To state the obvious, vulnerability management is a challenge for organizations, and this is not just because of capacity. Some worry that applying updates will disrupt critical business systems. Legacy IT, remote devices, and risks from supply-chain attacks add further complexity.
There are also turf issues between teams, causing delays in patching. Based on the latest Life and Times of Cybersecurity Professionals report from the Information Systems Security Association (ISSA), the two most popular responses organizations can take for improving the working relationship between IT and cybersecurity teams are:
1. Embedding security staff into functional technology groups
2. Automating processes requiring collaboration between IT and security
Even with automation helping reduce the time to remediate, there still remains residual risk. Of the 23,019 vulnerabilities that Mythos Preview identified, there were only 75 vulnerabilities that had a patch out of 530 bugs reported by Anthropic when the firm released its initial report.
Hon. Melissa Hathaway highlights that the gap between identifying and fixing a vulnerability is where organizations are most vulnerable noting that “[AI models] collapsed the time window from sixty days to about four hours.” Both creativity and collaboration are needed to address this.
Creativity
Creativity is a boost for businesses, supporting innovation, productivity, adaptability and fostering growth. Vulnerability management teams should consider holding brainstorming sessions with other teams that may result in solutions outside the traditional workflow. While others may focus on upgrading or implementing AI to remediate vulnerabilities, a better solution may just be removing software that is no longer necessary.
Creative thinking may also identify assets that do not get maintained regularly. Troubleshooting these devices may result in resolving an issue while also remediating any vulnerabilities identified on them.
Collaboration
Effective teamwork depends on team members collaborating. Consider collaborating to develop a process and reporting system that supports remediation with IT. This can lead to a reduced number of meetings and a reduced backlog of tickets through prioritization. Adding another ticket to the backlog may not be the best way to communicate that there is another vulnerability that needs to be remediated. Vulnerability management teams should also collaborate with IT to find and acquire new tools that enhance capabilities. Reviewing automatic deployment rules and baseline images are also other options.
How AI Can Assist
Creativity and collaboration can build off from AI. AI may help vulnerability management teams respond quicker; however, each business is different. Teams should consider using AI to uncover any gaps in existing processes or provide practical recommendations available. Sangeeta Arora, Director of Vulnerability Management at Adobe, recommends vulnerability management teams to look at ways to mitigate risk while vulnerabilities get remediated and to embed AI into every aspect of the vulnerability management lifecycle.
A prompt to Grok provided these recommendations that organizations can implement today:
- Assign clear ownership
- Create a dashboard showing high-risk vulnerabilities and remediation progress
- Educate employees on the importance of updates
- Implement a policy requiring new systems and software to be inventoried and included in the patching process before going live
- Invest in a vulnerability management platform that provides threat intelligence for your environment
- Track meaningful metrics
With more vulnerabilities to address, discipline becomes more important in vulnerability management. By collaborating with other teams to create solutions, organizations can improve their security posture against cyber threats. Based on AI, vulnerability management teams should start with visibility and prioritization, integrate security into everyday IT processes, and foster a culture where everyone understands their role. Information system owners or system engineers may provide more specific steps that may not be found through generic prompts.
Disclaimer: This article was prepared by the author in his/her personal capacity. The views and opinions expressed in this article are those of the author and do not necessarily reflect the official policy, opinion, or position of their employer.
