-: So up until this point we've talked a lot about scanning.
But what do you do once you have those scan results?
Well, you've got to remediate the vulnerabilities,
and in this lesson we're going to talk about
what that work flow should look like.
There's really three steps inside vulnerability management.
There's the detection of the vulnerability,
the remediation of the vulnerability,
and then testing to ensure that vulnerability
has been properly remediated.
And then, we start that cycle all over again.
Detection, remediation, testing.
Over and over again.
So, this is what we would call continuous monitoring,
because we're doing ongoing scans of our network
in a circular method and we continually are doing it
over and over again.
Hence, continuous monitoring.
This is going to check for vulnerabilities
as often as possible based on the resources available.
Now, this can be a continuous thing where we scan,
and then we stop, and then we scan again, and then we stop.
Or, it can be a thing where we say,
okay, once a week we're going to do a scan,
and that is what we define as continuous monitoring
in our organization.
It just depends on how you want to do that.
This is going to provide early detection
of vulnerabilities, 'cause the more frequently
you're doing scanning,
the more likely you're going to find
the vulnerability quicker.
Now, the big limitation here is
you're only going to find things based on
plug ins in vulnerability signatures that your tool has.
So if the new vulnerability or new threat
hasn't had a associated signature with it,
your scans are still not going to find it.
So continuous monitoring only helps to a point,
but it's the best that you've got and the best you can do.
Automation.
Many products have built in workflows
that will help you do automation
to track your vulnerabilities through their life cycle.
So for instance, if your using Qualysguard,
you can actually integrate that with your
trouble ticket system so that when it finds a vulnerability,
it will establish a change ticket, push that over to the
system administrator's queue, where they can then
install the patch, and then it will go back to you to
re-scan and make sure that it has been patched properly.
This can automatically close out vulnerabilities
once the scan has detected that they are no longer there
and it can create tickets for you, like I said,
in your trouble ticket system.
This is really helpful from a service management perspective
because it is going to save a lot of time
and a lot of emails going back and forth
because it's all inside of a centralized system.
This is going to help you as part of that process of
detection, remediation, and testing,
because if I detect the vulnerability,
I then create the ticket automatically to
remediate the vulnerability with the system administrator.
It then gets pushed back into my queue to re-scan,
that's the testing piece,
to make sure the vulnerability is no longer there.
Right? One, two, three, going detection,
remediation, and testing over and over.
That's the basic workflow you need to understand for
vulnerability management.
Now in your organization, that may look a little different
what steps are involved in each of these three major steps,
but those are the three major steps you need to understand
for vulnerability management.
(electric noise)