Introducing the Vulnerability Management Maturity Model - VM3 The information security landscape has evolved significantly during the last 5 years with the emergence and wider use of new technologies such as Cloud, BYOD, Mobile and the Internet of Things. Alongside this landscape, corporate organizations‰Ûª key defense leaders, CIOs, CSOs and CISOs, have evolved in their information security defense strategies, as well as in how they think and approach information security. This different and evolved landscape, combined with defense leaders‰Ûª new mindset, has influenced key information security processes and in particular, has resulted in a greater understanding of the process of Vulnerability Management. This session presents a Vulnerability Management Maturity Model, referred to as VM3, and which identifies six different levels of vulnerability management maturity within which different organizations operate. Detailed findings and lessons learned from of a recent study on vulnerability management maturity are shared. The session covers the six high level activities, as well as a surrounding business environment which characterize an organization's execution of the vulnerability management process. Key challenges present within each of the six high level activities of vulnerability management, as well as challenges imposed by the organization's surrounding business environment are identified and described. Attendees will learn and appreciate how these key challenges impede one's ability to achieve higher levels of maturity, as well as strategies on overcoming these identified challenges. Attendees will learn how they may help their organization evolve to higher levels of vulnerability management maturity, with the goal of achieving lower levels of information security risk. Gordon MacKay, CISSP, Software/Systems Guru with a dash of security hacking, serves as CTO for Digital Defense, Inc. He applies mathematical modeling and engineering principles in investigating solutions to many of the challenges within the information security space. His solution to matching network discovered hosts within independent vulnerability assessments across time resulted in achieving patent-pending status for the company’s scanning technology. He has presented at many conferences including ISC2 Security Summit, Cyber Texas, BSides Detroit, BSides San Antonio, BSides Austin, BSides DFW, RSA and more, and has been featured by top media outlets such as Fox News, CIO Review, Softpedia and others. He holds a Bachelor's in Computer Engineering from McGill University and is a Distinguished Ponemon Institute Fellow.

1. @NTXISSA #NTXISSACSC3
Introducing the Vulnerability
Management Maturity Model - VM3
Gordon MacKay - @gord_mackay
Chief Technology Officer
Digital Defense Inc.
October 2016

2. @NTXISSA #NTXISSACSC3
Overview
• What is Vulnerability Management and how has it
Evolved
• Inside the CISO’s Mind
• Vulnerability Management Challenges
• Vulnerability Management Maturity Model – VM3
• Accelerating your Evolution
• Bringing it all Together
2

3. @NTXISSA #NTXISSACSC3
Vulnerability Management - Then
• Scanning the Network
Once a Year
• Reporting on Vulnerabilities
Mountains of Data
• Fixing the Issues Overwhelming Resources
3

4. @NTXISSA #NTXISSACSC3
Vulnerability Management - Now
• Management Process Overview & Policy
• Discover Assets/Applications
Data Center, Cloud, Mobile
• Discover
Consider Business Value
• Assess What?
Vulnerabilities, Configuration, People
• Assess How?
Unauthenticated, Authenticated, DAST, SAST
• Prioritize Findings
Business Value, Threat Intelligence,
Network Architecture
• Assign Findings
IT Operations
• Measure
Report
4

5. @NTXISSA #NTXISSACSC3
Vulnerability Management – Now
Integrated Security Ecosystem
5

6. @NTXISSA #NTXISSACSC3
CISO Challenges
• Think Like a General
What is Vulnerable Now?
Minimize my Risk
• Think Like Detective
Where Might I Already Be
Compromised?
Newly Discovered Threats
Reveal Possible
Compromised Assets
6

7. @NTXISSA #NTXISSACSC3
How Modern CISO Thinks – Real World
Like a General and a Detective
Hypothetical Use Case: New Zero Day Impacts Apache
version 2.4.0 – 2.4.22 but fixed in 2.4.23
7
Vulnerable Then Vulnerable Now Time

8. @NTXISSA #NTXISSACSC3
Vulnerability Management Challenges
• Too Many Vulnerabilities
How to Prioritize
• Where is Business Value
Situational Awareness
• Who Owns the Assets
Many Different Teams
• IT Security and IT Operations
Have Different Agendas
• Accuracy of Past Findings
VM Intelligence
8

9. @NTXISSA #NTXISSACSC3
VM Challenge
Scan-to-Scan Endpoint Correlation
9
time
Scan
Week 1
Scan
Week 2
IP=192.168.40.6
DNS HN= None
NETBIOS HN= Blue
MAC= Alpha
IP=192.168.40.7
DNS HN= Papaya@myorg.com
NETBIOS HN= White
MAC= Undetected
IP=92.168.40.6
DNS HN=crm.myorg.com
NETBIOS HN= None
MAC= Undetected
IP=192.168.40.5
DNS HN= None
NETBIOS HN= Blue
MAC= Alpha
Asset A Asset B Asset C
Real World Network Assets
IP=192.168.40.5
DNS HN=crm@myorg.com
NETBIOS HN=None
MAC= Undetected

10. @NTXISSA #NTXISSACSC3
Prevalence of Network Churn
DDI Study
10
Source: https://www.ddifrontline.com/wp-content/uploads/2015/08/Network_Host_Reconciliation.pdf

11. @NTXISSA #NTXISSACSC3
Vulnerability Management Maturity Model VM3
Where do I Operate?
11
Source: https://www.digitaldefense.com/vm3-whitepaper

12. @NTXISSA #NTXISSACSC3
Vulnerability Management Maturity
Major Influencing Factors
• Business Environment
Executive Management Participation
Security Awareness
Business IT Structure
• Policy
Risk Threshold
Set Goals (SLA)
• Discover & Prioritize Assets
Know Your Business Critical Assets
• Assess
Type, Depth, Breadth, Frequency
12

13. @NTXISSA #NTXISSACSC3
Vulnerability Management Maturity
Major Influencing Factors
• Prioritize Findings
• Vulnerability Severity, Asset Criticality,
Threat Intelligence, Attack Path
• Remediate
• Who are Asset Owners?
• Security Operations vs IT Operations
• Remediation/Mitigation Speed?
• Measure – Report
• Measure/Report vs Set Goals
• Measure Risk
• Learn and Evolve Based on Measurements
13

14. @NTXISSA #NTXISSACSC3
Managed Service Vulnerability Management
Can Help
• Design and Build
• Discover New Assets Ongoing Basis
• Examine, Re-examine Business Criticality
• Design, Build Assessments
Varying Types, Depth, Breadth, Frequency
• Operate
• Prioritize Findings
Understand which vulnerabilities you should take on
• Managed Service Helps Bridge Gap Between Security Operations and IT
Operations Teams
• Report
Report on what matters to you
14

15. @NTXISSA #NTXISSACSC3
Wrap Up
• Vulnerability Management – An Evolving Process
• VM Challenges
• Time – Scan-To-Scan Endpoint Correlation
• Prioritizing Findings
• Asset Owners?
• Business Communication – IT Ops vs Security Ops
• Vulnerability Management Maturation Model
• Higher Maturity Levels -> Lower Risk
• Accelerating Your VM Evolution
15

16. @NTXISSA #NTXISSACSC3
Questions?
Email: gordon.mackay@digitaldefense.com
Twitter: @gord_mackay
Support:
support@ddifrontline.com
888.273.1412 option 2
16

17. @NTXISSA #NTXISSACSC3@NTXISSA #NTXISSACSC3
The Collin College Engineering Department
Collin College Student Chapter of the North Texas ISSA
North Texas ISSA (Information Systems Security Association)
NTX ISSA Cyber Security Conference – October 7-8,
2016
17
Thank you