Track and Report on Vulnerability Metrics

Learning Objectives

After completing this unit, you’ll be able to:

Explain how to track system vulnerabilities over a period of time.
Describe how to improve your vulnerability assessment program.

Track Vulnerabilities Over Time

It doesn’t take much for an organization to quickly become overwhelmed with the amount of vulnerabilities they find. To efficiently keep track of these, measure yourself against key performance indicators. These metrics allow you to keep up with system vulnerabilities over a period of time to better understand how your organization’s cyber risk posture evolves. Tracking and reporting of vulnerabilities is the key for your organization to enhance its cybersecurity maturity. A recent report by Fortinet found that leaders in operational technology are 133% more likely to report on vulnerabilities found and blocked than other organizations. Similarly they found that less than half of the bottom tier survey respondents adhered to this best practice.

So, what data should you use to enhance your vulnerability management program? Some metrics to consider include:

What percentage of your organization’s assets are covered by regular vulnerability scanning?
How frequently are assets scanned?
How many critical vulnerabilities are in your internet-facing systems?
How many of these critical vulnerabilities have known exploits?
How long does it take for known vulnerabilities to be detected?
How long on average does it take the organization to patch known vulnerabilities?

When reporting on the success of your vulnerability assessment program it is key to analyze and report on the results and risk in business terms. This helps ensure that even nontechnical leaders at your organization understand the value of timely vulnerability remediation.

A vulnerability analyst explains a report with graphs symbolizing reporting on metrics.

Continuously Improve Your Vulnerability Assessment Program

Attackers never stop trying to take advantage of vulnerabilities. As long as exploits exist, you need a process in place to continuously find and remediate your vulnerabilities. Continuous vulnerability assessments are an important part of effective and mature cybersecurity programs. You should regularly run automated vulnerability scanning tools against all systems and quickly remediate any vulnerabilities.

Another tool in your arsenal is to consider implementing a bug bounty program to identify vulnerabilities to systems and reduce cyber risk. These programs are widely used and reward researchers for uncovering certain types of “bugs.” The more severe the bug, the higher the reward. Many bigger organizations, some smaller organizations, and a lot of government entities use these especially for detecting unknown or nonpublic bugs.

Progressively automating as much as possible to enable visibility can help continuously improve your program over time. It’s also important that you and other cybersecurity professionals in your organization commit to an ongoing vulnerability management program. After all, threat and vulnerability management is a program (not a project)—it never ends. You should also take the initiative to help others in the organization understand vulnerability management and remediation best practices. Lead instruction and training for system administrators. Finally, if you see a better way to do something, speak up. Work to improve vulnerability management policies, procedures, and standards. This strengthens your organization’s security armor for the long term.

Knowledge Check

Ready to review what you’ve learned? The knowledge check below isn’t scored—it’s just an easy way to quiz yourself. To get started, drag the description in the left column to the appropriate True or False option area in the right column. When you finish matching all the items, click Submit to check your work. If you’d like to start over, click Reset.

Sum It Up

A mature vulnerability assessment approach significantly minimizes your cyber risk exposure and enhances your baseline of protection across your organization’s systems and data.

In this module, you’ve been introduced to methods for identifying your vulnerability footprint and scanning and assessing vulnerabilities. You’ve also learned how to integrate vulnerability data for analysis and track and report on vulnerability metrics.

Along with the information you reviewed in the Vulnerability Assessment Module, you should now have a better understanding of what it takes to be a vulnerability assessment analyst. You can learn more about the in-demand cybersecurity skills necessary to get a job in vulnerability assessment, or another field, and learn more from real security practitioners by visiting the Cybersecurity Learning Hub on Trailhead.

¿Necesita ayuda?