In this webinar, we share advice on how to evolve vulnerability management from an IT-only discussion to an IT & business collaboration, to drive better metrics, resourcing, and communication. The discussion includes a live demo showing examples of business-centric approaches that can improve the vulnerability metrics that IT organizations struggle with today. Led David White, lead consultant for Iceberg’s cyber risk practice. From March 2017.

2. TODAY’S PRESENTER
DAVID WHITE
Senior GRC Consultant
Iceberg
dwhite@icebergnetworks.com

3. AGENDA
Traditional Vulnerability Management
What’s missing
Risk-driven Vulnerability Management
Adding business context
Where do we start?
Demo
What’s next?

4. TRADITIONAL VULNERABILITY MANAGEMENT
Scan Identify Analyze Remediate Reporting
Risk

5. WHAT’S MISSING
• What business functions are
impacted by these vulnerabilities?
• Is this a positive or negative report?
• What is the compliance status for
SOX and PCI?
• What are the remediation plans and
how will remediation effect the
numbers on this report?
• Reports/dashboards, should provide
decision makers with data to enable
better decision making.

6. RISK-DRIVEN VULNERABILITY MANAGEMENT
43%
Reduction in number of open
vulnerabilities when
executives or board for
directors are held accountable
for breaches
11%
Acceleration in vulnerability
remediation when executives
or board for directors are held
accountable for breaches
103 days
On average, time a company
takes to remediate a security
vulnerability
6,449
Number of vulnerabilities
reported in 2016 through the
National Vulnerability
Database
Evolve vulnerability management to an IT & business collaboration,
to drive better metrics, resourcing, and communication.

7. ADDING BUSINESS CONTEXT
IT Asset
Vulnerability
Data
IT Asset
Properties
CVSS Score
Remediation
IP Address
Network Details
Services
Operating System
Age

8. ADDING BUSINESS CONTEXT
IT Asset
Vulnerability
Data
Business
Process
Business
Services
Applications
IT Asset
Properties
Location
Owner
CVSS Score
Remediation
Internal Services
Client Facing
Physical
IT Owner
Business Owner
Virtual
Country
Data Center
IP Address
Network Details
Services
Operating System
Supporting Software
Client Software
Corporate Process
Department Process
External Services
Age
Risk
Register
Exceptions
Remediation Plans
Metrics

9. WHERE TO START
IT AssetBusiness ProcessesProduct & Services
Vulnerability
Business Hierarchy
People
Applications
Locations Risk Register
Reporting

10. DEMO

11. ARCHER USE CASE
Threat Management
§ Consolidate threat data from trusted sources in a
searchable, standards- compliant database
§ Analyze and react to vulnerability and malicious
code warnings
§ Automatically notify responsible personnel so they
can proactively address emerging threats
§ Report on threats by technology, severity, type,
status and impact to your organizations business

12. ICEBERG - RISK INTELLIGENCE
Risk Data
Trusted
Aggregated,
Transparent
Decisions
Informed
Confident
Effective
Business Leaders
Board
Executives
Management
“Trusted, aggregated and transparent risk data for business leaders,
enabling organizations to make informed, confident and effective decisions.”

13. icebergnetworks.com/vulnerability/
info@icebergnetworks.com
Twitter: @icebergnetworks