(12) Reporting Vulnerabilities

Question 1

What should vulnerability reports include?

Answer 1

Vulnerability reports should include:

-Vulnerabilities and their associated information and a list of affected hosts with associated information

-A qualitative risk score and mitigation options

-Information about recurrence and prioritization

Question 2

What options are available for vulnerability management reports in terms of automation?

Answer 2

Vulnerability management reports are automated normally because they are recurring. .

Question 3

What is important about vulnerability information on reports?

Answer 3

The importance of vulnerability information is huge because there has to be ways to flag false positives and workarounds, in order to do something about any change or need that the infrastructure has.

Question 4

What are the stakeholder categories that need to be known for proper vulnerability reporting?

Answer 4

Stakeholder categories include:

-Technical

-Security, audit, and compliance

-Security management and oversight systems

-Executive or leadership staff

Question 5

How often should compliance reporting be conducted?

Answer 5

Compliance reporting should be conducted regularly, and should meet the reporting requirements that the standard requires

Question 6

What vulnerability management plans new to be in place?

Answer 6

There needs to be action plans around

-Configuration management

-Patching

-Compensating controls

-Awareness, Education, and Training

-Changing Business Requirements

Question 7

What are the 5 Metrics/KPIs that should be in place to review the vulnerability management system?

Answer 7

The top vulnerability management system Metrics/KPIs include

-Trends

-Top 10 lists

-Critical Vulnerabilities

-Zero-days

-Service level objectives (SLOs) (describe specific metrics like tie to remediate or patch, which are probably part of an SLA)

Question 8

What are some reasons that remediation might not happen?

Answer 8

Some reasons that remediation might not happen include:

-MOUs and SLAs

-Organizational governance, business process interruption and degrading functionality

-Legacy or proprietary systems

Question 9

What should happen if and when an inhibitor to remediation occurs?

Answer 9

A risk and policy based decision will need to be made about what should happen. The issue and decision should be fully documented