Vulnerability Management under ISO 27001

Learn about the best practices for vulnerability management in regards to ISO 27001.

What is vulnerability management?

Vulnerability management is the practice of identifying, classifying, prioritizing, remediating, and mitigating software vulnerabilities. It is integral to information security and information systems, and is distinct from vulnerability scanning.

Vulnerability scanning uses computer programs to identify vulnerabilities in networks, infrastructure, or applications. While scanning is an important component, vulnerability management also includes vulnerability assessments, risk assessments, penetration testing, and remediation.

A vulnerability management process should be part of your organization’s effort to control information security risks. It provides a continuous overview of vulnerabilities in your IT environment and the associated risks.

There are five steps to an effective vulnerability management process:

• ​Preparation
• ​Vulnerability scan
• ​Define remediating actions
• ​Implement remediating actions
• ​Rescan

ISO and vulnerability management

The International Organization for Standards (ISO) develops and publishes internationally agreed upon standards for information security. ISO standards are developed by experts and describe best practices for various activities.

An organization is ISO-compliant when it follows the best practices within chosen ISO standards. ISO certification requires internal audits from third-party assessors using ISO’s Committee on Conformity Assessment (CASCO) criteria.

The ISO/IEC 27001:2013 standard focuses on creating an information security management system (ISMS) that protects confidentiality, integrity, and availability of information as part of the risk management process.

Under ISO 27001:2013, a vulnerability is defined as “a weakness of an asset or control that could potentially be exploited by one or more threats.” A threat is any “potential cause of an unwanted incident, which may result in harm to a system or organization.”

Weaknesses can occur during design, implementation, configuration, or operation of an asset or control, either intentionally or by accident. Some weaknesses are easy to identify and remediate, while others require more time and resources.

ISO 27001 provides rules for managers to organize their information system and assure ongoing security compliance to avoid incidents. Through control A.12.6.1, ISO 27001 helps organizations prepare for and mitigate weaknesses via Technical Vulnerability Management.

The ISO 27001 approach for managing vulnerabilities in control A.12.6.1 includes:

Timely identification of vulnerabilities

The main objective is to detect and remediate vulnerabilities promptly. Regular vulnerability scans are necessary, as infrequent scans only provide a snapshot at a single point in time. The sooner a vulnerability is discovered, the sooner it can be remediated.

Assessment of your organization’s exposure to a vulnerability

Assigning severity levels to identified vulnerabilities helps prioritize remediation. A risk assessment assigns severity to vulnerabilities found during a vulnerability assessment. After assessment, decide whether to remediate vulnerabilities or accept the risks.

Proper measures considering the associated risks

After identifying critical vulnerabilities, create a risk treatment plan based on the risk level of each vulnerability. Allocate resources to remediate the most critical vulnerabilities appropriately.

ISO 27002 best practices for security control A.12.6.1

ISO 27002:2013 provides guidelines for organizational information security standards and policy, including the selection, implementation, and management of controls considering the organization’s risk environment.

Best practices for security control A.12.6.1 include:

Inventory of assets

Effective vulnerability management depends on knowing your information assets, including software manufacturer, version, installation location, and responsible parties. Asset management should be delegated to the asset owner.

Establish roles and responsibilities

Define roles to assure suitable tracking of assets, as vulnerability management involves many activities (monitoring, risk assessment, correction, etc.). Key roles include:

• ​Security officer: Owns and designs the vulnerability management process, ensuring it is implemented as designed.
• ​Vulnerability engineer: Configures the vulnerability scanner and schedules scans.
• ​Asset owner: Responsible for the IT asset being scanned and decides on mitigation or risk acceptance.
• ​IT system engineer: Implements remediation actions for detected vulnerabilities.

Timeline for reaction

Define a timeline to react to notifications of relevant technical vulnerabilities and address them through defined procedures.

Audit log

Maintain an audit log for the process and for maintaining traceability.

Aligning the system with incident management

Align the vulnerability management process with incident management activities to communicate data on vulnerabilities to the incident response function and provide technical solutions during incidents.

Continual improvement through corrective action and preventive action (CAPA)

Ensure controls continue to work as required and that new and emerging threats and vulnerabilities are identified and remediated. The vulnerability management program should contribute to business continuity, allowing the organization to function with minimal disruption.

Identifying, prioritizing, and treating vulnerabilities quickly helps avoid risks that could threaten business continuity management.

Vulnerability management and GRC

An effective vulnerability management process is a key method to prevent cyber threats and exploitation of information security vulnerabilities. Regular vulnerability assessments, scanning, penetration testing, and risk assessments should be routine, as the risk environment changes over time. New security controls should be implemented as needed to address new risks or misconfigurations.

ZenGRC and vulnerability management

ZenGRC is a governance, risk, and compliance (GRC) tool that supports routine vulnerability assessments, penetration testing, vulnerability scans, and risk assessments. It helps collect documentation, streamline workflows, and eliminate the need for constant follow-up while tracking outstanding risks. ZenGRC enables organizations to focus on fundamental issues of vulnerability management and compliance, making the process more efficient.

Using ZenGRC’s gap analysis tool can help create an agile compliance program and provides a single source of truth for compliance documentation.

Find out how ZenGRC can help your organization create an efficient vulnerability management process and contact them to schedule a demo.