Data Mining

Overview

It is important to take the time to analyze the data gathered as a part of the Vulnerability Management Program. This time spent will help to identify patterns and enable better prioritization of remediations. For example, if all systems have the same software versions or patch levels then it suggests that these should be updated in order to address multiple vulnerabilities at once. Alternatively, a single misconfiguration in a Linux system could be resolved to address multiple vulnerabilities. Taking the time to analyze Vulnerability Management Assessment data can help stakeholders with the business intelligence (ergo - epic, stories and sprints) they will need to quickly identify and prioritize remediations, thus improving overall cybersecurity posture.

It is also important to keep in mind that vulnerability assessment reports tend to be large and complex documents. It can be difficult for stakeholders to navigate these documents if they are not familiar with the underlying technologies or lack technical knowledge. Thus, it is essential to ensure that stakeholders have access to the necessary resources and training in order to understand the report and take the necessary steps to address the vulnerabilities.

By taking the time to analyze Vulnerability Management Assessment data and regularly review them, the analysis and stakeholders can identify patterns, prioritize remediations and stay up-to-date on potential vulnerabilities. In turn, this will help to improve overall cybersecurity posture by reducing the risk of exploitation from known threats.

More than just a scan

Vulnerability scans can help gain insight into an organization's approach to its information and operational technology (IT/OT) and security posture. They provide valuable information on how organizations operate from a technical and cultural perspective. By analyzing the results of a vulnerability scan, organizations can gain insights into their security posture and identify areas for improvement.

By analyzing the information in the scan results, a security analyst can determine the organization's patch management program. Is there a testing cycle, the frequency patches are applied, and what resources haven't been patch measured in months, perhaps even years?

The scan results can also help provide insight into the organization's configuration management program. Are the machines configured following security best practices? Which best practices? Are they up to date? How quickly are new configurations pushed out?

In addition, data mining vulnerability scans can provide an additional layer of security by identifying non-compliant machines that may have been missed during the audit process. Are there any rogue, unknown systems connected to the network? If so, are they secure and compliant with company policies?

These insights also help the organization prepare to meet applicable standards for their industry or market segment, such as PCI-DSS, HIPAA, Sarbanes Oxley, or GDPR. 

Vulnerability scans can also be used to support refreshing the CMDB and ensuring the accuracy of its data. Are all systems up to date in the CMDB? Does it contain any stale or irrelevant information?

In the case of a breach, vulnerability scans can provide pieces of the puzzle when attempting to determine the origin of an attack and the scope of systems susceptible to a particular vulnerability.

Vulnerability scans can provide evidence to support insurance claims by helping to determine the level of risk posed by an organization's IT/OT systems and in its ability in preventing a mishap (i.e., breach) from occurring.

Security Metrics

Security metrics provide valuable insights into the security posture of an IT/OT environment. By measuring various aspects of the IT/OT environment, organizations can identify potential weaknesses and address them before they become serious problems.

The three core security metrics of a vulnerability management program (VMP) are the Asset Risk Score (ARS), Vulnerability Severity Score (VSS), and Incident Response Time (IRT). ARS assesses the risk level associated with an asset, while VSS evaluates the severity of a software vulnerability. IRT measures how quickly an organization can respond to a vulnerability and mitigate its effects. Each of these metrics is important for measuring the effectiveness of an organization's vulnerability management program.

The first metric is asset risk score or ARS. This score measures the potential risks associated with each asset within your network. It considers factors such as the time an asset has been exposed, its criticality, and any vulnerabilities discovered during scan results. Knowing these levels helps identify which assets need additional attention when patching or hardening systems against potential threats.

Another key metric is the vulnerability severity score or VSS. This score indicates how severely a vulnerability impacts your system based on the type of exploit and the risk it poses. For example, a remote code execution vulnerability would likely be considered more severe than an information disclosure bug. The VSS score helps prioritize which vulnerabilities should be addressed first when remediating systems.

Finally, incident response time, or IRT, measures how quickly an organization can respond to incidents or threats. It considers the time it takes for security teams to detect and respond to any suspicious activity and the amount of time needed for remediation. Knowing your IRT helps you identify areas of improvement regarding detection and response processes.

Collecting and analyzing data from these three core metrics can be used to understand our security posture and take appropriate action to strengthen it. For example, if ARS and VSS scores are increasing, but IRT is decreasing, this could indicate that we need to improve its incident response capabilities. Tracking and monitoring these metrics can help us better manage our cyber security risk and ensure the safety of our systems.

ARS, VSS, and IRT can be essential measurements of a successful vulnerability management program. We should use these metrics to measure the effectiveness of our security posture and take appropriate action to ensure our systems are safe and secure from cyber threats.

Decision Metric

Based on the tread of the each of these scores (ARS, VSS, IRT) you can then measure how well the IT/OT is protected against attacks and other threats compared to industry standards and best practices. As the following table demonstrates, these scores can give you an overall picture of our organization's security health, highlighting areas where improvements could be made to increase protection.

Indication	ARS	VSS	IRT
Could suggest that threats are being identified but not effectively addressed, which could mean the vulnerability management program is not working as intended.
Could mean that security teams are able to identify and address threats on time, but the vulnerability management program is not adequately addressing potential risks.
Could suggest that threats are being identified but not adequately addressed, which could indicate that the vulnerability management program is not working as intended.
Could mean that security teams are not taking appropriate steps to identify and mitigate potential threats promptly, and the vulnerability management program is not adequately addressing potential risks.
Could indicate that security teams are responding to identified threats in a timely manner, but the vulnerability management program is not adequately addressing potential risks.
Could signify that the vulnerability management program is working as intended, and security teams are taking appropriate steps to identify and mitigate potential threats promptly.
Could indicate that the vulnerability management program is working effectively, as security teams are able to identify and address threats promptly.
Could suggest that security teams are responding to identified threats in a timely manner and the vulnerability management program is working as intended.
Signify that the vulnerability management program is working as expected
Could mean that security teams are not taking appropriate steps to identify and mitigate potential threats promptly, indicating that the vulnerability management program is not adequately addressing potential risks.
Could indicate that security teams are able to identify threats but not adequately addressing them, suggesting that the vulnerability management program is not working as intended.
Could suggest that security teams are taking appropriate steps to identify and mitigate potential threats promptly, indicating that the vulnerability management program is working effectively.