What is the Best Framework for Vulnerability Management

A vulnerability is a weakness or flaw in a system, process, software, or network that has the potential to be exploited. Attackers may attempt to gain unauthorized access, disrupt operations, or steal sensitive data if vulnerabilities are left unfixed.

Vulnerabilities can result from coding errors, misconfigurations, outdated software, or weak security controls. Organizations are advised to properly manage all vulnerabilities to ensure that their systems, data, and users are well protected against any cyber threats that might target them. Cybercriminals constantly aim to exploit weaknesses in software, networks, and hardware, potentially leading to security breaches, financial losses, and reputational damage. By implementing a proactive vulnerability management program, organizations can better identify, assess, and remediate security gaps before attackers identify and exploit them.

Effective vulnerability management strengthens an organization’s overall cybersecurity posture, minimizes downtime, and enhances trust with customers and stakeholders.

What Is Vulnerability Management?

Vulnerability management is the practice of identifying, categorizing, prioritizing, and remediating security issues. For a vulnerability management process to be properly comprehensive, it is essential that the process is ongoing. As vulnerabilities can arise throughout the lifecycle of a technology, checking it for weaknesses once is not good enough. Having an automated process that runs frequently will help to ensure that computers systems, enterprise applications, and networks are protected against cyber-attacks and data breaches.

A vulnerability management framework acts as a guide for how organizations be most effective in managing these risks. 

It provides a structured approach that organizations can use to identify, assess, prioritize, and remediate security vulnerabilities in their systems and networks, and typically includes key steps such as discovery, assessment, prioritization, remediation, and continuous monitoring to minimize security risks.

What Are The Different Frameworks For Vulnerability Management?

While there are multiple established vulnerability management frameworks, each with slight differences, they all provide guidelines and best practices to help organizations identify, assess, and mitigate security risks. Some examples of common frameworks include:

CISA Cyber Resilience Review (CRR)

CISA (Cybersecurity and Infrastructure Security Agency) is a component of the US department of homeland security that is responsible for the protection of cybersecurity and infrastructure across all levels of government. CISA Cyber Resilience Review (CRR) is an assessment tool designed to improve cyber resilience by helping organizations evaluate their cyber resilience efforts and assess their ability to prepare for, respond to, and recover from cyber incident. CISA Cyber Resilience Review (CRR) divides the process of vulnerability management into four phases: 

1. Define a Strategy 
   • The goal of this first step is to map the vulnerability management process to an organization’s specific requirements and critical success factors 
   • Includes gathering input and support from all stakeholders 
   • Organizations must set the parameters of their vulnerability management program, determine what vulnerability assessment methods will be used, and allocate resources to meet those goals 
2. Develop a Plan 
   • The overall strategy is converted into a more concrete plan with rules and guidelines 
   • At this stage, vulnerability management teams should define their expectations and decide how they can use their resources most effectively
3. Implement the Capability 
   • Organizations will implement their fleshed-out vulnerability management plan 
   • During this phase, organizations perform vulnerability assessments, analyze the root causes behind vulnerabilities, record and categorize issues, and take steps to manage their exposure
4. Assess and Improve the Capability 
   • This phase involves analyzing the overall vulnerability management program and comparing the outcome to the organization’s needs
   • At this point, organizations can determine the state of their program and make improvements where needed 

NIST Cybersecurity Framework (CSF) 

The National Institute of Standards and Technology (NIST) is an agency of the US department of commerce, promoting US innovation and industrial competitiveness via advanced measurement science, standards, and technology to enhance economic security and improve quality of life. The NIST CSF is a risk-based framework that helps organizations improve their overall cybersecurity posture, and includes guidance on vulnerability management, such as asset management, risk assessment, and security maintenance. CSF is made up of the following components:

• CSF Core 
• CSF Organizational Profiles 
• CSF Tiers 

This framework is suitable for organizations of any size, ranging from small startups to large enterprises. 

The core of NIST’s CSF is made of six essential functions:

1. Govern
   • Central idea for establishing, communicating, and monitoring an organization’s approach to cybersecurity risk management 
   • Understanding an organization’s specific needs within the context of their cybersecurity strategy
2. Identify 
   • Understanding an organization’s assets, suppliers, and related cybersecurity risks
   • Ensuring that organizations prioritize their efforts in a way that matches with the goals set out under Govern 
3. Protect 
   • Using safeguards to manage an organization’s cybersecurity risks 
   • Supports the ability to secure assets, preventing or lowering the chances of a breach 
4. Detect 
   • Finding and analyzing possible cyberattacks and compromises 
   • Enables the timely discovery and analysis of IoCs 
5. Respond 
   • Taking appropriate action when a cybersecurity incident is detected 
   • Supports the ability to contain the impact of security incidents 
6. Recover 
   • Restoring any assets or operations that have been impacted by a cybersecurity incident 
   • Supports reducing the effects of security breaches and allowing teams to communicate during recovery 

The CSF is structured as a wheel because these six core functions all relate back to each other. Govern represents the center of the wheel because this controls how organizations implement the other five core functions. Rather than this framework being a step-by-step process, these functions are addressed simultaneously. 

CSF Organizational Profiles are used to describe either an organization’s current cybersecurity posture or the security posture they would like to achieve. These profiles are based on the outcomes of this CSF core. Organizations can compare their current organizational profile to a target profile. This comparison helps identify what actions are needed to bring organizations closer to their security goals.

Tiers are a metric that organizations can use to gauge how strictly they are managing their cyber risks. The available tiers are:

• Tier 1: Partial 
• Tier 2: Risk-Informed 
• Tier 3: Repeatable 
• Tier 4: Adaptive 

SANS Institute Vulnerability Assessment Framework (VAF)

The SANS Institute is a private U.S. for-profit company that specializes in information security, cybersecurity training, and selling certificates. They maintain the largest collection of cybersecurity research in the world and work to support organizations in mitigating cyber risk through knowledge. The Vulnerability Assessment Framework (VAF) is a structured methodology for conducting vulnerability assessments, which are a key part of a broader vulnerability management program. VAF serves as a comprehensive roadmap that can guide businesses in addressing vulnerabilities more effectively, and can be broken down into seven phases:

1. Engagement Planning
   • Includes defining the rules of engagement, permissions, and resources required for the assessment
   • All stakeholders need to be on the same page and prepared for this process 
2. Intelligence and Threat Modeling 
   • Organizations gather publicly available information about their systems and networks, then use this to identify potential threat actors and attack techniques
   • When teams are aware of which threats are the most likely to manifest, they can more effectively prepare defenses 
3. Discovery 
   • Organizations create a comprehensive list of the live systems and services running in their environment
   • Keeping this inventory helps ensure that there are no blind spots or missed vulnerabilities 
4. Scanning 
   • Various vulnerability scanning tools and techniques are used to identify both known and unknown vulnerabilities in their environment 
   • Vulnerability scans tend to go wide rather than deep; the goal is to uncover as many issues as possible 
5. Validation 
   • Organizations confirm if potential vulnerabilities discovered during scanning are actual issues
   • Discovered vulnerabilities are prioritized based on what risks they could pose to the organization
6. Remediation 
   • This phase revolves around developing and implementing plans to address confirmed vulnerabilities
   • Actions that may be taken to reduce risk may include patching, implementing new security controls, or adjusting configurations
7. Reporting 
   • Organizations document the results of their vulnerability assessment, then present this information to shareholders
   • This reporting keeps all shareholders up to date with the latest information, which in turn informs better high-level decisions

Comparison Of Frameworks 

Regardless of which framework is chosen, vulnerability management is not a one-and-done task. The cybersecurity threat landscape is constantly evolving, so these frameworks are all intended to be followed regularly. Which framework is “best” will depend on the needs of your organization.

• CISA’s framework follows a cyclical structure and emphases the importance of continuous improvement 
• NIST’s framework is highly adaptable for a wide range of use cases, even if it’s more general than just covering vulnerability management specifically 
• SANS’ step-by-step approach focuses on the practical steps involved with running a vulnerability management program 

It is worthwhile to be constantly evaluating your most pressing threats and your weakest points, to best evaluate which of the available frameworks would be best suited to addressing them.

Here are a selection of article that also cover the topic vulnerability management:

---

• The Top Vulnerability Management Solutions 
• Vulnerability Management Buyers’ Guide 
• The Top Vulnerability Scanning Software Solutions 
• The Top Vulnerability Assessment Solutions

---