SANS Institute Investigates the Modern Complexity of Vulnerability Management

BETHESDA, Md., Nov. 2, 2020 /PRNewswire/ -- Vulnerability management is an established function of information security, but with technology configurations constantly evolving and cloud and container infrastructure expanding, the complexities of VM persist. In a new white paper and accompanying webcast "SANS 2020 Vulnerability Management Survey," SANS Analyst, Instructor, and Author David Hazar will share his analysis of this year's survey results and discuss how organizations' vulnerability programs are maturing in response to changing technology, architecture, and design.

The positive takeaway is that most organizations are following best practices for vulnerability identification and already taking steps to prioritize vulnerabilities based on asset value and exploitability. A full 87% of the respondents stated that they have some VM processes in place, and formal programs—often ushering in a growing use of automation—are on the rise. However, responsibility for successful VM outcomes is shared across multiple teams including IT, security, development, audit/risk and compliance, making it difficult to expose blind spots and close timelines to remediation.

The webcast and white paper will further outline respondents' answers on the following topics:

• How organizations are discovering different types of vulnerabilities on different systems and within their applications along with discovery frequencies
• What remediation processes are operational and the level of maturity
• How vulnerabilities are prioritized and whether deadlines are established
• Who in the organization is responsible for the different processes related to vulnerability management

"The end goal for all this effort is to enable organizations to effectively and efficiently remediate vulnerabilities; . . . anything security can do to help identify and remove impediments will make remediation that much easier for IT organizations," said Hazar.

The webcast featuring David's survey analysis will take place at 1 pm EST Tuesday, November 10. More information about that webcast can be found at https://www.sans.org/u/18pD.

A second webcast will take place the following day, featuring a panel discussion lead by report author David Hazar and with guests Jerry Caponera, VP Cyber Risk Strategy at ThreatConnect, and Mehul Revankar, Vice President Product Management and Engineering at Qualys. More information about this webcast can be found at https://www.sans.org/webcasts/2020-vulnerability-management-survey-panel-discussion-115710.

About SANS Institute The SANS Institute was established in 1989 as a cooperative research and education organization. Today, SANS is the most trusted and, by far, the largest provider of cyber security training and certification to professionals in government and commercial institutions world-wide. Renowned SANS instructors teach more than 60 courses at in-person and virtual cyber security training events and on demand. GIAC, an affiliate of the SANS Institute, validates practitioner skills through more than 35 hands-on, technical certifications in cyber security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers a master's degree, graduate certificates, and an undergraduate certificate in cyber security. SANS Security Awareness, a division of SANS, provides organizations with a complete and comprehensive security awareness solution, enabling them to easily and effectively manage their 'human' cybersecurity risk. SANS also delivers a wide variety of free resources to the InfoSec community including consensus projects, research reports, webcasts, podcasts, and newsletters; it also operates the Internet's early warning system--the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to support and educate the global information security community. (https://www.sans.org) 

SOURCE SANS Institute

Related Links

https://www.sans.org