MGT516.1: Overview: Cloud and Asset Management

Overview

In this section we look at why vulnerability management is important and introduce the course. We then provide an overview of the cloud and how different cloud service types and architectures can impact the way we manage vulnerabilities. We'll also look at how to choose technologies and tools for our cloud environments. Finally, we'll dig into why asset management is so important and foundational for effective vulnerability management, and the different ways that gaining additional context can help us succeed.

Exercises

Moving to the Cloud

• Scenario-based lab about the impact of moving to the cloud on an organization's vulnerability management program

Critical Attributes

• Scenario-based lab on how to identify critical contextual attributes that need to exist within our asset management database or be tracked in some other way to prioritize and manage vulnerabilities more effectively

Leveraging Asset Context

• Hands-on lab leveraging a spreadsheet that contains both vulnerability and asset data sets to answer questions about the vulnerability of data and the quality of the asset data

Cyber42 Game

• Game introduction and practice event
• Initiative selection for Round 1
• Two Round 1 events

Topics

Course Overview

Cloud and Cloud Vulnerability Management

• Overview
• Tool selection in the cloud

Asset Management

• Overview
• Importance of context
• Attributes and inline context
• Cloud asset management

MGT516.2: Identify

Overview

Identifying vulnerabilities continues to be a major focus for our security programs, as it can provide insight into the current risks to our organization. It also provides the data for our analysis and for the measures and metrics we use to guide the program and track our maturity. In this section, we will look at common identification pitfalls and discuss identification architecture and design across both infrastructure and applications. We'll also look at where we might require permission to perform identification and how we safely grant permission to third parties to test our systems and applications and responsibly disclose any findings.

Exercises

Scanning

• Scenario-based lab to better understand and identify the types of scanning that are most effective for different asset types

Scan Validation

• Scenario-based lab to better understand and identify the reasons why certain vulnerabilities are showing up in infrastructure scans even though they seem invalid or out of place

Cyber42 Game

• Two Round 1 events and one Round 2 event
• Initiative selection for Round 2

Topics

Identification

• Challenges
• Tools, architecture, and design
• Cloud identification
• Permission
• Validating scan results
• Scanner configuration
• Application vulnerabilities
• Bug bounty programs

MGT516.3: Analyze and Communicate

Overview

Gone are the days when we can just scan for vulnerabilities and send the raw output to our teams for remediation. We need to help reduce the burden by analyzing the output to reduce inaccuracies and identify root-cause issues that may be preventing remediation. Once we have identified the issues that cannot be resolved, we should prioritize the rest to ensure that we are having the greatest impact and provide targeted reports or dashboards to system and platform owners. In this section, we will look at some common inaccuracies in the output of our identification processes, discuss prioritization, and then look at what metrics are commonly used to measure our program and the related operational capabilities. We will also discuss how to generate meaningful reports, communication strategies, and the different types of meetings that should be held to increase collaboration and participation.

Exercises

Prioritization

• Hands-on lab leveraging a spreadsheet to provide a high-level illustration of basic prioritization based on severity and also a more risk-based approach to prioritization

Solution Groups and Types

• Demo of two different methods (spreadsheet and ServiceNow) to apply solution groups or remediation actions to vulnerability data sets and leverage the groupings for analysis and reporting.

Cyber42 Game

• Three Round 2 events

Topics

Analyze

• Vulnerability-centric prioritization
• Asset-centric prioritization
• Threat-centric prioritization
• Threat intelligence in VM
• Solution and exclusion groups

Communicate

• Metrics
• Reporting
• Strategy
• Meetings

MGT516.4: Treat

Overview

Treating vulnerabilities and reducing risk is the ultimate goal of all that we do in vulnerability management. It is important for program managers and all participants to understand the typical processes and technologies that exist and how to leverage them to increase positive change within the organization. Most organizations will have some type of change, patch, and configuration management program. In this course section, we will look at how we interface with these processes to streamline change and increase consistency. We'll also examine some unique challenges we face in the cloud, how to better deal with application vulnerabilities, and some alternatives we can look to when traditional treatment methods are not available.

Exercises

Changing Culture

• Discussion and thought-based lab about what organizational cultures are most or least conducive to vulnerability management and how to go about changing or influencing culture

Remediation Effectiveness

• Scenario-based lab to better understand and identify how to gauge the effectiveness of the treatment options selected for various vulnerabilities after implementation and over time

Cyber42 Game

• Initiative selection for Round 3
• Two Round 3 events

Topics

Treatment

• Change management
• Patch management
• Configuration management
• Cloud management
• Application management
• Alternative treatment
• Other treatment considerations

MGT516.5: Buy-in, Program, and Maturity

Overview

Vulnerability management is not the easiest job in an organization, and there are many challenges that can hold us back. From split responsibility and accountability to reliance on shared personnel, much of the work done in this space goes unrecognized. In this section, we'll summarize much of what we have learned and discussed throughout the week and look at how we can use this information to improve the program. We'll discuss how we can make VM more fun and successful within the organization, how we can identify and collaborate more effectively with various stakeholders, and how we can build out and mature a robust vulnerability management program.

Exercises

Vulnerability Management Buy-In

• Scenario-based lab to better identify important stakeholders and get or improve buy-in for the program

Cyber42 Game

• Three Round 3 events
• Final scoring and wrap-up

Topics

Buy-In

• Making VM fun
• What are we doing today, and why it isn't working?
• How can we improve?
• Collaboration

Program

• How are we doing things today?
• Creating a VM program
• Common problems

Maturity

• Advancing the program
• The SANS VM Maturity Model