Whitepaper

Guide toVulnerability
Management
Intelligent world-class endpoint
protection and threat discovery

Guide to Vulnerability Management

Contents
Management Summary........................................................... 3
Complete Threat Management............................................ 3
Payment Card Industry
Data Security Standard (PCI DSS)...................................... 5
WithSecuretm Elements Vulnerability
Management at a glance......................................................... 6
The story of Equifax................................................................. 7
Patching is not a given......................................................... 8
Known unknowns, and unknown unknowns........................ 8
Don’t forget your Intranet..................................................... 9
Visibility is key...................................................................... 9
Overview of current vulnerabilities......................................... 10
The Key to Preventing Cyber Attacks................................ 11
Adversaries don’t need
many vulnerabilities One is enough....................................... 12
The usual timeline of an intrusion.......................................... 13
What are the consequences
if you don’t watch your surface?............................................ 15
The company internal discussion about the cyber risk...... 17
GDPR – fearsome penalties or an opportunity to elevateyour organization?............................................................. 19

What is Elements Vulnerability Management offering?.......... 20
Identify and expose the possible threats........................... 21
Internet asset discovery.................................................... 22
Discovery scans................................................................ 23
System scans.................................................................... 24
Web scans......................................................................... 25
Custom web applications.................................................. 26
Scan Node Agent.............................................................. 26
Elements Vulnerability Management Agent....................... 27
Management..................................................................... 28
Reporting........................................................................... 28
Value proposition................................................................... 29
Getting visibility into your environments............................ 29
WithSecuretm Elements Vulnerability Management............... 30

2

Guide to Vulnerability Management

Management Summary
Complete Threat Management
WithSecure™ Elements Vulnerability Management is acomprehensive, easy-to-deploy, all-in-one vulnerability
scanning and management platform that supports organizations’ security programs with clear, actionable, and prioritizedvisibility into real risks. Elements Vulnerability Management ismainly designed to address the needs of small and medium-sized enterprises (SME), empowering them to protect theirbusiness continuity through effective vulnerability management. Unpatched and badly configured software is a key
attack vector and breach enabler, especially when it comes tomore advanced attacks. WithSecure™ Elements Vulnerability
Management can significantly lower the cost of cyber security
by being proactive and identifying potential security problems
before they are exploited. Leveraging Elements Vulnerability
Management cloud resources allows organizations to reduce
their expenses, which is a particularly important factor for
SMEs that do not yet have dedicated security resources.
Additionally, WithSecure™ Elements Vulnerability Management is an optimal solution for managed service providers(MSP), enabling them to enter the cyber security service
business, grow with WithSecure™, and capture market oppor-

tunity. With Elements Vulnerability Management, managed
service providers can expand their service offering to cloudbased vulnerability management, and deliver market-leading cyber security solutions and services in a scalable andcost-efficient manner.
End customers who lack the time or knowledge to manage
their own vulnerability assessments are likely to execute
their cyber security strategy with the help of an established,
local managed service partner. The EU data and privacy laws
(GDPR) incentivize customer companies to become compliant and seek help and services from a local managed service
provider. Managed service partners are most influential among
end-customer deployments of less than 1,000 seats.
This document describes the high-level security controls WithSecure™ employs with Elements
Vulnerability Management.

3

Guide to Vulnerability Management

Identify and expose
possible threats
Unlike many other vulnerability management solutions on themarket today, WithSecure™ Elements Vulnerability Management features web crawling technology, called Internet Asset
Discovery, that also covers the deep web. With this, you canfulfill a wide variety of tasks ranging from threat assessment
to business intelligence. In essence, Elements Vulnerability
Management allows you to easily browse through all targets toquickly identify risks and potentially vulnerable connections,and expand the analysis of your attack surface beyond yourown network.

The many ways a business can be exposed to cyber risk

Successful intellectual property and brands often makecompanies the target for fraudulent or malicious activities.
Such activities include brand violations, where third parties
pose as your company, phishing sites intended to scam orinfect visitors, and typo squatting – where someone registers
domains using words resembling your brand to redirect traffic
through links that look like yours. Many companies have little
to no awareness of these sorts of activities.

Your Business

Publicauthorities

Banks andinsurers

Professional
hackers,
Hacktivists,
Espionage

Logistics andsuppliers

Telecoms
serviceproviderServiceprovidersCustomers

Supply chain
management

Employees

Credit cardand payment
brokers4

Guide to Vulnerability Management

Payment Card Industry Data Security Standard (PCI DSS)
Ensure compliance with current andfuture regulations
As an approved service vendor, WithSecure™ has to performthe actions listed here to identify any scoping discrepancies
that exist in the information provided by the scan customer.
Information on any scoping discrepancies must be indicatedon the Attestation of Scan Compliance in the “Scan Status”.
Although this information must be reported as noted, we thenhave to disregard this information in determining the PCI
DSS compliance:• Include any IP address or domain previously provided to
WithSecure™ and still owned or used by the scan*customer that has been removed at the request of the scancustomer.
• If the scan customer no longer owns or has custody of the IP
address or domain, include that IP address or domain for atleast one additional quarter after it was removed from scopeor released by the scan customer.
• For each domain provided, look up the IP address of thedomain to determine whether it was already provided by thescan customer.
• For each domain provided, perform DNS forward andreverse lookups of common host names—such as “www,”“mail,” etc.—that were not provided by the scan customer.
• Identify any IP addresses found during MX record DNS
lookup.
• Identify any IP addresses outside the scope that are reached
via web redirects from in-scope web servers (covers all
forms of redirecting including: JavaScript, Meta redirect andHTTP 30x codes).
• Match domains found during crawling to user-supplied
domains to find undocumented domains belonging to thescan customer.

5

Guide to Vulnerability Management

WithSecure Elements Vulnerability
Management at a glancetm

Get the big picture
Map all system assets for a complete
security overview. No system is too
big— WithSecure™ Elements Vulnerability Management scales as you grow.

Streamlined security
management
Monitor vulnerabilities efficiently with
automated, scheduled scans. Assign,
manage and track all security issues incoordination with system administrators, developers, auditors and more.

Customized reporting
made simple

Compliant with EU
regulations

Customize and automate standardized
reports for all audiences in a variety
of formats.

WithSecure™ Elements Vulnerability
Management meets EU regulations
with PCI ASV vulnerability scanningcompliance and helps customers tocomply with GDPR.

Continuous improvement
WithSecure™ Elements Vulnerability
Management is automatically updated,
improved, and ready for seamless
third-party integration through
WithSecure™ Elements Vulnerability
Management API.

WithSecuretm
Elements Vulnerability
Management your way
Run vulnerability scans from a secure
cloud-based SaaS or as an on-site
solution behind your corporate firewall.

6

Guide to Vulnerability Management

The story of Equifax
On September 7th, 2017, Equifax, a consumer credit reporting
agency, announced that they had been the victim of a cyberattack in which the personal data of as many as 145.5 million
individuals was accessed. At the time of writing, this incident
precipitated the early retirement of the company’s CEO, two
top security officials, Chief Information Officer and Chief Security Officer.
Forensic analysis into the incident indicated that the attackers
leveraged an unpatched vulnerability in Equifax’s web application software, Apache Struts. This vulnerability was initially
discovered by Nike Zheng, a Chinese security researcher.
Apache released a fix for the vulnerability on March 6th, 2017.
By March 9th, 2017, attackers were already actively exploiting
the vulnerability in the wild.
Equifax, like all other companies using the platform, wasmade aware of the patch on May 6th, 2017. A memo about
the vulnerability was sent to IT staff on May 9th, 2017, but due
to internal miscommunication and a series of unsuccessful investigations, Equifax did not patch all their vulnerable
Apache Struts installations until July 29th, 2017, after they had
discovered evidence of being breached.
As it turns out, attackers got into Equifax’s systems on
May 13th, 2017, exactly one week after the patch had beenreleased. Closer investigation revealed that Equifax had a
48-hour policy for applying critical patches, but this policy
wasn’t followed. Had they followed their policy, they would
have avoided this breach altogether.
Although close to three months sounds like a long time topatch a critical vulnerability, Equifax isn’t even close to being
the slowest company to patch systems against critical vulnerabilities. For instance, there are still plenty of systems in the wildthat are susceptible to the EternalBlue exploits that enabledboth NotPetya and WannaCry during the Summer of 2017.
And while Equifax’s story sounds like chaos, it’s more often
than not the reality for teams tasked with managing complex
computing infrastructure.

7

Guide to Vulnerability Management

8

Patching is not a given
Patching is not a given. Applying software updates is often thejob of multiple individuals in an organization. Just as operating
systems and software are highly diverse, so are the mechanisms used in applying updates and receiving notifications ofavailable patches. Every vendor alerts their customers about
the availability of updates in their own way. There is no single
place to find all the information you need, and IT departments
still rely heavily on email and RSS feeds to keep themselveson the map.

Updates and patches arrive on a frequent basis, and withdozens or even hundreds of separate applications to manage,
most IT departments are flooded with different updates. For
each of these, someone needs to understand not only what’schanging in the software itself, but how it might affect thesurrounding systems. For this reason, updates often need
to be tested or piloted before being deployed across a wholeorganization. In the case of server updates, maintenancewindows need to be scheduled, especially if patching causes

downtime. This forces IT departments to prioritize patchingactivities, and to generally only patch when absolutely needed.
But to make these prioritization decisions, they need to know
if a vulnerability is being actively exploited, and whether thatvulnerability is present in the organization’s attack surface.

Known unknowns, and unknown unknowns
To properly secure computing infrastructure, IT personnel
need to know what systems require patching. Obtaining
this knowledge often involves collecting and maintaining
an accurate inventory of all known systems and software in
the organization. As companies grow, business functions
commonly implement their own systems and applications
without the involvement of the IT department. Those systems
become part of what is commonly known as shadow IT, andcan drastically increase an organization’s attack surface.
Shadow IT systems are difficult to find, and their impact isoften grossly underestimated.

But if shadow IT systems represent a set of known unknowns,
systems belonging to a company’s supply chain represent
an even larger set of unknown unknowns. Still, supply chain
attacks are fairly common.
During Christmas 2013, criminals stole credit card details
belonging to more than 60 million people from Target, a large
US retail chain. The attackers breached Target’s network by
installing malware (via an email attachment) onto a systembelonging to a company called Fazio Mechanical. At that time,
Fazio Mechanical was supplying heating and air-conditioning
services to Target. After the attackers breached Fazio Mechanical, they obtained the VPN credentials needed to remotelyconnect to Target’s corporate network, and once inside, theattackers pushed malicious software onto cash registers at
an estimated 1800 stores. Investigations into the incident
revealed that there were no controls limiting the attackers’
access to any of Target’s systems, including devices withinstores, such as point of sale (POS) registers and servers. In
one instance, the attackers were able to communicate directlywith cash registers in checkout lanes after compromising a delimeat scale located in a different store.

Guide to Vulnerability Management

Don’t forget your Intranet
While patching vulnerabilities in Internet-facing systems
is generally taken seriously, the security of systems withina corporate network is often overlooked. Systems behindthe corporate firewall are often considered “protected” fromattacks, and it is assumed that there are no intruders on the
network. These security shortcomings aren’t always tied tosoftware patch levels, though. Misconfigurations often provide
attackers with access to easy lateral movement mechanisms.
Identifying software misconfigurations is a troublesome task.
This is compounded by the fact that software isn’t always
secure straight out of the box, and it often takes research tofigure out how to properly configure each piece of a company’s IT infrastructure. Take, for example, an SSH server. Once

installed, you probably want to configure it to not allow password logins, and you’ll most likely want to disable the ability
to remotely log into a system as root. A new admin setting up
a system would need to know that these two configuration
changes should be done, and would need to know how to dothem. Now let’s say you have a handful of SSH servers on
your network, all of which were installed at different times, bydifferent staff. To find out if any of those are misconfigured,
you’d need to perform an audit of each one. Now apply thatsame logic to multiple other pieces of software installed acrossan organization, and to settings in the operating systems
themselves. Not an easy task to perform once, let alone on afrequent basis. So, again, tasks like these are prioritized.

Visibility is key
Keeping systems secure is overwhelmingly complex andwork-intensive. But ultimately, it’s important to have a clear andaccurate picture of your current situation. Only then can you
start to approach the task of properly securing your infrastructure. And by then, you will you be able to answer questions
such as:• Is our risk level where it should be?
• What is the likelihood of a breach occurring?
• What would be the likely impact of a breach?
• Which of our assets are most exposed?
• What is our plan for reducing exposure of assets in the future?
• How much will it cost to bring our risk level to where it should be?
• How does that cost fit into current budget allocations?

These are the types of questions any leadership team will askof an IT department if they’re at all worried about cyber security (which they should be). So, by obtaining enough visibility
into your organization’s infrastructure (including the known
unknowns and unknown unknowns), you’ll not only be in aposition to answer those questions in a proactive and confident manner, you’ll sleep better at night.

9

Guide to Vulnerability Management

10

Overview of current vulnerabilities
Execute code

32718

Denial of Service

23603
18081

Overflow
XSS

With cyber threats growing more rapidly than ever, the issue of
security has been brought to the forefront of every CIO’s mind.
Today, cybercrime is a billion dollar enterprise, and it’s on therise. According to data from Arbor Networks, the number andsize of cyber attacks increased by 73% in 2017. With the incidents of cyber attacks growing year over year, no organization,
regardless of size or industry, is free from the risk of a data
breach. So it is no longer a question of if your company will be
attacked, but when. For this reason, it is important now, morethan ever, to implement a proactive approach to cybersecurity.

15303
10989

Gain Information
Sql Injection

7853

Bypass Something

6375

Memory corruption

5339

Gain Privilege

5006

Directory Traversal

4130

CSRF

2521

File Inclusion
Http Response Splitting

Prevent incidents proactively

2235
166
0

5000

10000

Source: http://www.cvedetails.com/vulnerabilities-by-types.php

15000

20000

25000

30000

35000

Due to the misconception that implementing security
measures will cost businesses a lot of time and money, thedefault approach that companies take with cybersecurity is“reactive.” A reactive approach means that companies wait
until they are affected by a threat to implement a solution.
Ironically, this method will likely cost your business considerably more time and money than implementing preventative
measures. Statistics show that the ROI for businesses that
implement preventative security measures is met in the face ofan attack.

Guide to Vulnerability Management

The Key to Preventing Cyber Attacks
The key to overcoming breaches caused by human error isto create an environment where all employees have a vested
interest in security. Employees need to understand the valueof protecting client and partner information, and their role in
keeping it safe. They also need basic knowledge regarding therisk landscape, and a way to make good judgments regarding
Internet safety on a consistent basis. To many people, security
seems like common sense, but it is more like “out of sight andout of mind”. Creating a secure foundation must begin with thetraining and education of employees.

Though advances in technology bring new and exciting security solutions to our industry, attackers continue to develop
and launch new tactics, techniques, and procedures to outwit
them. Security does not have to be a costly process, but doing
nothing should not be an option. Whether or not a company
can afford a new, high-tech security solution, taking a step backand focusing on security at a basic level should still be a priority.
Being proactive about security is everyone’s job, and requires
constant vigilance. By making a conscious effort to adhere to
standard processes, procedures, and policies for security andeducating employees, companies can drastically reduce theirvulnerability to attack.

11

Guide to Vulnerability Management

Adversaries don’t need many vulnerabilities
One is enough
Every

90
minutesa new security
vunlnerability is identified

50–300critical vulnerabilities
exploitable depending
on industry

That is an average of7vulnerabilities

per asset across a typicalIT environment

That is an average of8000

known and disclosed
vulnerabilities each year

It takes an average of

It takes

days

days

103

until known security vulnerabilities are remediated15in the average that avulnerability is exploited12

Guide to Vulnerability Management

The usual timeline of an intrusion
In computer security jargon, “Day Zero” is the day on which
the interested party (presumably the vendor of the targeted
system) learns of the vulnerability. Up until that day, the vulnerability is known as a zero-day vulnerability. Similarly, an exploitable bug that has been known for thirty days would be called a30-day vulnerability. Once the vendor learns of the vulnerability, they will usually create patches or advise workarounds tomitigate it.
In general, there is too much hype surrounding zero-day
vulnerabilities. The CVE Details website shows an averagevulnerability score of 6.8, across all known vulnerabilities on
all known platforms. Of the over 80,000 known vulnerabilities
in their database, 12,000 (almost 15%) of those are classified
as high-severity. However, it is good to remember that thesevulnerabilities exist across plenty of different client and server-side applications (including, you guessed it, Adobe Flash).
From a company’s point of view, handling high-severity vulnerabilities is the number-one priority. And they get handled inwell-run organizations. High-severity vulnerabilities get a lotof visibility, and because of this, they’re patched on the spot.
But vulnerabilities alone don’t make up your company’s entire
attack surface. Your CISO is probably more worried aboutphishing and upstream attacks than internal network miscon-

figurations and unpatched internal systems. As an IT admin,taking care of infrastructure is your biggest concern.
Of course, you’re going to perform triage when a new high-severity vulnerability surfaces. But what about the rest of them?
Applying every patch to every piece of software on every
system on your network, as the patch is released, is just not
feasible. That’s why admins rely on periodic patch cycles to
fix low-severity vulnerabilities, if they do fix them at all. Taking
time out of their day to understand the implications of every
new vulnerability out there is too much to ask from mostIT admins.

ImpactTraversal

BreachReconnaissanceYour
company13

14

Guide to Vulnerability Management

And so, in many cases, they simply don’t bother. When looking
to apply patches, admins often ask questions such as:

Using our Elements Vulnerability Management service toanalyze vulnerability trends within our customer base shows
exactly this. High severity vulnerabilities were rare to non-existent. The vast majority of unpatched vulnerabilities we foundwere of low-medium severity. Of these, it’s interesting to notethat TLS/ SSL and OpenSSH misconfigurations were fairly
common. Remember, though, that although they’re labelled
misconfigurations, it’s possible these systems were configuredthat way in order to interoperate with the customer, partner, or
proprietary in-house services.
Our Information Security Manager, a member of our CISO
office, looked at this graph and concluded that if this represented the situation at our own company, he’d be able to sleep
at night.

Prevalence• how exposed is the system?
• will this patch break something else?
• do I even know what this vulnerability means?

High

Medium

Low

1

2

3

4
Severity

The data in this graph was collected during the first 6 months of 2018,
over WithSecure's™ customer base, with our Elements Vulnerability
Management product. WithSecure™ Elements Vulnerability Management is a vulnerability management and security scanning solution that
performs platform and web application vulnerability scans.

5

6

7

8

9

Guide to Vulnerability Management

15

What are the consequences if you don’t watch
your surface?
The Risks

Unauthorised changes to systems

Establishing and then actively maintaining the secure configuration of ICT systems should be seen
as a key security control. ICT systems that are not locked down, hardened or patched will be
particularly vulnerable to attacks that may be easily prevented.
Organisations that fail to produce and implement corporate security policies that manage the secure configuration and patching of their ICT systems are subject to the following risks:

Attack surface
External
misconﬁgurations

Brand infringements

Vulnerable partner
businesses

Malware and phishingNon-compliant systems

Misconﬁgurations

Outdated software

Open ports

Development

Customer data

E-Commerce

Shadow it

An attacker could make unauthorised changes to ICT systems
or information, compromising confidentiality, availability
and integrity

Exploitation of unpatched vulnerabilities
New patches are released almost daily, and the timely application of security patches is critical to preserving the confidentiality, integrity, and availability of ICT systems. Attackers willattempt to exploit unpatched systems to gain unauthorizedaccess to system resources and information. Many successful attacks are enabled by exploiting a vulnerability for which apatch has been issued prior to the attack taking place.

Guide to Vulnerability Management

Exploitation of insecure system
configurations
An attacker could exploit a system that has not been locked
down or hardened by:• Gaining unauthorized access to information assets orimporting malware• Exploiting unnecessary functionality that has not been
removed or disabled to conduct attacks and gain unauthorized access to systems, services, resources,
and information• Connecting unauthorized equipment to infiltrate information
or introduce malware• Creating a back door for future malicious endeavours

Increases in the number of security
incidents
Without an awareness regarding vulnerabilities and the availability (or unavailability) of patches and fixes, the business will
be increasingly disrupted by security incidents.

Security breaches hurt small businesses
mostOnly 31 percent of small businesses take active measures toguard themselves against security breaches. Furthermore, 41

percent of small businesses are unaware of the risks associated with human error, and only 22 percent are willing to improvetheir security measures from last year.
It might not surprise you that security breaches hurt small
businesses the most. More than 70 percent of attacks target
small businesses, and it is estimated that 60 percent of hacked
SMBs go out of business after just six months. This research
may be a bit skewed, since the number of people who ignore
cyber security is high. People still consider traditional security
measures, like antivirus and firewalls, sufficient enough.

Cost of data breach is higher than you think
A lack of awareness, coupled with exposure to threats, has led
to a drastic increase in the number of attacks: data breaches’
share of cyber attacks has increased to 31 percent from a mere
18 percent in 2014. If you think that you can get away easily
after an attack, think again. The cost of recovery is staggering,and in most cases, it leads to the shutdown of businesses. The
average cost of recovery from SMB data breaches is $36,000
and can lead to losses of up to $50,000. This amount may
even be the total value of small businesses. Recovery may be
next to impossible if you are the victim of a data breach.
Since most small businesses aren’t able to recover after
security breaches, it is always good to keep precautionary
measures ready against an attack.

16

Guide to Vulnerability Management

17

The company internal discussion about the cyber risk
When a CISO approaches management with a budget request
for a new technology or security initiative, it’s a meeting
between people speaking two different languages. The CFO
and CEO think in terms of monetary amounts – business value
and ROI. Without those numbers to refer to, the CISO must
somehow convince top management that the investment isnecessary. The CISO resorts to the only argument the executives will respond to: fear. “If we don’t do this, the sky’s going tofall on our heads.”

And how does the CISO show top management how importantthese investments are to the company, without resorting to
FUD (Fear, Uncertainty, Doubt) to get the message across?

Yet, it is possible to put real numbers in your cyber security risk
assessments. It is possible to speak in a language the boardroom will understand.

The answer lies in being able to quantify the impact of a cyberbreach to your company, the very practice CISOs often shy
away from. It’s true that using ambiguous rating systems orusing red, green, and yellow color coding to indicate risks
doesn’t give you much to go on.

After all, no company wants to be the next news headline forthe wrong reasons.

“Most managers rely on qualitative guidance from ‘heat maps’
that describe their vulnerability as ‘low’ or ‘high’ based onvague estimates that lump together frequent small losses andrare large losses”, write Chacko, Sekeris and Herbolzheimer
in the Harvard Business Review article “Can you put a Dollar
amount on your companys cyber risk” from October 05, 2016.
“But this approach doesn’t help managers understand if they
have a $10 million problem or a $100 million one, let alone
whether they should invest in malware defenses or email
protection. As a result, companies continue to misjudge whichcybersecurity capabilities they should prioritize and often
obtain insufficient cybersecurity insurance protection.”“Implementing this technology will cost $100,000, but it will
reduce our risk by $2 million,” or “We can reduce our cyber
insurance coverage by $50 million, and here’s why.” These arestatements CISOs and CFOs can make, and confidently backup, with the help of new ways of measuring and quantifying
cyber security risks. WithSecure's™ method is called Cyber
Breach Impact Quantification (CBIQ), and it predicts how
much a cyber incident will cost an organization. It also shows
how much companies will reduce their risk by implementing a
specific security control.

But at the end of the day, how does a company know if its
security investments are effectively reducing or eliminating
risks to the extent that its executives hope or imagine they
are? The expensive employee training program, the event
monitoring system, the replacement of security software
across the organization? How does a company know if it’sinvesting in the right places, or if it has purchased the properlevel of insurance to adequately cover itself in the event of adata breach, ransomware incident, or DDoS attack?

Guide to Vulnerability Management

2019 Cost of Data Breach Study: Global Overview
IBM Security and Ponemon Institute, study conducted
between July 2018 and April 2019.

507
companies$3.92
millionglobally studied

is the average total costof data breach

25,575279 days

average size ofa data breachis the average time to identify
and contain a breach$150

is the average cost perlost or stolen record

29,6%

is the probability ofexperiencing a data breachin the next two years

18

Guide to Vulnerability Management

19

GDPR – fearsome penalties or an opportunity
to elevate your organization?
As if the costs of recovering from a data breach aren’t enough,the cost of potential fines resulting from GDPR enforcement
must now be considered as well. Under the GDPR, whichcame into effect in May 2018 with a goal of protecting the data
privacy of EU citizens, companies who experience a data
breach could face fines of up to 4% of annual turnover, or €20
million ($22.5 million), whichever is greater.
The directive may be aimed at strengthening the privacy rights
of EU citizens, but its scope is not limited to Europe. Under
the GDPR, any company that processes, stores or transmits
personal data belonging to EU residents is required to comply– a broad demarcation that affects practically any company
with a Web presence. And because the GDPR is likely to set a
standard other countries will want to follow, getting company
policies, procedures and technologies on board is a good idea
whether a company is technically affected or not. Data privacy
laws worldwide are likely to get stronger, not weaker.
To look at the Equifax breach through a GDPR lens, it is estimated that the personal records of more than 147.9 million
people were exposed. Had the company been subject to
GDPR and its 72-hour deadline for reporting a discovered

breach, it would have failed miserably. Equifax discovered thebreach on July 29, 2017 and disclosed it well over a month
later, on September 7. With over $3 billion in annual turnover,a rough calculation based on the maximum penalty reveals
that Equifax could have potentially faced well over a hundred
million in fines.
Securitywise, the GDPR does not detail specific requirementsfor keeping data safe. But because implementing solid security practices is critical to protecting data and being compliant, a comprehensive security program encompassing threat
prediction, prevention, and breach detection and response
should be in place. Effective vulnerability management, as theEquifax case illustrates, is a critical part of that program and of
GDPR compliance.
Another important aspect of the GDPR is data inventory – knowing what you are storing, where you’re storing
it, and where multiple copies of data are located acrossyour company infrastructure. Discovering and documenting machines where data may reside is the first step in thisprocess. The discovery scan capabilities of WithSecure™
Elements Vulnerability Management can help you find andmap out your network assets and shadow IT. A server set
up by the marketing department for last year’s campaign, forexample, may contain customer information that is not part ofthe company’s GDPR processes.
All in all, the GDPR is a reality to be approached in one of two
ways: As a fearsome penalty to be avoided by meeting theminimum qualifications for compliance; or as an opportunity toappreciate its goals and proactively elevate your organization
to where it should be in our increasingly data-driven world.

Guide to Vulnerability Management

What is Elements Vulnerability Management offering?
The best threat response is to predict
and map your cybersecurity threats. No
other technology does that better thanvulnerability management.
An organization’s attack surface crosses all network infrastructures, software, IOT, and web applications internally and in
the global Internet. It includes an understanding of all points
of interaction. Information security managers need to be able
to approach vulnerability assessment from several perspectives in order to get an accurate assessment of risks, minimize
security threats, and maintain compliance.
Unlike any other vulnerability solution on the market, WithSecure™ Elements Vulnerability Management features web
crawling technology, called Internet Asset Discovery, that
also covers the deep web. Elements Vulnerability Management allows you to easily browse through all targets to quickly
identify risks and potentially vulnerable connections, and to
expand the analysis of the possible attack surface beyond
your own network.

20

Guide to Vulnerability Management

Identify and expose thepossible threats

Vulnerability
management
dashboard

Vulnerability scans
Scan systems and web
applications for publiclyknown vulnerabilities

Successful intellectual property and brands often makecompanies the target for fraudulent or malicious activities.
With a little bit of experience with Elements Vulnerability
Management, any IT security manager can generate a threat
assessment report concerning activities such as brand violation or phishing sites intended to scam or infect visitors.

Keep on top of the current
status of vulnerabilities andincidents, prepare standard
and custom reports on risk
and compliance, and more

WithSecure™ Elements Vulnerability Management identifies
your organization’s assets, and pinpoints exactly where they
are vulnerable, allowing you to minimize your attack surface
while reducing risk. With Elements Vulnerability Management,
your IT security team maps your organization’s attack surface
in the aggregate of:Internet asset
discovery

Automatically collect datafrom all your endpoints

Enumerate possible attack
vectors with an internet andweb threat assessment

Vulnerability
management• all known, unknown, and potential vulnerabilities critical tobusiness• controls across all software, hardware, firmware, andnetworks• shadow IT, external misconfigured systems, malware
websites, website-linked hosts• partner and contractor security entropy• brand infringements and phishing

Discovery scans
Map your attack surface with
network and port scanning.

21

Vulnerability
management
endpoint agent

Manage vulnerabilities
centrally with security alerts
and forensics

Pci dss compliance
Ensure compliancewith current and future
regulations to reduce risk ofdata loss

Guide to Vulnerability Management

Internet asset discovery
You can find your organization’s Internetfacing systems in Elements Vulnerability
Management with Internet discovery.Internet
discovery uses crawling and port mapping toallow you to collect data on public systems.
You can search for data based on location,
top-level domain, pay-level domain, keywords,
hostname, and IP address.

You can add the discovered hosts to a scan group for vulnerability scanning using either passive or active scanning. Passive
scans check for vulnerabilities without connecting to the target
host. Active scanning runs a regular system scan on the host.
The internet asset discovery includes all of this:• Attack Surface Enumeration• BGP (IP to AS)• Public sources (RIPE, Public BGP, CERNET)• IP & Service information• Port scans & banners• Domain names• Reverse DNS, zone transfer, brute force• WhoIs information• Linking all the above together• Geolocation• Public/private databases

22

Guide to Vulnerability Management

23

Discovery scans
Elements Vulnerability Management Discovery is responsible for the first step in the vulnerability
management workflow process and security auditing. It lets you discover hosts and network
devices in your infrastructure (within defined network range(s)).

Discovery scan uses ICMP PING / TCP SYN / UDP scan /Fragment scan techniques to enumerate all hosts available
on a network. Additionally, it lists services that each host are
exposing and what operating systems they are running.

The output from a network discovery scan is a report with thelist of all scanned targets with all services detected, accompanied by supplemental information depending on which options
are used.

IP range is the only required input information to conduct
network discovery scan. The other configuration options are
the following:

In the case when the only purpose of the scan is to determine
if the host is alive, not the services it is running, the “discovery mode” can be enabled. The scan procedure in discovery
mode, for each host in scope, includes ARP resolution (in local
segments), ICMP PING, and a limited port scan of the default
ports for SSH, HTTP, HTTPS, and Remote Desktop services.
If any of those indicate that the host is active, the scan marks
the host alive and proceeds to the next target.

• TCP port scanning and defining the port range• UDP port scanning and defining the port range• Limiting the port range to Top 100 or 1000 most common
open ports• Enabling detection of the services on the discovered hosts• Detecting the operating system on each live host
• Scanning hosts which do not respond to PING request• Control scanning performance by adding additional delay
time between subsequent packets sent
• Control the number of simultaneous threads usedduring scanningGuide to Vulnerability Management

24

System scans
System scan is a network-based vulnerability scanner that is able to scan any system with an IP
for common vulnerabilities.

Note: System scan is non-disruptive
and designed not to cause Denial ofService conditions on your systems.

When you start a system scan, it first performs a port scan of
the target, and once all the open ports (services) have been
identified, they are assessed for vulnerabilities. These are justsome of the systems that can be examined with system scans:• Web servers• Firewalls• Email servers and gateways• Routers and switches• Domain controllers• DNS servers• Antivirus gateways• Workstations

The checks that the scanner runs include the following:• Detect services and operating systems discovery (UDP /TCP / ICMP)• Testing for vulnerabilities and misconfigurations in services• Testing for vulnerabilities and misconfigurations in operating
systems• Testing for vulnerabilities and misconfigurations in network
devices• Secure configuration testing (SSL / SSH)
• Default passwords discovery (operating systems/services/
network/devices)
All vulnerabilities are reported with a CVSSv2 score, CVE,
BID, BugTraq, and other references when available.

Guide to Vulnerability Management

Web scans
Web scans allow you to examine and test web
applications. You can use web scans during
the development of new applications as partof the development lifecycle. As vulnerabilities
are discovered early on in the development
process, the cost and amount of resources
required to mitigate vulnerabilities at a laterstage is reduced significantly.
Web scan is considered a complementary scan, which can beapplied on top of an existing System Scan. In other words, it isrecommended that whenever you scan a target with a System
Scan, systems with web applications should be scanned with
Web scan as well.

Defining the targets for web scans
When defining the target URL for a web scan, take into
account that automated site discovery (crawling, and what is
actually being scanned) is limited to locations that have:• the same port number as the defined scan target (i.e.: port
80 - default for http://.. , port 443 - default for https:// , port
8080 - if explicitly specified like this: https://www.some-site.
com:8080/)• the same protocol as the defined scan target (in other words,
if you specify the URL
http://www.company.com, the scan does not automaticallyscan https://www.company.com in addition)• the same FQDN as defined in the scan target (in other words,
if you specify the URL https://service.com, the scan does
not automatically cover content available under https://www.
service.com)
This is to protect against scanning something that thecustomer does not intend to scan. For example,
http://www.bank.com can consist of an official website of abank with some generic info. Whereas
https://www.bank.com can host a completely different
service, for instance online banking The same web scan is notnecessarily intended to scan both.

25

Guide to Vulnerability Management

26

Custom web applications
Before you create a new web scan, you must first understandthe situations where it’ll be effective. As a rule of thumb, you
should only scan custom web applications. If you have asystem running a standard deployment of WordPress (without
any custom modules installed), for example, it does not makesense to scan it with a web scan, because system scans areable to detect the WordPress version and any known vulnerabilities. However, if you know that your WordPress contains
custom-developed modules, it makes sense to scan it withboth system and web scans. Keep in mind that you only needto scan the custom code or module, and not the entire website.

We are using both - the top 10 and the static 55 categories
Web scans detect security vulnerabilities within commercial and custom-built web applications, testing for numerous
vulnerabilities, including the OWASP Top 10.

In addition to the top 10, WithSecure™ Elements Vulnerability
Management also refers to the 55 static categories of threatclassification that are defined by the Web Application Security
Consortium (WASC).

• A web application scanner - able to identify vulnerabilities incustom applications• Supports simple form-based authentication• Supports assisted crawling (recordings)• Scalable to cover expanding needs• Certified PCI ASV scanning tool

The WASC Threat Classification is a cooperative effort toclarify and organize different website security threats. The
members of the Web Application Security Consortium
have created the project to develop and promote industrystandard terminology, so that application developers, security
professionals, software vendors, and compliance auditors
have access to consistent language and definitions for web
security-related issues.

how many simultaneous scans it can run at a given time basedon the configuration.

ment component that can be exchanged, by reinstalling, at
any time when there are no ongoing scans.

Once a scan is finished, the Scan Node Agent sends thereport back to the Vulnerability Management Dashboard andremoves all temporary scan data from the node, including thereport and log for the scan. It is very important to note that thescan node does not store any vulnerability data after the scan
has been completed. It is a Elements Vulnerability Manage-

The Scan Node Agent is run as a service in the operating
system, and it’s deployed and shipped together with an additional application for system admins that allows them to preview
the scan node configuration and actual status of scan jobs,
meaning the details of the scans currently running on the node.

Scan Node Agent
The Scan Node Agent is an WithSecure™ Elements Vulnerability Management component that manages all scanning
processes running on the scan node.
It guards all scan jobs (the list of system, web, and discovery
scans) and contacts Vulnerability Management Dashboard,
checking whether there are any new scan jobs waiting in thequeue. The Scan Node also has its own capacity, and knowsGuide to Vulnerability Management

Elements Vulnerability Management Agent
When it comes to identifying and fixing vulnerabilities on yourinternal network, there are two competing (but not mutually
exclusive) approaches. There’s the more traditional approach,running internal network scans on a box known as a scanning“appliance” (a scan node) that is deployed in your infrastructure. Then there’s the even more modern approach, running“agents” on your devices that report back to a central server.
Vulnerability scanning tools, such as Elements Vulnerability
Management, typically were using network-based scanningapproach. The scan node was assessing the security postureof remaining devices by running a vulnerability scan throughthe network, either with or without authentication. This traditional way of scanning has its own limitations that agent-based
scanning can overcome.
Elements Vulnerability Management supports both ways of
performing vulnerability scans and give ability to portal user tomanage vulnerabilities using one, common asset view, regardless of the method used to gather vulnerability findings.

The benefits of agent-based scanning are numerous:• It brings extended endpoint-based vulnerability scanningcapabilities.
• Simplifies network configurations, as less network rules areneeded to allow Elements Vulnerability Management scanning. No need to open doors to your most valuable estate– devices.
• Volatile devices. Facilitates scanning of endpoints residing
outside of the company network, e.g remote working.
• Detailed inventory, even with dynamically changing IP
addresses.
• Easy deployment on top of existing WithSecure™ Elements
products as the agent is part of unified Elements Endpoint
Agent.
• Build-in patch management capabilities are available withthe client, when the customer purchases/owns Elements
Endpoint Protection subscriptions.

What does the Elements Vulnerability
Management Agent scan?
The content of the Elements Vulnerability Management Agentscan is similar to authenticated SystemScan with exclusion ofvulnerability findings that can be tested only by looking at thebox from the network point of view. Example of such finding is
SSL/TLS cipher suites misconfiguration on your web server.
Typical findings contain:• list of open ports• list of hardware• list of software• vulnerabilities related to installed software• vulnerabilities related to operating system

27

Guide to Vulnerability Management

Management

Reporting

The Account management page allows you to control user accessto Elements Vulnerability Management using Role Based AccessControl (RBAC) principles. User management in Elements Vulnerability
Management involves three concepts: Users, User groups, and Roles.

Reporting is another extremely vital part of the Vulnerability
Management Dashboard. With Elements Vulnerability Management, you
can generate customized reports that suit the needs of your manager,system administrator, or your third-party service provider.

Users

Roles

You can create your own report on the Reports page. Once the report is created, it is added to
the list on the Summary Reports page. You can view each report in several formats:

The Account management page shows you alist of all users with access to your Elements
Vulnerability Management account. On thispage, you can review the users and what
they have access to and, of course, add or
remove users.

Roles are used to define the content a user
can access. For example, you can create
roles like “View only”, “System owner” and“Administrator”. To view and edit the roles
for your Elements Vulnerability Management
account, click the Account management
menu button and select Manage roles.

User groups
User groups act as containers for one or moreusers. With groups, you can control whichscan groups users have access to and withwhat permissions (roles). The User groups
column shows you which groups each listeduser belongs to.

28• XML: Download the raw report data in XML format.
• Word report grouped by hosts: Contains all the technical details of the hosts in scope, organized by the host. This is useful when your scope does not cover a large number of hosts.
• Word report grouped by vulnerabilities: Contains all the technical details of the hosts in scope,organized by vulnerability type. This gives you a smaller report if the scope is very large.
• Excel report grouped by vulnerabilities: Contains all the technical details of the hosts in scopeand gives you the freedom to use the features available in Excel.
• Word report, executive summary: Designed to be a light-weight report with few pages even if
the summary report scope covers thousands of hosts.

Note: After generating a report, it creates a snapshot of the current state of your vulnerabilities. To update the report, click the menu icon in the actions column and selectRefresh report data. Select Create a new report based on this if you do not want to overwrite the existing report.

Guide to Vulnerability Management

29

Value proposition
Strategic

Getting visibility into your environments

Stay compliant

The biggest fears of any company include reputation
damage, negative publicity, and the loss of trust due toincompetence or negligence. In addition to the above,other negative consequences include productivity
loss, the disintegration of a firm’s competitive edge
due to stolen key intellectual property, and potential
regulatory violations associated with the GDPR.

Protect the brand by avoiding
incidents
Security equals quality andapplies to any offering

TacticalSecurity management

Execution

Vulnerability detection capabilities to protect systems
Develop secure applications

What you need is visibility into the overlap between
the vulnerabilities in your environments and the security holes being exploited in the wild. Furthermore,
you need to focus on the vulnerabilities with the mostimpact to your business, and prioritize the issues inthese environments first.

Complete threat management, done by WithSecuretm
Elements Vulnerability Management
WithSecure™ Elements Vulnerability Management
is a vulnerability scanning and management service
operated by WithSecure™ Corporation. WithSecure™
Elements Vulnerability Management is available either
as a cloud-based service (SaaS) solution or as an
on-site solution. Elements Vulnerability Management
consists of the following components:• Vulnerability Management Agent• Elements Vulnerability Management scan nodes• Vulnerability Management Dashboard

The scan nodes perform the actual scanning. The
Vulnerability Management Dashboard manages andcoordinates the scan nodes, collects the results andprovides reports of the findings.
WithSecure™ Elements Vulnerability Management detects weaknesses and threats immediately, boosting network and application security andensuring regulatory compliance. Unparalleled central
reporting and in-depth analysis effectively improvesecurity management.

Guide to Vulnerability Management

30

WithSecure Elements Vulnerability Managementtm

Comprehensive visibility

Reporting on risk

Effective security mapping through precise
discovery and mapping of all assets, systems,
and applications on the network and beyond.

Produce reports with credible
information about your organization’s security posture over time.
Show and justify how IT security
enables business continuity.

Streamlined productivity andsecurity management

Reduced costs
Quickly address problems across multiple
domains with an efficient service workflow, including vulnerability monitoring, automated scheduledscans, and ticketing for prioritized remediationand verification.

Streamlined security management
Simplified integration with an efficient service
workflow and ticketing system that monitors vulnerabilities with automated scheduledscans, and assigns them for prioritized patching
and coordination with system administrators(e.g. ServiceNow).

Vulnerability management canlower the cost of security significantly. It’s less costly to deal withsecurity before serious problems
than during a crisis or incident
recovery. Additionally, Elements
Vulnerability Managemen cloud
resources allow organizations tolower their expenses.

Ensure compliance withcurrent and future regulations
WithSecure™ Elements Vulnerability Management is compliant with the PCI ASV vulnerability scanning requirements. We
are your EU-based partner that complies with EU regulations. When you use WithSecure™ Elements Vulnerability
Management, you achieve compliance with an approved PCI
ASV scanning solution and get PCI-compliant with a Qualified
Security Assessor (QSA) partner. Carry out regular testing andidentify new vulnerabilities. Generate user-friendly reports for
all users.

Who We Are
WithSecureTM is cyber security’s reliable partner. IT service providers,
MSSPs and businesses along with the largest financial institutions,manufacturers, and thousands of the world’s most advanced
communications and technology providers trust us for outcome-based
cyber security that protects and enables their operations. Our AIdriven protection secures endpoints and cloud collaboration, and ourintelligent detection & response is powered by experts who identify
business risks by proactively hunting for threats and confronting live
attacks. Our consultants partner with enterprises and tech challengers
to build resilience through evidence-based security advice. With morethan 30 years of experience in building technology that meets businessobjectives, we’ve built our portfolio to grow with our partners throughflexible commercial models.
WithSecureTM is part of F-Secure Corporation, founded in 1988, andlisted on the NASDAQ OMX Helsinki Ltd.