Page 218 - Cyber Defense eMagazine Annual RSA Edition for 2024

Whose responsibility is it anyway?

VM remains deceptively reliant on manual processes in 2024. In more blunt terms, it is prone to human
error. It's common to find a lack of clarity in roles, responsibilities, and communication when addressing
vulnerabilities.

This fragmentation results in a patchwork of efforts between and within security teams and other
stakeholders, including IT production teams or application owners. Rather than working in harmony, they
are frequently driven by conflicting goals. When VM lacks a coordinated strategy, it becomes reactive,
which puts organizations at higher risk of oversights and inefficiencies.

This approach can lead to several serious issues. On the one hand, it could mean actions are duplicated
with multiple teams unknowingly completing the same tasks and wasting time and resources. At the other
end of the scale, critical vulnerability management tasks may go uncompleted because everyone
assumes someone else will be doing it – potentially leaving vulnerabilities open to exploitation. “That’s
not my job” are the four most dangerous words in cybersecurity.

Lack of clear responsibility and poor communication can also hamper the ability to respond to new
vulnerabilities quickly. This is especially dangerous regarding high-risk CVEs, which are a race against
time to patch before threat actors discover and exploit them.

A lack of proper tools and processes for the job often compounds these organizational issues. VM activity
is frequently accomplished through multiple tools that don't connect, further adding to the fragmented
approach. Teams often have no central repository for VM priorities and needs; and no, Excel
spreadsheets and emails don’t count.

Getting organized with a VOC approach

It's common to find that VM responsibilities are within the remit of the Security Operations Center (SOC)
in the hope of creating a more organized approach. This is reasonable since the team there is chiefly
concerned with cyber risk. But it can also be problematic given the SOC already has a broad spectrum
of responsibilities including addressing active threats, performing essential triage and threat-hunting
activities. As any SOC operative will attest, their plates are already heaped high without them also bearing
the brunt of all proactive vulnerability management.

However, while the SOC team itself should not be the ones to manage all VM activity, the SOC’s
centralized, automated model is the right way to go. The Vulnerability Operations Center (VOC) provides
a solution to deliver just this without burning out your existing security teams

Like a SOC, the VOC offers an integrated and risk-based approach to vulnerability management. Unlike
a SOC, it focuses on prevention rather than response. The goal is to create a central control point,
aggregating all available vulnerability data in one place. This enables the team to gain a complete picture
of every VM issue and prioritize activity accordingly. A risk-based approach means the most critical and
high-risk items are tackled first. This more automated and streamlined process, free of unreliable manual

218