Tips for Vulnerability Management Reporting | Reciprocity

A vulnerability management program is crucial when analyzing an organization’s security posture and devising a plan to remediate any flaws within its cybersecurity.

ISO certification, and in particular the ISO 27001 standard, is one component of vulnerability management and risk management—and a big one, at that. This certification can assure that customers and employees feel comfortable with the business handling their sensitive data, such as payment card information. To obtain the certification, an ISO checklist must be created.

The other piece of vulnerability management is a vulnerability assessment. To understand which parts of the organization’s security are weak, a vulnerability scan must be performed, and then a report must be written. Unlike penetration testing, vulnerability assessments can be automated, easing some of the burden for your security team.

What is a vulnerability assessment report?

A vulnerability assessment report documents the findings of the assessment. It also contains recommendations to remediate whatever security vulnerabilities the assessment found. Attention to detail is critical here, to ensure organizations know exactly what weaknesses exist and how to patch them. 

This applies even to wording in the report; the language must be understandable not just to those familiar with the IT world, but also to any senior executives within the company. 

What are the metrics for vulnerability management reporting?

In theory, it’s possible to assess every single aspect of the company’s IT systems. In practice, that approach can cause high-risk threats to become lost among heaps of other information—so selecting the right metrics to include in a report is crucial. Paying attention to evolving threats will assure that the system stays step ahead of security vulnerabilities, and will instill faith in stakeholders by generating a clear, concise report of what truly matters. 

So what issues should a vulnerability management report measure, to assure your application security is satisfactory?

Inventory Scanning

• How many assets are known, in comparison to how many are scanned?
• How often are assets scanned, and by what grouping?

Time to Detect

• How long does it take for vulnerabilities to be detected across the system? 

Patching & Remediation

• How many vulnerabilities were found, versus the number of vulnerabilities patched?
• How long was the vulnerability known before patching occurred?
• How often was the same vulnerability reopened? (This gets at whether the patching is process flawed.)

Prioritizing

• Which security vulnerabilities are most critical?
• How many critical vulnerabilities are open?

What should a vulnerability assessment report contain?

A robust vulnerability assessment report should contain the following three elements: executive summary; assessment overview; and results & mitigation recommendations.

Executive Summary

This section reviews the vulnerability scan’s results. It gives readers a look into how well or poorly a system performed. It can then classify the organization as having a low, medium, high, or critical risk level. 

As the title suggests, this is simply a summary. Too many details will overwhelm the reader, so graphs are used to depict how many vulnerabilities exist within the system and how critical they are. 

In short, this section offers a big picture view of issues, especially for senior executives who may not be well-versed in security.

Assessment Overview

This section should clearly and concisely state the validation, investigation, and deliverables given by the vulnerability assessment. The open source, commercial, and custom tools used by the scan should be included. 

The reader should be able to leave this portion of the report with enough information that, if warranted, he or she could investigate further. 

Results and Mitigation Recommendations

This section lists and describes each security vulnerability, including (ideally): 

• Name of the vulnerability 
• Date of discovery
• Vulnerability score
• Detailed description
• Process to detect the vulnerability
• Proof of concept of the vulnerability
• Guidance for remediation
• Prioritization of vulnerability (This is where CVSS is helpful.)

This portion of the report is crucial, which means attention to detail is paramount. 

Conclusion

A comprehensive vulnerability management program is essential to keep your organization (and all the information it contains) safe from data breaches, hackers, and whatever else might harm your assets. A detailed and solid report is a great stepping stone to assure your cybersecurity is effective.