I recently wrote a diary on the SANS Internet Storm Center about supervising and verifying vulnerability management.
Please click here to read the full diary entry and this diary entry has been briefly mentioned in the SANS Daily Network Security Podcast (Stormcast) for Friday, June 16th, 2023 over here. Alternatively, the full diary is reposted in full below.
Managing vulnerabilities in operating systems and software can be challenging and even contentious. Opinions are divided among industry peers – some argue that security updates would be unnecessary if developers were held accountable for security vulnerabilities . In contrast, others assert that updating systems as soon as possible (where applicable) was a critical best practice for users . Most clients in my consulting job adopt some form of vulnerability management paradigm (quarterly vulnerability assessments and addressing discovered vulnerabilities to automated vulnerability management programs where identified vulnerabilities are addressed as soon as possible). I noticed some peculiarities while providing consultancy services to a discerning customer’s automated vulnerability management program. The automated vulnerability management product will not be discussed here as it is neither the main focal point nor a debate on whether the product is trustworthy. Instead, it was serendipitous and stemmed from just a simple drive to appropriately mitigate identified vulnerabilities in all systems. Together with the client’s management support, we worked together to address the vulnerability in question while ensuring it was fully mitigated.
REG_DWORD value of
1. The change management team approved the configuration change, and the system administrator was tasked to implement the hardening configuration.