Vulnerability Management Process
This document presents the general vulnerability management process and shows in detail all procedures to be performed when vulnerability is discovered
Process covers the vulnerability reports provided by recurring internal scan results as well as external 3rd party reports.
Also provides general understanding to all involved parties (Information Security Team, Information Asset Owners and Operational Team) of communication flow, responsibilities and desired results.
Scope
This process applies to all Corporate Group owned devices and devices connected to the Corporate Group‘s network and may apply to personally-owned devices if used exclusively or extensively to conduct Corporate Group related business needs.
Periodic Vulnerability Assessment - Existing Asset
Vulnerability assessment must be conducted of all of networked computing devices on a periodic basis.
At a minimum, authenticated scans must be conducted on a quarterly basis.
Monthly scans are required for the following networking computing devices:
Critical assets
Assets that must meet specific regulatory requirements, e.g., PCI DSS, etc.
All file-system images or virtual machine templates used as base images for building and deploying new workstations or servers
Any network infrastructure equipment.
Scans must be performed during hours appropriate to the business needs of the entity and to minimize disruption to normal business functions.
No devices connected to the network must be specifically configured to block vulnerability scans from authorized scanning engines.
New Asset Vulnerability Assessment
No new assets shall be considered in production until a vulnerability assessment has been conducted and vulnerabilities addressed.
Corporate Group may conduct vulnerability assessments:
At the completion of the operating system installation and patching phase
At the completion of the installation of any vendor provided or in-house developed application
Just prior to moving the asset into production
At the completion of an image or template designed for deployment of multiple devices
For vendor provided assets, prior to user acceptance testing and again before moving into production
For all new network infrastructure equipment, during the burn in phase and prior to moving to production
At the completion of each of the above vulnerability assessments, all discovered vulnerabilities must be documented and remediated.
Limitation of Scanning
Corporate Group must not conduct intrusive scans of assets that are not under their direct authority.
Networked computing devices that appear to be causing disruptive behavior on the network may be scanned using nonintrusive methods to investigate the source of the disruption.
Remediation
Discovered vulnerabilities must be remediated and/or mitigated based on the following rules:
Critical risk vulnerabilities must be fully addressed within 2 calendar days of discovery.
High risk vulnerabilities must be fully addressed within 7 calendar days of discovery.
Medium risk vulnerabilities must be fully addressed within 30 calendar days of discovery.
Low risk vulnerabilities must be addressed within 90 calendar days of discovery.
Vulnerabilities are considered remediated when the risk of exploitation has been fully removed and subsequent scans of the device show the vulnerability no longer exists.
It may be cases where Corporate Group accepts the risk produced by the vulnerability.
Process Diagram
Vulnerability management procedures
1.
Scan cycle started
Scan cycle initiated using automated tools.
New scan
Information Security Team
At least once a quarter
2.
Assets gathered and confirmed
Assets are gathered using automated tools and confirmed with Asset Owner.
Asset list
Information Asset Owner
2 days from scan cycle initiation
3.
Automated scanning started
Scan is started using the automated tools
Scan report
Information Security Team
1 day after assets obtained
4.
Vulnerability confirmed
Vulnerability was detected during the scan
Vulnerability report
Information Security Team
Immediately after the vulnerability was detected and no later than in 1 day
Registration
5.
Vulnerability assessment
Identified vulnerability is assessed, risk score is calculated.
Risk score
Information Security Team
Immediately after the vulnerability was confirmed and no later than in 1 day
6.
Register the vulnerability
Vulnerability is registered to the vulnerability management framework
Vulnerability entry
Information Security Team
Immediately, no later than in 1 day
7.
Request change
Request for change / remediation is issued to the asset owner
Ticket created
Information Asset
Owner
1 day after the assessment was completed
Remediation
8.
Remediation
Vulnerability is resolved
Vulnerability mitigated
Operational Team
2 days for critical
7 days for high
30 days for medium
90 days for low risk vulnerability
9.
Log the outcome
Vulnerability ticket is closed, outcome is documented.
Vulnerability mitigation is logged
Information Security Team
Immediately
Review and Update
This Process must be maintained in accordance with the Information Security Policy.
Revision History
0.1
LŠ
GK
2023-05-20
2023-05-23
0.2
LŠ
DM
2023-11-02
2023-11-02
0.3
GK
DM
2024-09-10
2024-09-10
Last updated