From reactive to proactive vulnerability management

Many security teams are constantly putting out fires, leaving no time for strategic initiatives. While fires certainly need to be put out, wouldn’t it be great if you could get ahead of fires and prevent them from occurring in the first place?

Granted, this is easier said than done. An effective solution for this is risk-based prioritization, where risks are prioritized according to the potential risk they pose to the organization. The higher the potential risk, the higher the priority to fix the risk. The earlier you can fix the most critical risks, the more fires you will prevent. But once the most critical ones are fixed, how do you decide what to tackle next, knowing you only have limited resources?

Decisions, decisions, decisions

While risk-based prioritization is absolutely essential to ensure that the biggest ‘security holes’ in your environment are fixed, this method only looks at risk. It does not consider the effort needed to fix the identified issue and whether efforts can be combined to achieve cost savings. While a highly critical, exposed CVE needs to be fixed or mitigated (practically) no matter what the cost, that still leaves hundreds of medium to high risk vulnerabilities that also need to be fixed. In a world of finite resources, which ones should you tackle first to get the biggest risk reduction at the lowest effort?

To decide this, several factors need to be taken into account when deciding what to remediate next:

• What is the potential impact if this risk is exploited?
• How likely is it going to be exploited?
• How easy is it to remediate?
• How much time would remediation take?
• Can remediation efforts be combined to save time?
• What would the security improvement be?

Trying to answer all these questions is no easy feat. This is why we built Mondoo’s ‘Move the needle’, the first remediation prioritization dashboard that considers both impact and effort. 

Move the needle dashboard

This dashboard gives you fast answers so it’s immediately clear where you can get your next biggest quick win. By showing this information front and center, you spend less time making decisions, and start remediating earlier and more effectively.

The dashboard shows the current space risk and identifies the top actions for risk reduction along with a take action button for fast mobilization. For each risk, Mondoo shows the number of affected assets, the effort in hours and minutes to fix the risk, and the decrease in space risk. Remediations are ordered by highest impact and lowest effort. Let’s break this down in more detail:

#1. Average risk score

The space risk shows the average risk score between 0 and 100 and is calculated by taking the sum of all risk scores and dividing it by the amount of findings. So a risk score of 0 means all vulnerabilities have an average of 0 risk (let’s face it, this is not going to happen in a real environment), and 100 means all vulnerabilities have the maximum risk (yikes!).

The table below shows the meaning of the different score ranges:

#2. Top actions for risk reduction

Here’s where it really gets interesting. This is where Mondoo ranks remediation projects with the highest impact and lowest effort. For each project it shows:

Risk reduction: 

For each remediation effort, Mondoo shows the risk reduction in the space. This is calculated by first summing the potential improvement: we take the 'risk gap' per asset (100 minus the CVE risk score) and multiply it by the number of assets with that CVE.

For example, if a CVE has a risk score of 75, the risk gap is 25. If that CVE is on 20 assets, the total potential improvement is 25 x 20 = 500.

That sum is then divided by the Total Findings in Space. The result is the final Risk Reduction value—the exact number of points your space score will go down.

Number of assets:

Here we list the number of assets that are affected by this same CVE. This provides insight into how widespread the finding is. The higher the number of assets, the greater the remediation impact will be.

Effort estimation:

For this number we estimate the manual remediation time and the Mondoo effort. Since Mondoo automates many parts of the remediation process, using Mondoo to remediate vulnerabilities is much faster than the manual way.

The manual remediation effort factors in time for:

1. Research and planning
2. Scripting and Testing
3. Staged Rollout
4. Verification

These processes can be a significant effort in complex environments with many assets, and often require specialized skills to determine remediations and write remediation scripts for Ansible, Terraform, PowerShell, etc.

Mondoo effort:

Mondoo significantly speeds up the remediation process by accelerating and even completely eliminating some manual tasks:

• Research and planning: Mondoo provides all the asset details and remediation steps for each OS variation and environment.
• Scripting and testing: Mondoo provides ready-to-use and pre-tested code snippets.
• Stage rollouts: Rollouts are much faster when using Mondoo pipelines for Ansible and Terraform.
• Verification: Mondoo automatically verifies fixes so there’s no manual effort involved.

Manual vs Mondoo effort comparison

The table below shows the comparison between manual remediation effort and Mondoo effort:

Move the Needle workspace focus areas

Another cool thing is that Mondoo not only shows you a Move the Needle dashboard for your entire environment, but also for your individual workspaces. This means that you can see your quickest remediation wins by focus area, such as team, location, technology, and asset criticality. For example, if you have a workspace for all your critical assets, Mondoo will show you the biggest remediation wins available to you in that particular workspace.

A real-life example

So let’s talk about a real-life example. Imagine you’re a security professional and your Mondoo space risk is at 98 (yikes!). How can you get this risk score down as quickly as possible? Time to consult the Move the Needle dashboard.

Read our blog describing a real-world scenario where we were able to reduce our space risk by 54% in under 3 hours, with the help of Move the Needle and Mondoo’s fast remediation.

About Mondoo

Mondoo is an exposure management platform that identifies, prioritizes, and addresses vulnerabilities and misconfigurations in your entire IT infrastructure and SDLC from a single interface — covering on-prem, cloud, SaaS, and endpoints. Unlike siloed approaches, Mondoo enables you to quickly understand your most urgent risks and initiate fast remediation, ensuring optimized security efforts and significantly improving security posture. 

To learn more about the Mondoo platform, schedule a demo with one of our experts.