In this lesson,
we're going to cover vulnerability response
and remediation options.
Vulnerability response and remediation
refers to the strategies and actions taken to identify,
assess, and address vulnerabilities in a system or network
by aiming to mitigate risks associated
with those known vulnerabilities
so that you can strengthen
your organization's security posture.
When a vulnerability is identified within an organization,
it's imperative to respond effectively
and efficiently to mitigate or completely neutralize
that threat.
The process of vulnerability response and remediation
is going to encompass a range of options including patching,
insurance, network segmentation,
implementing compensating controls,
and granting exceptions and exemptions.
Now, let's take a look at each of these options
and how they contribute to an organization's
overall cybersecurity strategy.
Now, our first option for response and remediation
is the use of patching.
Patching refers to the process of applying updates
to software, systems or applications
in order to fix security vulnerabilities
or to improve performance.
Patches are typically released by software vendors
to fix known vulnerabilities that could be exploited
by a threat actor.
For example, if a software company has identified
a vulnerability in its word processing software application
that would allow a threat actor to gain unauthorized access
to your sensitive data, that company should quickly develop
and release a security patch or hotfix
to mitigate this known vulnerability.
Now that the patch is released,
it's going to be up to our end users to update their software
to the latest version that includes this new security patch,
so that vulnerability in their system can be mitigated
and that the threat actor can no longer
exploit their system.
The second option we have for response to remediation
is to purchase an insurance policy.
Now, purchasing a cybersecurity risk insurance policy
is going to be a risk management strategy
where an organization is going to procure an insurance policy
that is designed to mitigate any financial losses
that could result from a cyber incident like a data breach,
network outage, or business interruption.
For example, if you're working for a small
e-commerce company, you might opt to purchase
a cybersecurity insurance policy.
So that if the company does suffer from a data breach,
the insurance policy will cover the costs for mitigation,
remediation, and recovery that are associated
with that incident.
And this includes things like legal fees, new servers,
new software, consultants, public relation efforts
to rebuild your company's image,
and all the costs associated with notifying your customers
that were affected by that incident.
Our third option for response and remediation
is known as segmentation.
Network segmentation involves dividing a computer network
into smaller parts or segments to improve performance
and security by isolating different parts
of the network from each other.
This way, if one segment becomes compromised,
the threat will not be allowed to easily propagate itself
into other parts of your organization's network as well.
For example, a hospital might implement network segmentation
to separate patient data from other non-critical systems.
This way, if a malware infection occurs in one
of the non-critical systems, the segmented network
that's hosting that sensitive patient data will be kept safe
from the malware that already infected
our non-critical systems in that other network segment.
Our fourth option for response and remediation
is known as compensating controls.
Compensating controls are alternative security measures
that can be implemented when a standard security control
cannot feasibly or effectively be implemented
on a given system.
These compensating controls are tailored
to provide equivalent levels of protection
when you're mitigating your vulnerabilities.
For example, let's say that your organization's leadership
decide that we're all going to use multi-factor authentication
on all of our systems because it's considered
the best practice for securing your user accounts.
The problem with this is that we can't implement MFA
on all of our servers because some of them
are running older legacy versions of the server software.
Now, until those servers can be replaced
or upgrade to more modern versions of the server software,
our company is going to have to use a series
of compensating controls,
such as rigorous password policies,
account lockouts after failed login attempts,
and regular security awareness training for our employees
to mitigate the fact that multi-factor authentication
simply cannot be installed on those legacy servers
at this time.
Now, our fifth option for response and remediation
is to create an exception or an exemption.
An exception in the world of vulnerability response
refers to a situation where a certain security control
or policy is going to be temporarily relaxed or bypassed
because your operational business needs it to be.
Now, when you do this, you have to understand
and accept the associated risk of bypassing those controls.
But when you do, this creates an exception.
Now, for example, if an organization has a policy
that requires all of your systems to be updated regularly,
but you have a critical server running a legacy application
that simply cannot be updated without breaking
that application, well, in this case,
you need to use an exception,
and that exception could be made so that this server
is being acknowledged for the risk of not being updated,
and the rational and timeframe for that exception
will also be documented like the scope of the exception
and the date by which the exception will expire,
and that server has to be replaced or upgraded
to a more secure version,
or be completely removed from the network
for non-compliance.
Now, an exemption on the other hand,
is an instance where a security control or policy
is permanently going to be waived for a specific reason
such as when you're trying to use a legacy system
that simply cannot use a modern security measure
as one of its controls.
For example, if you're working for a large
university's research department
and they have an older computer system that's necessary
for processing historical data
and it can't run the updated security software
that you want to install, your university's
chief information security officer might decide to grant
a permanent exemption for that system so it doesn't have
to be updated anymore in the future.
Because this system will be physically
and logically isolated from the rest
of the university's network.
And this mitigates the potential risk
associated with making this exemption.
And because the system is so expensive,
it's going to take us years to replace
because we can't afford to buy a new supercomputer,
for example, and so we're going to have to use
an exception instead of completely avoiding this risk
by updating that server.
So remember, vulnerability response
and remediation refers to the strategies
and actions that are taken to identify,
assess, and address vulnerabilities in a system or network
by aiming to mitigate risks associated with those
known vulnerabilities so that you can strengthen
your organization's security posture.
Whether it's quickly applying patches,
investing in an insurance policy,
utilizing network segmentation,
implementing compensating controls,
or granting exceptions and exemptions,
each type will offer us a different way to enhance
the organization's cybersecurity posture.
By understanding and effectively leveraging these options,
your organization can fortify its defenses
and navigate the complex landscape of cybersecurity threats
with more confidence and more resilience.