Vulnerability Report Best Practices

---

Maximize Effectiveness of Reporting

• Use appropriate tools
  • identify reporting need first, then select the best tool for the need
• Consistency
  • develop policies and procedures for generating reports on a regular schedule
• Follow best practices
  • use consistent formats, standard color-coding to highlight important information
  • stay focused on critical information
• Automate
  • use automation in as many places as possible
  • makes the process more consistent, reliable, efficient, and easy to maintain

Vulnerability Report Content

• include detailed information about each vulnerability:
  • type of vulnerability
  • number of instances
  • affected systems
  • risk levels
  • recommendations and mitigations
• asset inventory is a critical component
  • bc identifies systems to be evaluated
  • if this is inaccurate, then so is vuln report
• cause of vuln recurrence
  • incorrect asset inventory
    • when corrected by adding missing assets, can introduce old vulns
  • misconfigured scans
    • may run improperly due to
      • invalid credentials
      • improper scan settings
      • invalid hostnames or IP addresses
      • etc.
    • once fixed, old vulns may now appear in report

Risk Score and Priority

Risk scores help measure the risk posed by a particular system, application, or individual vulnerability in terms of being successfully hacked or breached.

• depends on many factors:
  • nature and quantity of discovered vulns
  • severity of vulns
  • potential impact
  • likelihood of exploitation
• uses
  • to prioritize work
    • e.g., zero-days and critically severe vulns
  • compare security posture of different organizations in same sector
    • can help identify vulns that are more common among specific orgs
  • determine if security posture is adequate to those in same sector

Top 10 Lists

• top 10 styles lists can help highlight potential problems or focus on important activities/trends/changes
• e.g.,
  • traffic volume by device
  • protocols by volume
  • inbound traffic protocols by volume
  • outbound protocols
  • top external IP connections
  • email volume by user
  • malware alerts by user
• effective when used in dashboards

Compliance Reports

Compliance reports provide a detailed overview of how an organization is adhering to the laws, regulations, and standards that apply to its operations.

• typically used to:
  • evaluate the effectiveness of an organization’s compliance practices
  • assess the organization’s compliance with applicable laws
  • provide important information to stakeholders and regulators
• can help identify potential areas of noncompliance, identify potential risks, and develop strategies to address them

Types

• Regulatory compliance reports
  • Prepared by qualified personnel
  • include information on:
    • policies and procedures
    • internal audit results
    • employee training records
    • risk assessments
    • and other relevant data
  • The law, policy, contract, or regulation mandating the compliance report dictates its content
• Internal compliance reports
  • Include:
    • assessments of endpoints to validate configuration per required secure configuration baselines
    • employee adherence to established procedures
    • vendor management practices
    • change management practices
    • user account management
    • and many other areas

Effectiveness and Relevancy

• provide context and analysis around trends, critical vulnerabilities, and zero-day vulnerabilities
• can analyze trends over time to understand:
  • where vulnerabilities are most prevalent
  • where remediation efforts should be prioritized
• highlight critical vulnerabilities that pose the most significant risk
  • provide recommendations for addressing them
• include analysis and recommendations for newly discovered zero-day vulnerabilities with no available patch
• use a risk-based approach that considers the severity of the vulnerability and its potential impact to:
  • help organizations prioritize their efforts
  • allocate resources more effectively
• provide actionable recommendations for remediation and mitigation
  • include specific steps