Threat and Vulnerability Management
First of all, at a high level the information security paradigm requires corporate risk to be evaluated and appropriate controls established to mitigate the risks.
Furthermore, at a technical level we establish a risk:control objective to reduce the overall exposure of the organisation. For example, focusing on the network and applications that run on it, the risk:control objective is to reduce the number of attack vectors thereby reducing the overall exposure. Simply put, if there are fewer vulnerabilities on the network there is less chance that something will get compromised.
Vulnerability Management Framework
An effective vulnerability management framework will enable the organisation to:
- establish an appropriate frequency for detecting vulnerabilities
- detect such vulnerabilities across the enterprise’s public services and internal resources
- attribute an appropriate severity rating to the vulnerability
- link the detection capability to the enterprise change, configuration and release management processes
- appropriately address the issues according to their vulnerability
- confirm that remediation activities have lowered the exposure to, or removed in total, the initial vulnerability
- perform ongoing vulnerability management through a continuous improvement lifecycle
The modern enterprise information system is a highly complex, multi tiered, multi vendor, centralised, distributed or hybrid deployment. The complexity gives rise to a multi faceted network of devices and applications all potentially presenting an attack vector or entry point into the network. As a result, over time different threats will emerge, each with their own capability to test the defence mechanisms of the organisation.
Threat Management Framework
An effective threat management framework will enable the organisation to:
- identify threats that may lead to a degradation in performance, or an attack, of an enterprise resource
- evaluate the risk that a threat presents and take appropriate action
- direct the appropriate information about threats to the affected parties so an informed decision can be made to the response
- ultimately have the capability to focus and utilise the security resources where most needed
With threat and vulnerability management systems running in harmony, the exposure of the network is greatly reduced thereby bringing security, reliability and availability to the enterprise network.
Sense of Security has many years of experience in protecting enterprise networks through our effective threat and risk management programs. As a result, we can assist with the development of a vulnerability management process through to the selection of appropriate supporting tools.
To discuss how our specialist security services can help your organisation with threat and vulnerability management please contact us on 1300 922 923 or complete the enquiry form by pressing the button below.
