In this lesson,
we're going to discuss Validating Vulnerability Remediation.
Now, when we identify a vulnerability
during a vulnerability scan or a penetration test,
it's important that the vulnerability gets remediated.
If the vulnerability is caused by missing a software update
or a security patch,
then the remediation is simple,
we need to just install that related hotfix
or security patch onto the system.
Now, if the vulnerability
is associated with a misconfiguration of the device,
then that remediation would be
to properly configure that device.
Either way, our system administrators
have been notified of the vulnerability
and given instructions on how to remediate it,
such as installing that patch
or reconfiguring a device,
but now we as cybersecurity analysts
need to validate that vulnerability
has actually been remediated.
This is done by conducting rescans, audits,
and verification of your systems
to validate that the vulnerability has been remediated
and is no longer going to be exploited by an attacker.
Now, first, we have the process of rescanning our devices.
After the initial vulnerability scan
and subsequent remediation efforts have been completed,
it's important that you take the time
to conduct a rescan of your targeted system.
This rescan will serve as a form
of double-checking your work,
and it ensures the system is no longer vulnerable
to that specific vulnerability.
When you're conducting rescanning,
this is going to help you to identify
if any vulnerabilities remain
that are unaddressed in the system.
Another benefit of conducting rescans
is that we can determine if any new vulnerabilities
have emerged since our initial scan.
And this new vulnerability
may also need to be mitigated
by installing a new security patch
or reconfiguring your system.
But probably one of the most important reasons
for rescanning your system
after you've applied a new security patch
is to validate that the patch
actually did solve the vulnerability
that you initially identified during your scans.
Now, over my career, I have had several cases
where a Microsoft patch has been released
and that hotfix or security patch
was actually released for one vulnerability,
but when we installed it inside of our testing environment,
we found out that it actually
did not fix that vulnerability.
Other times, we found that when we installed a patch,
it fixed the identified vulnerability,
but then it introduced two or three new vulnerabilities
into our system as well.
So rescanning can also ensure
that the patch was properly installed
and that it's effectively mitigating
the original vulnerability,
as well as not introducing
any new vulnerabilities into your systems.
Now, when it comes to rescanning,
I recommend that you schedule your rescans
to be conducted automatically.
Also, I recommend that you use a comprehensive scan
when you're conducting your rescan
to make sure you're validating
not just the one vulnerability,
but all vulnerabilities on your system
so you know what the exact security posture is.
And finally, you need to make sure you rescan
under the same conditions as your initial scan,
because that way, you're comparing apples to apples
or oranges to oranges.
Second, we have to conduct an audit of your devices.
Now auditing refers to the process
of systematically reviewing logs,
configurations, and patches
to ensure that they're aligned
with the established security standards and policies
that you have in your organization.
These audits can be conducted to validate your configuration
or your patch status,
and configuration auditing
is going to involve checking the system's setup
to ensure that there are no misconfigurations
or deviations from the security baseline.
Additionally, we can conduct patch auditing,
which ensures that all of our patches
were properly applied
and that they were implemented to solve
all of our known vulnerabilities.
When it comes to auditing,
it's going to be important to maintain the proper documentation
and detailed records of the identified vulnerabilities,
the applied patches, and the system changes
to prove that you've actually mitigated
these vulnerabilities and their associated threats.
You can also leverage automated auditing tools
to conduct the auditing process,
such as a configuration management solution,
which can drastically speed up the auditing process for you.
Your audits should also include compliance checks
that are being used to ensure your system is in compliance
with any applicable industry regulations or standards,
including things like GDPR, HIPPA, GLBA, or SOX.
Third, we have to conduct a verification of our devices.
Verification is the final checkpoint
in validating our vulnerability remediation process.
Verification is going to involve testing the system
to confirm that the patches and configuration changes
have the desired effect.
These verifications can be performed
by conducting a penetration test,
conducting user verification,
or using feedback loops.
A targeted penetration test
can be used during the verification process
to simulate an attack vector
to verify that the vulnerabilities
have been properly addressed and remediated
and that they're no longer able to be exploited
using that specific attack vector.
Additionally, because your system administrators
might install a security patch to solve one vulnerability,
they can inadvertently disrupt
normal operating functions too.
And so it's important to conduct user verification
to ensure that all of your applications and services
are still functioning correctly
after the remediations have been completed.
Also, you can establish feedback loops
and other mechanisms with your users and staff
to quickly identify and address any issues
post-remediation that may have occurred.
Now, when it comes to verification,
you should perform holistic testing, continuous monitoring,
and sometimes, you may even want to engage
an external auditor
to help complete your verification process.
When it comes to verification,
you should not only verify
that the vulnerabilities have been resolved
by your remediation actions,
but you also need to take the time
to evaluate the entire system
to ensure it has remained stable
and functional for all of your end users.
The best vulnerability management programs
also use a process of continuous monitoring
to quickly detect and respond
to any anomalies that may occur in the future.
Finally, if you need to ensure that you're in compliance
with industry best practices or regulations,
you can engage the services of an external auditor
to provide a fresh pair of eyes
to help catch anything that you might've missed
during your own auditing and verification process.
By using an external auditor,
you will have a purely objective evaluation
of your remediation efforts,
and this can be really helpful.
So remember, validating vulnerability remediation
is not just about checking off boxes on your checklist,
but it's also about ensuring that your systems
are actually going to be more secure
than they were before you performed remediation actions.
By systematically rescanning, auditing,
and verifying your remediation efforts,
you can strengthen your security posture
while ensuring that your organization remains compliant
and operationally efficient.