Why a Vulnerability Scan is Not Enough to Keep Business Running Smoothly

Today’s cybersecurity threat landscape is so vast and complex that it’s impossible to manage threats manually. Vulnerability management is a typical example: tech teams wrestle with many vulnerabilities across apps, networks, and endpoints.

A 2019 Kaspersky report outlines the size of the challenge. The security firm identified over 24 million unique malicious malware objects in 2019. The company also described the growing nature of the malware problem, noting that the 2019 figure is a 14 percent increase over 2018.

That’s why a vulnerability scan is such a critical tool. It helps IT teams identify and prioritize the most critical of vulnerabilities across the technology tools they use so that vulnerabilities can be addressed before malware takes hold and business operations are impacted.

The cost of an attack can be significant: the 2019 Accenture Cost of Cybercrime study found that the average cost of an attack went up from $11.7m per incident in 2017 to $13m in 2018.

But vulnerability scanning is just one part of the picture…In this article, we explain what vulnerability scanning is, including its pros and cons. We also outline how IT teams can augment vulnerability scanning tools to reduce the attack surface to the absolute minimum — all while consuming fewer staff hours, and at a lower cost.

What is a vulnerability, and what does a vulnerability scan do?

Many components work together to make a technology solution work. Any one of these components may have a weakness that an attacker can exploit — in other words, a vulnerability.

Applications, networks, and endpoints routinely have inherent weaknesses that allow criminals to gain control, or to intrude and disrupt your business. Typical vulnerabilities include communication ports that are left open unnecessarily, unpatched software bugs, or incorrect configuration.

Sometimes the vulnerability is down to the manufacturer or developer. Often, though, it’s the result of stressed-out IT teams whose ever-increasing to-do lists result in patching never getting done, or they’re misconfigured.

Managing vulnerabilities

Even modest technology deployments entail thousands of applications and devices, all of which are likely to have multiple vulnerabilities. Good cyber hygiene[AM2] will mitigate the scope of vulnerabilities to some extent, but scanning and testing are essential.

Not all vulnerabilities are critical. Some pose a high risk to your organization; others may not pose much of a threat. Grading vulnerabilities, according to severity, helps teams to address the most critical problems first. Of course, your team needs to know where these vulnerabilities are in the first place.

Scanning to detect vulnerabilities

A vulnerability scanner is an automated tool that probes and tests your applications, devices, and networks for known vulnerabilities. A scan can also check that configurations are airtight.

Some tools perform continuous around the clock scanning for the most dangerous vulnerabilities, but often a comprehensive scan is run at a set interval — once a week, say.

Your vulnerability management tool generates a report that flags the most critical vulnerabilities, grading the remainder according to severity. It helps your team prioritize patching and remediating — a process that can consume tons of IT resources, especially if you’re starting your vulnerability management process from scratch.

Strengths and weaknesses of a vulnerability scan

Vulnerability scanning is an established part of the cybersecurity arsenal. It delivers consistent benefits, but a vulnerability scan is not a comprehensive cybersecurity solution. It is just one tool in the security toolset.

There’s no arguing against the benefits of vulnerability scanning, of course. The best vulnerability scanners are easy to set up and continue delivering reports month after month with just minor tweaks. Set up a vulnerability scanner and you keep the same benefits year in, year out

Vulnerability Scan Benefits

• Quick action. Scanning occurs quickly, and teams get their feedback reasonably fast. Worried about vulnerabilities in your network or endpoints? A scanning tool can rapidly re-assure you or prompt your team into action.
• Easy to use. A good vulnerability scanning tool is easy to set up and gives you repeated results at whatever interval you prefer. Vulnerability reports are equally easy to interpret at a glance — your team gets actionable data that they can move on.
• Continuous monitoring. Vulnerability scanning alerts you when new issues come up. Whether it’s a new exploit or a new device on your network, regular reports help you keep vulnerabilities to a minimum — assuming your team has the time and resources to do so.

Just like all automated security tools, there is a danger that vulnerability scanning is seen as a comprehensive, end-to-end solution when it is not.

Vulnerability scan weaknesses

• Fixing and patching is a manual process. Your vulnerability report is just a starting point. Fixing issues still requires action from your team, and that can take up a significant amount of time. While a prioritized report helps, in reality, many teams fix the most critical vulnerabilities — never addressing the moderate risks.
• Vulnerability patching can be highly technical. It is easy to underestimate the expertise required to fully and consistently repair a vulnerability. Even if a vulnerability is identified, your team may not have the expertise to remediate it successfully.
• Some vulnerabilities won’t be detected. Exploits that are complex or that haven’t yet emerged won’t be detected by an automated tool. Some of these might be critical and lead to significant damage if left unaddressed.

So, while vulnerability scanning will help your team get on top of the most dangerous exploits, it rarely results in comprehensive protection. In fact, a 2019 survey by Ponemon Institute found that 60 percent of breaches involved unpatched vulnerabilities.

Chances are that your scanning tool will miss important vulnerabilities. Besides, your team may never get around to addressing that moderate vulnerability that opens the door to a successful intrusion.

Why you need to augment a vulnerability scan

It should be clear by now that patching every single vulnerability across your business environment just isn’t practical. But there are a few other tools you can use that can provide far more rounded protection.

Automated patching

Patching is a time-consuming process and teams rarely get down to comprehensive patching. Vulnerability scanners will point to the biggest risks, but as we suggested, IT teams don’t always get the time to mitigate critical risks, never mind the countless moderate risks. An automated patching regime can help.

For example, aiden’s automated endpoint management capabilities will automatically patch endpoint applications using intelligent packages, addressing many known vulnerabilities. It also saves time so that your team can get around to mitigating further down the vulnerability list. Besides, after running aiden, your team can demonstrate its effectiveness by simply producing a much-shortened vulnerability report.

Network and application firewalls

Another good way to stop the exploitation of vulnerabilities is to restrict the traffic in your network — and access to your applications. Network and application firewalls can dynamically monitor traffic to identify suspicious patterns — and suspicious sources of traffic.

Yes, you should always fully address critical vulnerabilities, but your firewall can help reduce the attack surface across low-risk and moderate-risk vulnerabilities.

Considered, strategic IT practices

Vulnerabilities are not always related to individual apps and devices. Sometimes vulnerabilities emerge due to poor planning, or due to time-pressured teams that simply don’t apply good practice. Ringfencing critical application is one example: time-consuming, but helpful when a vulnerability goes unmitigated.

Similarly, correctly configuring networks and apps — by closing non-essential ports, for example — is good practice that sometimes gets skipped in the rush. Dedicating more time to strategic IT and to best practice IT is a key route to minimizing the potential harm behind a vulnerability.

Vulnerability scanning is essential — but not a comprehensive solution

Attaining the best security posture always relies on a multi-pronged approach. Each element has its purpose: vulnerability scanning is a fast way to find critical holes in your defenses. But it’s just one element.

Your team must understand the pros and cons of using a vulnerability scanning tool, and augment the cons with other approaches.

That said, vulnerability scanning highlights how IT automation delivers improved protection while also freeing up time for IT teams. And tech teams with the space to think strategically stand a much better chance at sustaining business continuity in the long run.

Please add some type of statistic relevant to medium to large-sized enterprises and the threat landscape or how the threat landscape has become more complex etc. to really hook the reader. This will help to support why vulnerability scans are such critical tools. Remember, our target audience’s main concern is keeping the business running smoothly and protecting their data.