Vulnerability Detection and Response; Address CVEs

Cyber assaults continue to pound the attack surface and then lateral pathways are exploited and used to spread further into organizations, leading to total compromise. You want to know where you’re vulnerable and how to fix it, and this is what vulnerability detection, vulnerability response, and vulnerability management tools are for.

Vulnerability detection is the identification of software vulnerabilities across your systems. It should include scanning for the national Common Vulnerabilities and Exposures (CVE) database, adherence to MITRE guidance, and additional crowdsourced threat intelligence to identify software flaws and misconfigurations in the environment. These CVEs can be detected via database scans, application scans, host-based scans, and other scans.

Vulnerability response pulls vulnerable software assets aside and groups them for remediation. This is the crucial second half of overall vulnerability management, where that which is detected as a vulnerability or threat is dealt with.

Vulnerability management is the identification, analysis and treatment of security vulnerabilities in systems and software. It involves both vulnerability detection and automated response, as a one-two, or simultaneous, double punch.

Learn more about Atomicorp vulnerability detection and vulnerability management. Protect attack surfaces and block invasion routes, while meeting compliance standards.

Scan for CVE ID Remediation and Compare Against GTI

Watch the video below.

Vulnerability Detection and Management from Atomicorp

Vulnerability management requires strong continuous monitoring and remediation of security flaws, missing patches, misconfigurations and other means that attackers use to breach organizations. Modern vulnerability assessment requires near real time detection of vulnerabilities on all your endpoints, as opposed to old school, labor- and time-intensive network based scans that can take days or weeks to complete, and rely on all your assets, like laptops and mobile devices, to be accessible. Today’s vulnerability assessment requires full time access to every endpoint to ensure missing patches and misconfigurations don’t provide opportunities to breach your organization.

Lateral Movement

The top way that modern hackers compromise organizations is by finding a known vulnerability, and using that to gain access to a trusted network or environment. This is how some of the biggest compromises occurred: through lateral movement. In the SolarWinds hack, hackers gained access to vulnerable internal systems, and from there were able to use admin access on those systems to gain control over systems that were NOT vulnerable. This one-two punch is how hacking really happens.

Malicious lateral movement spread into 18,000 organizations and government agencies as a result of the SolarWinds hack.

Vulnerability Detection and Defense in Depth

When vulnerability detection is combined with defense-in-depth (i.e., layered defense that places multiple successive physical or logical barriers in the path of the adversary), this provides the one-two punch to stop hackers. Once inside your network, adversaries need to be able to perform reconnaissance, move laterally, escalate privilege, access data, and exfiltrate assets. The more obstacles for them, such as exploit-free software, the better your ability to stop the spread and damage.

Lateral defense-in-depth starts with zero trust, which means treating every asset as if it were the weakest link. This includes fixing known vulnerabilities quickly, eliminating vulnerable default settings, controlling remote access such as preventing Remote Desktop Protocol default settings from leading to the compromise of critical assets, preventing limitless Administrative shares, and protecting endpoints at the endpoint. Once modern hackers breach the perimeter, most organizations are doomed. They can easily perform reconnaissance, gain access to internal systems, and use this to spread malware or malicious activity with impunity.

Vulnerability management and intrusion and protection systems such Atomic OSSEC and Atomic Protector provide the vulnerability detection and management and lateral defense-in-depth you need against sophisticated attacks such as Dark Halo and Sunburst.

It’s detection and CVE scanning across multiple operating systems, open source and Windows. Atomicorp CVE scanning extends across Linux, Windows, and AIX environments, major cloud platforms, digital transformation projects, and legacy systems such as HP-UX, RHEL 5, Solaris, and Ubuntu. Watch the video to see it in action.

Find out more about vulnerability detection, vulnerability response, and vulnerability management in Atomicorp’s intrusion detection and cloud workload protection systems.

Check out Atomic OSSEC at work against lateral attacks in Windows.

Watch the lateral movement video.