Essential Guide

How to hone an effective vulnerability management program

Knowing your system's weak points is the first step to crafting an effective defense. Learn how to create a potent vulnerability management program from initial assessment to tool selection, and keep bad actors at bay.

Introduction

Security teams deal today with a barrage of new, rapidly evolving threats. An effective vulnerability management program is essential if an enterprise is going to survive in the modern threat landscape. This guide offers information and advice on topics -- like risk assessment, penetration testing, and patch and configuration management -- that security professionals need to know to craft an effective vulnerability management program.

1ASSESSMENT-

Vulnerability risk assessment

Making a vulnerability management program effective means first knowing its purpose -- that is, know what it needs to accomplish. In this module, learn how to both identify and rank your system's security weaknesses, so your program focuses on the most significant threats first. A thorough assessment includes first making sure your system meets the security controls required by law and by industry regulations. Even then, though, there are likely to be gaps, or "residual risks." You'll need to know what these are and how to handle them in order to fine-tune your program.

Tip

Network security vulnerabilities: What matters most?

Risk management programs produce piles of data on your network's security vulnerabilities. Here's now to rank the risks so you can prioritize remediation. Continue Reading

Tip

Security soft spots: Advice for specialized companies

How can a university hospital or an auto parts manufacturer identify their data security weaknesses? Information security architect Nick Lewis offers an effective process. Continue Reading

Tip

Eliminate residual risks with this step-by-step assessment process

Even after an organization applies security controls to comply with laws and regulations for their industry, data management gaps inevitably remain. But there are five steps you can take to identify and offset them. Continue Reading

Answer

Assessing risks with a RACI matrix

Learn how to assess info security risks with the responsibility assignment matrix. Continue Reading

Tip

Vendors and the evolution of threat detection and management

As malware gets smarter and more dangerous, vendors are upgrading defensive products essential to stopping it. Continue Reading

Feature

The latest vulnerability management products

Learn which products scored highest with SearchSecurity readers in the vulnerability management products category. Continue Reading

Tip

These five tips will improve your vulnerability management program

There's a barrage of threats coming for your system, so an effective vulnerability management program is a must. Here are five ways to make yours even better. Continue Reading

2PEN TEST-

Penetration testing

A vulnerability management program that's effective is one that's been thoroughly tested. Penetration testing is the search for security vulnerabilities in a system, network or application. The idea is to locate the weaknesses before an attacker does and eliminate them. In this portion of the guide, you'll get advice from several experts on what works best when it comes to organizing and carrying out a penetration test. There are risks involved, as with any security effort, but also new enhancements to pen testing to consider, like the use of social engineering methods.

Answer

How a network pen test can increase application security

Network penetration testing can reveal alternate routes to sensitive data. Learn how to secure your data from every angle. Continue Reading

Magazine

How best to approach security penetration testing

Learn the best approaches to penetration testing from top security expert Dave Shackleford, chief technology officer of IANS. Continue Reading

Answer

Pen testing: On-demand versus in-house

Pen testing is one of the newer services available on demand. But is it a good replacement for in-house testing? Network security expert Brad Casey discusses. Continue Reading

Answer

Penetration testing involves risks. Learn how to reduce them

You can minimize the risk associated with pen testing by limiting the test's scope, our expert says. Continue Reading

Tip

Four ways to use social engineering for pen testing

Social engineering techniques can be used to increase security. Learn four ways to add it to your pen tests. Continue Reading

Answer

Picking the best Web app testing method for your budget

If your budget's tight, what’s the best approach to Web application security testing? Michael Cobb compares penetration tests and code reviews. Continue Reading

Answer

Why third-party pen tests are best

A third-party penetration test can best determine whether an online data store could be compromised. Continue Reading

3ETHICS-

Ethical hacking

While pen testing is essential for security, there are right and wrong ways to go about it. A concept called "hacking back" has become popular but is still being developed, as well as debated. What's clear so far is that to "ethically" hack a system, you need to establish both policy and processes. The experts here weigh in on how to do both. Still, it's worth noting that some industry heavyweights, like Gary McGraw, argue that hacking back is the wrong way to think about the problem of system and app security. In this segment of our guide, you'll learn about the concept and the ongoing arguments in this still-evolving area of security.

News

Security experts struggle with the concept of hacking back

Is offensive security, known as "hacking back," an acceptable enterprise defense tactic? At a recent RSA Conference, experts struggled just to define the term. Continue Reading

Tip

Ethical hacking, step by step

In this chapter from Hacking for Dummies, author Kevin Beaver explores how to hack ethically, glean info about your organization from the Internet, scan your network and look for vulnerabilities. For more from Beaver, see his presentation in the video section below. Continue Reading

Tip

Forget hacking back -- build stronger software, systems instead

Hacking back ain't no way to win a cyberwar, says Gary McGraw. It's far better to build software and systems with fewer vulnerabilities. Continue Reading

4PATCH-

Patch management

Testing a system inevitably reveals security gaps that must then be addressed. In this segment, learn the risks involved in patching in an era of zero-day exploits. Even without external threats, patching can be tough, and some are tougher than others. Read on and you'll come away better equipped to tackle particularly challenging fixes, and you'll also learn how to do so with a minimum of expense.

Tip

To test or not to test? That is the zero-day question

Is it better to risk exposure and test zero-day patches or risk business disruption and patch without testing. Michael Cobb considers the conundrum. Continue Reading

Tip

Frugal patch management with virtual patching

Struggling to cut patch-management costs? Expert Michael Cobb explains virtual patching and how automated tools can play a role. Continue Reading

Answer

Is Java patching a futile pursuit?

Security threats expert Nick Lewis weighs in on whether patching Java security flaws is an exercise in futility. Continue Reading

Answer

Going outside: The best third-party patch tools

Do you know what the best third-party patch deployment tools are? See expert Michael Cobb's recommendations on which tools would work best for your enterprise. Continue Reading

5TUTORIALS-

Risk tutorials

Creating a vulnerability management program from the ground up requires first understanding where your security gaps are, devising a plan to fill them and then deciding how to make the fixes. That means acquiring the tools. The links here lead you to informative presentations about a range of security vulnerability tools.

Tip

Take a peek at OWASP's Mantra tool

OWASP's Mantra tool is being praised by security pro's for its abundance of options and ease of use. In this screencast, Mike McLaughlin takes a look at what Mantra has to offer. Continue Reading

Tip

What can WebScarab do?

In this WebScarab tutorial, get step-by-step advice on how to install and use this free tool, including the WebScarab proxy features. Continue Reading

Tip

Learn to use Netcat, a free command-line tool

Helpful for penetration testers and network admins who need to debug infected systems, the netcat command-line tool boasts many free features for enterprise use. Continue Reading

Tip

Open source pen tools can detect your Web app and XSS weaknesses

In this video demo, learn how to use XSSer, open source penetration testing tools for detecting various Web application flaws and exploiting cross-site scripting (XSS) vulnerabilities against applications. Continue Reading

Tip

Try these free vulnerability management tools

Learn how to use NeXpose Community Edition, a free collection of vulnerability management tools that offers predefined scan templates and the ability to scan networks, OSes, desktops and databases. Continue Reading

6VIDEOS-

More from the Dummies author on vulnerability assessment

The preceding segments of this guide address a range of issues related to managing system vulnerabilities. But as expert Kevin Beaver knows, a huge part of maintaining security is remaining flexible and adapting to changing technology and attack methodologies. In this segment Beaver relates his on-the-ground experiences in coping with the changing threat landscape.

Video

Kevin Beaver reveals the secrets of vulnerability assessments

In this webcast, the author of Hacking for Dummies explains how to improve vulnerability assessments with better planning, tools and respect for the process.

7DEFINITIONS-

Defining the terms

The information security field is loaded with sometimes confusing terminology and acronyms; the subfield of vulnerability management is no different. But here we've gathered a concise glossary for easy reference.

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close