Vulnerability Management: When 'More Scanners' Isn't the Answer

Historical Archive Note: This post was originally published on the Gartner Blog Network on March 22, 2014 by Anton Chuvakin.
Original URL: http://blogs.gartner.com/anton-chuvakin/2014/03/22/vulnerability-management-when-more-scanners-isnt-the-answer/ | Archive.org Snapshot

A client asked me recently: "Anton, our vulnerability reports have 40,000 findings. Should we buy a second scanning engine to find what the first one missed?"

My answer was simple: No. Absolutely not.

If your team cannot remediate or mitigate the 40,000 vulnerabilities your current scanner found, finding another 5,000 does not make you more secure—it merely accelerates your team's nervous breakdown.

The Broken Paradigm of Scan-and-Throw:

Vulnerability management has devolved into a mechanical exercise: security runs a scan on Saturday, dumps a 300-page PDF on the system administrators on Monday, and then blames IT when nothing is patched by Friday.

• Prioritize by Exploitability: A CVSS 9.8 vulnerability on an isolated internal test server with no network route is far less dangerous than a CVSS 6.5 flaw on an internet-facing web portal with a public Metasploit module.
• Account for Compensating Controls: WAF rules, network segmentation, and host IPS change the risk calculation completely.
• Fix the Feedback Loop: Treat remediation workflow and IT partnership as the core metric, not scanner coverage percentage.