Question

Assume that you work for an organization that has around 10,000 desktops/laptops and approximately 1,000 servers spread throughout the world. A new "zero-day" vulnerability is discovered, and warnings are sent out by major security firms (Zero-day vulnerabilities are recently discovered previously unknown system or software weaknesses). This vulnerability affects 90 percent of your systems, including the servers. How should the organization go about prioritizing mitigation efforts once the vulnerability is announced? What steps should the organization have taken to identify these systems prior to this incident?

Answer 1

1. How should the organization go about prioritizing mitigation efforts once the vulnerability is announced?

Vulnerability management is a vital part of any business/organization. Every organization should have a dedicated team to manage any vulnerabilities happening. By having a proper vulnerability management team, prioritizing mitigation efforts becomes easy.

By accomplishing an accurate view of your entire attack surface ( in this case 90 percent of the systems. including the servers are vulnerable), you can adequately and effectively respond to those vulnerabilities which represent the greatest threat to your organization. It requires a new way to deal with such vulnerabilities and is called Cyber Exposure.

Cyber Exposure is basically focused on the following four questions:-

1. Where are we exposed?
2. How should we prioritize based on our approach?
3. How are we reducing our exposure over time?
4. How do we compare with others?

2. What steps should the organization have taken to identify these systems prior to this incident?

Active prioritization requires complete transparency to your attack surface. These are the following steps that should be taken by the organization to identify these systems prior to this incident -

1. By prioritizing your previous threat responses based on vulnerabilities for which exploits happened.
2. By letting your data drive actions. When you encounter any vulnerabilities, you will be well informed about where to respond first.
3. By maintaining an active response team and giving them proper instructions on when to do what when such incidents happen in the future.
4. By keeping an updated inventory of critical asset so you know accurately what is at risk and where attackers are most likely to take aim.