Software Vulnerability Management

  2022 was a busy year for cybersecurity. A record-breaking number of security advisories were published, and many significant vulnerabilities were the cause of data breaches, ransomware attacks and other types of threats. Top 3 most critical vulnerabilities: Log4Shell/Log4j (CVE-2021-44228), even with its disclosure in December 2021 , many organizations are still struggling to identify and patch the vulnerability. Spring4Shell (CVE-2022-22965), still many systems remain unpatched despite the risk. ProxyNotShell (CVE-2022-41040 and CVE-2022-41082) in Exchange. DOWNLOAD THE REPORT HERE Interesting facts and trends: 2022 is the year with the most recorded Secunia Advisories since 2002 Average Threat Score of 2022:  13.66 (click here to learn how we calculate this) Average CVSS3 Score of 2022:     7.35 Less Extreme Critical Advisories have been reported in 2022 : 44  (2021: 60) 85 Advisories reported a zero-day vulnerability. (2021: 81) More than 50% of all Advisories are for Vulnerabilities in  Unix/Linux operating systems.   More than 50% of all rejected Advisories are also for Unix/Linux operating systems. Almost 79% of all Networking related Advisories are for Cisco, NetApp and Juniper. About Microsoft: 4% of all Advisories were for Microsoft which placed them on 8 th place of Vendor ranking. More than 56% of all Zero-Days were related to Microsoft Products (first place). None of the top 4 vendors with most Advisories ( SUSE, IBM, Red Hat, Ubuntu) had any Zero-Day reported in 2022. Log4j: 131 Advisories were related to Log4j, last Advisory was released in November (11 months later) for IBM Security QRadar SIEM 7.x 62 Log4j related Advisories were linked to IBM Products 33 of them were rejected Advisories with various reasons including “ the respective product does not have the vulnerable log4j component...” Less than 11% of all Advisories had a High to Critical Threat Score which means that there was evidence of exploitation. Using Threat Intelligence is going to help you with prioritizing what needs to be patched immediately.

This is very exciting! We've introduced a new user interface you may choose to use. It looks great and has some nice benefits, but it does not do everything the previous UI did. This article explains the differences and what to expect in the months ahead. 

A common question that is seen among the IT Operations and Security teams is – "How am I doing with the security vulnerabilities in my environment?" or put differently, "what is the trend of vulnerable applications and/or devices in my environment? Is it going upwards or downwards? Am I getting better at addressing software vulnerabilities?" We have heard interest in being able to answer questions like these customers, who were very keen in having a capability to build their own trend reports beyond the reports available in SVM. To help address this need, we have made some improvements to the APIs that gather such data and are leveraging these using the tool described as part of the SVM Client Toolkit. This new tool was released as part of our June 2021 update of SVM. Upon installing the new version of SVM Client Toolkit, a shortcut will be created on the desktop which allows you to pull data from SVM and store it on your local SQL server. It provides an option to establish a connection to a local SQL Server and to SVM. These steps are shown in an attached video, but the steps are pretty straight forward: When connecting to a SQL Server for the first time, select the option to create a database. The tool will create a database on the SQL Server with the required schema to store data from SVM. Upon successful connection to SQL Server and creating a database, click ‘Sync Data’ to collect SVM data for this point in time The first time you do so, the sync may take few minutes, depending on how many hosts and applications you may have in your environment. You may then choose to schedule future data syncs. To support this, the tool supports a command line switch that may be leveraged along with the Windows Task Sequencer to automatically run all the future data syncs at your desired frequency. We also provide four Power BI templates for trend reporting as a strong starting point, which you may choose to customize to your specific needs. With PowerBI Desktop installed, you may import the provided templates and change the database connection to your local database where you synced SVM data. The four provided Power BI templates represent the following sample trend reports: Applications by Criticality: Displays the trend representing the unique number of applications by their criticality (Extreme Critical, Highly Critical, Moderately Critical, Less Critical and Not Critical) . Applications by Status: Displays the trend representing the  unique number of applications by their status (Secure, Insecure and End of Life). Devices by Criticality: Displays the trend representing the unique number of devices by their criticality. If a vulnerable application is found on a device, then the device will be categorized under that application’s criticality level, for example if an Extremely Critical application is found on a device, then that device will be categorized as Extremely Critical. Devices by System Score: Displays the trend representing unique devices by their system score. System Score represents the percentage of secure vs insecure applications on a device. In this report we have color-coded the values to show red is for system score less than 80%, yellow for system score between 80% and 95%, and green for system score above 95%. Each report has a line graph on the left showing the trend and a detailed tabular report on the right. For instance: in the Applications by Criticality report, the line graph on the left shows the trend of of unique applications by their criticality across years, months, weeks, and days and the detailed report on the right shows a table with the list of all the applications. Therefore, by way of example, if Adobe AIR 3.x appears as an Extremely Critical application 4 times each in Q1, Q2 and Q4 and 5 times in Q3 for the year 2020, this would be a total of 17 occurrences for the year 2020. In the line graph Adobe AIR 3.x will be counted only once (unique) for year 2020. Similarly, it will be counted only once for each of the four quarters at the quarter level. The detailed report in the table shows all the 17 occurrences along with the quarter, week, and day on which this app was found in a scan. If you’d like to work with such data outside of PowerBI, the tabular report can be exported into an excel document if you wish you see each occurrence of an application and build your own report there.  Attached here is a video demonstrates how to use the new tool to connect to SVM and a SQL Server and pull data from SVM into SQL Server database. The video also shows how to import the in-built Power BI templates and generate a trend report. This is a starting point, and one that we intend to enhance with your feedback. Based on your input, we can extend our APIs to collect additional data and this tool to make use of them. Please leverage our Ideas portal to make specific requests for data and when possible state the purpose of the report and how you intend to action it. 

As an IT Professional, you’ve got your hands full. Any opportunity to do more with what you already have is worthy of attention most any day. But, these days with hiring freezes in place for a majority of the industry, the ability to automate something like the publishing of patches could not be timed better. To that end, I’m happy to announce that you can now subscribe to patches in SVM to have them automatically published as new versions of application become available.

Greetings software vulnerability managers.  Let’s countdown to the new year with tips to keep you most efficient in software vulnerability management.  We have broken down topics and uses of our software vulnerability management tool into (mostly) five-minute, or less, informational sessions that will be released each week December 2nd through December 24 th .  Our goal is to provide you with digestible content in the form of video series, so you can soak in as much knowledge as possible to start the new year off right with a minimal daily investment of time.  It will deliver information to help you be more efficient in the critical task of staying ahead of the next software breach. All of the videos will be available in our “Getting Started with Software Vulnerability Manager” online course available from the Flexera Community Learning Center. The topics released this week include: Overview of Software Vulnerability Manager Understanding the Risk Window Software Vulnerability Manager Overview Initial Configuration User Management Settings – User Directory Masking (Gdpr) Software Suggestions for Vulnerability Topics released the week of Dec. 9 th , 2019 include:  Scanning  Configure SCCM Inventory Import Creating the SCCM Agent Package Settings - Live Update (Assessment and Resource management) Assessment - Priorities Vulnerability Priority Dashboard Smart Group Overview Topics released the week of Dec. 16 th , 2019 include: Assessment-Priorities Smart Group Creation Threat intelligence Patching Vendor Patch Module Patch Prioritization with Smart Groups Patch Prioritization and Notification Videos to be be released later in December include topics on scanning, assessment & priorities, patching and reporting.  Be sure to bookmark this page so you can keep coming back for all this great content and more.  Happy Learning!

In this article I go into the ways you can count our patches and just what we provide so you can appreciate what you truly get in terms of coverage when considering the SVM Vendor Patch Module.  

The Vendor Patch Module for Software Vulnerability Manager enhances the value of its vulnerability and threat intelligence insights by providing over 1000 out-of-the-box patches and providing details to help users more easily create over 1000 additional patches.