The Unpatchables
In a perfect world, there would be no vulnerabilities. In a perfect patching world there would be a patch for every vulnerability and we would always be able to patch all of our systems as soon as a patch was available. In the real world we do the best we can and struggle with testing cycles, incompatibilities, and legacy applications which means sometimes we have to leave insecure and unpatched systems in production.
There are a variety of situations that can cause exposure:
- Some patches break needed applications or cause compatibility problems
- Patches may not yet be available for a vulnerability but the systems must stay online and exposed Legacy applications or operating systems may still be required (for example Internet Explorer 6 may be required to access a legacy web application, probably running on a legacy web server)
- A maintenance window may not be immediately available when patches are released
- Systems in development environments may be vulnerable during development and testing phases
These vulnerable systems can be hardened and some mitigation may be possible, but they will always require close monitoring to make sure that they are not compromised.
Tenable's Unified Security Monitoring (USM) simplifies the monitoring process thorough instrumentation of sensitive or targeted systems. A dashboard such as the Threat Matrix could be tuned to deliver the insight needed to evaluate and monitor these exposed systems.
It is important to carefully monitor widely accessible systems for unusual activity including unexpected system changes, unapproved scanning, or intrusion events. This also applies to systems that have restricted access with the addition of monitoring for new host relationships and unexpected file access- activities that could indicate not only attacks, but misconfigured network segregation that exposes these systems.
Using a combination of active and passive scanning with Nessus and the Passive Vulnerability Scanner (PVS), log aggregation and normalization with the Log Correlation Engine (LCE), and SecurityCenter for correlation, reporting, and alerting, Tenable’s USM offering can provide the insight you need to evaluate and monitor unpatched, exposed systems.
Related Articles
Study: Tenable Offers Fastest, Broadest Coverage of CISA's KEV Catalog
October 23, 2023Tenable ranked first in multiple vulnerability management categories, including the most comprehensive coverage and quickest detection of CISA's Known Exploited Vulnerabilities, according to a Miercom report commissioned by Tenable.
Tuning Network Assessments for Performance and Resource Usage
September 13, 2022Using the correct tool for the job and optimizing scanner placement will have a large impact on scan efficiency with Nessus, Tenable.io and Tenable.sc.
Terrascan Joins the Nessus Community, Enabling Nessus To Validate Modern Cloud Infrastructures
May 17, 2022The addition of Terrascan to the Nessus family of products helps users better secure cloud native infrastructure by identifying misconfigurations, security weaknesses, and policy violations by scanning Infrastructure as Code repositories.
Navigating Security Challenges Around OT in the DoD’s Manufacturing Lines
April 15, 2024How operational technology can revolutionize logistics, supply chain management, and overall efficiency.
CVE-2024-3400: Zero-Day Vulnerability in Palo Alto Networks PAN-OS GlobalProtect Gateway Exploited in the Wild
April 12, 2024A critical severity command injection vulnerability in Palo Alto Networks PAN-OS has been exploited in limited targeted attacks. While a fix is not yet available, patches are expected to be released on April 14 and mitigation steps are available.
Cybersecurity Snapshot: CISA Says Midnight Blizzard Swiped U.S. Gov’t Emails During Microsoft Hack, Tells Fed Agencies To Take Immediate Action
April 12, 2024Check out CISA’s urgent call for federal agencies to protect themselves from Midnight Blizzard’s breach of Microsoft corporate emails. Plus, a new survey shows cybersecurity pros are guardedly optimistic about AI. Meanwhile, SANS pinpoints the four trends CISOs absolutely must focus on this year. And the NSA is sharing best practices for data security. And much more!
- Nessus
- Patch Auditing
- SecurityCenter