Quicksheet

Vulnerability Management
Maturity Model
Lifecycle Management

AD-HOC PATCHINGLEVEL 1This is the initial patching process. Think of this as running Windows Update (WSUS) on yourlaptop for system scanning and installation of OS patches. Administrators run the process onservers at an ad-hoc time and execute manually. This is the general practice for small shops withlimited to no IT departments.
BMC server automation solutions are the key offerings for Level 1.

PLANNED PATCHINGLEVEL 2

Organizations plan a patch window for servers on a regular basis, typically monthly. Deploying
the patches, bringing down (pre-tasks) and up (post-tasks) of the applications will be executed
manually. An ad-hoc manual testing of the application will be executed. Discovery tools are used
to identify servers to be managed and blind spots.
BMC server automation solutions are the key offerings for Level 2.

SCRIPTED PATCHING (PRE / POST TASKS)
Scripting is implemented to help with the pre- and post-steps to the patching process. Patching isfully scheduled, and servers are defined for patch windows. A change request should be createdwith the documented servers that are patched.

LEVEL 3

BMC server automation solutions are the key offerings for Level 3. Orchestration can also
suppose integrating change requests and a closed-loop change management system.

VULNERABILITY SCANS AND SCRIPTED PATCHINGLEVEL 4The security team adopts a vulnerability practice and deploys a vulnerability scanner (i.e. Qualys,Nessus, Rapid7). Scans are executed on an ad-hoc basis and results are collected. Scan reports
include ip addresses for servers and CVE identifiers vulnerabilities. Reports on vulnerabilities andrisk are presented to executives for awareness. At this point, the organization is becoming moresecure, but manual labor can increase due to the amount of time and effort spent on analyzing
the scan reports.
BMC server automation solutions are the key offerings in Level 4. Orchestration can also
support change requests and a closed-loop change management system.

MANUAL VULNERABILITY REMEDIATION AND SCRIPTED PATCHINGLEVEL 5The security teams are sending scan reports over the wall to the operations teams
to begin addressing the vulnerabilities. This is a pain-staking process as there is nobusiness context for the vulnerabilities, only an IP address and vulnerability
identifier (CVE). Operations teams are left trying to determine what to patch first
and to develop remediation packages in an ad-hoc manner. Many vulnerabilities go
unpatched due to the amount of manual effort involved. Scripts are used forpatching, and vulnerability remediation is performed manually.
BMC server automation solutions are the key BMC offerings in Level 5.
Orchestration can also support change requests and a closed-loop change
management system.

INTEGRATED VULNERABILITY SCANNING, PLANNING, AND PATCH
AUTOMATIONLEVEL 6

Data from discovery tools is used to cross-reference assets with vulnerability
scanner data to identify blind spots (systems known to the discovery tool but were
not scanned by vulnerability scanners). Systems are in place to tie vulnerability scanreports to available remediation options. Planning is supported, and includes
assignment of patches to vulnerabilities and are tracked. There is an integrated
solution of vulnerability scanning to automated patch deployments, and remediation
efforts are tracked. Configuration changes to close vulnerabilities are also
implemented using automation tools.
BMC server automation solutions are the key BMC offerings in Level 6.
Orchestration can also support change requests and a closed-loop change
management system.

CLOSED-LOOP VULNERABILITY MANAGEMENT AND PATCH
AUTOMATION (VERIFIED)LEVEL 7

Automation and Orchestration complete the loop of integration through the change
management process. As vulnerability scans occur, they are integrated to thevulnerability management system which identifies remediation options.
Orchestrated remediation can be scheduled which automates the creation of thenecessary change requests with the associated servers and vulnerabilities to bepatched, and schedules the remediation jobs in the appropriate maintenancewindows per asset. Finally, a validation of success, inclusive of successful
remediation deployment and application functionality, is integrated into theorchestrated process.
BMC server automation solutions are the key offerings in Level 7. Orchestration
can also support change requests and a closed-loop change management
system.

LEVEL 8 – SECDEVOPS INTEGRATION
As part of the CI/CD (Continuous Integration/Continuous Delivery) release process,developers have visibility to the vulnerabilities within their applications and canaddress them as part of their release cycle. The remediation packages andconfiguration changes are automatically scheduled with regular release cycles.

LEVEL 8Vulnerability testing is also integrated with the CI/CD release process to help preventthe reoccurrence of potential vulnerabilities. SecOps integration refers to asituation where Security team and Operations teams have bridged the “SecOpsGap” and have integrated tools that enable them to collaborate on setting priorities
for vulnerability management. They also have visibility to the actions of each other,and support the rapid and automated remediation ofvulnerabilities in an agreed-to, prioritized sequence that
optimizes organizational security, achieves
SLA’s, and maximizes the vulnerability “burn-down” (closure)rate.

*Note: BMC Helix Cloud Security can be adopted at any
maturity level (Levels 1-8) because it gives developers visibility
to vulnerabilities within their applications that they can correct
as part of their release cycle, before they are deployed inproduction environments.

BMC server automation solutions and BMC Helix Cloud
Security are the key BMC offerings in Level 8. Orchestration
can also support change requests and a closed-loop change
management system.

FOR MORE INFORMATIONTo learn more about managing security vulnerabilities
https://www.bmc.com/it-solutions/truesight-serverautomation.html

VULNERABILITY MANAGEMENT MATURITY LEVELS

Responsible Party

Level 8Operations

Level 7Level 6Level 5Level 4Level 3Level 2

Vulnerability
Scans and
Scripted Patching

ManualVulnerability
Remediation and
Scripted Patching

Integrated
Vulnerability
Scanning,Planning, andPatch Automation

SecDevOps
Integration

Closed-Loop
Vulnerability
management andPatchAutomation(Veriﬁed)

Security Agility

App Owner

Scripted Patching(Pre / Post Tasks)

PlannedPatching

Level 1Ad-hocPatching

ManualDomain Automation

Enterprise Automation

About BMC
BMC delivers software, services, and expertise to help more than 10,000 customers, including 92% of the Forbes Global 100, meet escalating digitaldemands and maximize IT innovation. From mainframe to mobile to multi-cloud and beyond, our solutions empower enterprises of every size and industry
to run and reinvent their businesses with efficiency, security, and momentum for the future.

BMC – Run and Reinvent

BMC, BMC Software, the BMC logo, and the BMC Software logo, and all other BMC Software product and service names are owned by BMC Software, Inc. and areregistered or pending registration in the US Patent and Trademark Office or in the trademark offices of other countries. All other trademarks belong to their respective
companies. © Copyright 2019 BMC Software, Inc.

www.bmc.com