some of the
modifications from the NIST framework and other research conducted in the universities.

HYBRID FRAMEWORK
Here in this hybrid framework, the demerits of the traditional approach have been converted into
advantages. To introduces a new maturity model which has worked out in the current project. In this
paper, we present to you some of the key modifications done and how we were able to solve some
of the complex problems introduced in the Infrastructure vulnerability program. For example:
 VULNERABILITY MANAGEMENT 14

The reoccurrence of The problem persists even after

01 vulnerabilities – Supersede 02 patch deployment.

03 Coverage of impact analysis. 04 Creating a baseline for

reference to keep track.

05 Approach each category of

vulnerabilities differently

By the time we write this paper, the framework built has matured into running this program smoothly.
Security professionals can adopt this framework to make this better and seamless.

In the following section, we list the modifications

introduced in the framework.

Data segregation based on the Elimination of false positives,

01 category. 02 decommissioned assets.

Dividing each category of

03 vulnerabilities to a team 04 Implementing
changes
registry

member.

Review of vulnerabilities by
05 Clean-up procedure 06 manual observation in the
testbed environment.

Design and maintain

07 Ensure impact analysis is
covered in each stage patch test. 08 test plan.

09 Use of PowerShell Script to

monitor version updates.
 VULNERABILITY MANAGEMENT 15
For Example: Here with the help of PowerShell script, we can identify the version upgrade/update is
successful prior

$filename = "\Windows\system32\ntoskrnl.exe"
$obj = New-Object System.Collections.ArrayList
$computernames = Get-Content C:\Users\xyz\Desktop\Servername.txt
foreach ($computernames in $server)
{
$filepath = Test-Path "\\$server\c$\$filename"
if ($filepath -eq "True") {
$file = Get-Item "\\$server\c$\$filename"
$obj += New-Object psObject -Property @{'Computer'=$server;'FileVersion'=$file.VersionInfo|Select
FileVersion;'LastAccessTime'=$file.LastWriteTime}
}
}

$obj | Out-Host

select computer, FileVersion, lastaccesstime | Export-Csv -Path

'C:\Users\xyz\Desktop\File_Results.csv'

Categories of Vulnerabilities
Actions Zero Day OS Patch Application Patches Application Patches

Remediate Need Immediate Need to plan Update/Upgrade the Registry changes

Patch organizational Application Versions after patch
by vendor requirement deployment
accordingly (Month,
Quarterly and Half
yearly patch)

Deployment Implement Deploy patch, 2nd Need to update the Reboot after fix
workaround, if no Tuesday of the application patches
patch from the month every 15days
vendor (Microsoft patch
release)

Testing time Low Moderate/High Low Moderate

window

Complexity Critical Critical/High Medium/High Medium

Figure 3: Patch Management

 VULNERABILITY MANAGEMENT 16

CONCLUSION
Here we conclude by stating that the framework propagated is a continuous and
on-going process which needs correction and execution in the Organization. The work
and study conducted predominately over the windows environment.
By adopting these framework security professionals need to modify based on their
Organization’s requirements and business risk. Since different organizations have
different needs and requirements, one needs to establish the importance of security
policies as per organizational requirements and implement them accordingly.

AUTHOR BIO
Yogesh Babu B S has over 12 years of experience in IT Indus-
try as Server Administrator, VMware and Information Security.
He is currently a part of the Infrastructure Management and
Security Services Business unit in Happiest minds Technologies
Ltd. He is responsible for Security Vulnerability Management,
Vulnerability Assessment Project, SCCM, Servers, Microsoft
Exchange and emerging technologies.

Vishwanath P R has over ten years of holistic experience in

the field of Information Security. He is currently a part of the
Infrastructure Management and Security Services Business
unit in Happiest minds Technologies Ltd. He is responsible for
Web Application Security, Infrastructure Vulnerability
Assessment, Penetration Testing, and Vulnerability
Management.

Business Contact

About Happiest Minds Technologies

Happiest Minds, the Mindful IT Company, applies agile methodologies to enable digital transformation for enterprises and technology providers
by delivering seamless customer experience, business efficiency and actionable insights. We leverage a spectrum of disruptive technologies such
as: Big Data Analytics, AI & Cognitive Computing, Internet of Things, Cloud, Security, SDN-NFV, Blockchain, Automation including RPA, etc.
Positioned as “Born Digital . Born Agile”, our capabilities spans across product engineering, digital business solutions, infrastructure management
and security services. We deliver these services across industry sectors such as retail, consumer packaged goods, edutech, e-commerce, banking,
www.happiestminds.com
insurance, hi-tech, engineering R&D, manufacturing, automotive and travel/transportation/hospitality.

A Great Place to Work-Certified™ company, Happiest Minds is headquartered in Bangalore, India with operations in the U.S., UK, The Netherlands,
Australia and Middle East.