Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Process for managing technical vulnerabilities

Critical
High
Normal
Low

The organization has defined a process for addressing identified technical vulnerabilities.

Some vulnerabilities can be fixed directly, but vulnerabilities that have a significant impact should also be documented as security incidents. Once a vulnerability with significant impacts has been identified:

  • risks related to the vulnerability and the necessary actions are identified (e.g. patching the system or other management tasks)
  • necessary actions are scheduled
  • all actions taken are documented
Connected other frameworks and requirements:
12.6.1: Management of technical vulnerabilities
ISO 27001
14.2.1: Secure development policy
ISO 27001
ID.RA-1: Asset vulnerabilities
NIST CSF
PR.IP-12: Vulnerability management plan
NIST CSF
RS.AN-5: Vulnerability management process
NIST CSF

Regular penetration testing

Critical
High
Normal
Low

Static scans on code are the first step in detecting risky vulnerabilities. However, once a service has been deployed, it is vulnerable to new types of attacks (e.g., cross-site scripting or authentication issues). These can be identified by penetration testing.

Connected other frameworks and requirements:
12.6.1: Management of technical vulnerabilities
ISO 27001
14.2.8: System security testing
ISO 27001
18.2.3: Technical compliance review
ISO 27001
DE.CM-8: Vulnerability scans
NIST CSF
5.36: Compliance with policies, rules and standards for information security
ISO 27001

Selecting and tracking data sources for vulnerability information

Critical
High
Normal
Low

Information sources for software and other technologies have been consciously identified to identify and maintain information about technical vulnerabilities that are relevant to us (e.g. authorities or hardware and software manufacturers). Data sources are evaluated and updated as new useful sources are found.

Vulnerabilities can be found directly in the vendor systems we exploit or in the open source components exploited by many of our systems. It’s important to keep track of multiple sources to get the essential information obtained.

Connected other frameworks and requirements:
12.6.1: Management of technical vulnerabilities
ISO 27001
I23: Ohjelmistohaavoittuvuuksien hallinta
DE.CM-8: Vulnerability scans
NIST CSF
8.8: Management of technical vulnerabilities
ISO 27001

Initial treatment of identified technical vulnerabilities

Critical
High
Normal
Low

We have defined the rules for responding to identified vulnerabilities. The rules may include e.g. the following things:

  • who are part of a quick-response team that is ready to respond to vulnerabilities
  • the person locating the vulnerability immediately informs the entire team down the agreed channel
  • the team determines the severity of the vulnerability (low, medium, high) based on predefined criteria
  • the team decides whether to continue processing as a security breach (more urgently) or under general change management
  • the necessary individuals are selected to continue addressing the vulnerability

Vulnerabilities related to high-risk data systems are always of high severity and are addressed first.

Connected other frameworks and requirements:
12.6.1: Management of technical vulnerabilities
ISO 27001
ID.RA-1: Asset vulnerabilities
NIST CSF
PR.IP-12: Vulnerability management plan
NIST CSF
RS.AN-5: Vulnerability management process
NIST CSF
RS.MI-3: New vulnerability mitigation
NIST CSF

Regular vulnerability scanning

Critical
High
Normal
Low

The organization regularly conducts a vulnerability scan, which searches for vulnerabilities found on computers, workstations, mobile devices, networks or applications. It is important to scan even after significant changes.

It should be noted that vulnerable source code can be from operating system software, server applications, user applications, as well as from the firmware application as well as from drivers, BIOS and separate management interfaces (e.g. iLo , iDrac). In addition to software errors, vulnerabilities occur from configuration errors and old practices, such as the use of outdated encryption algorithms.

Connected other frameworks and requirements:
12.6.1: Management of technical vulnerabilities
ISO 27001
18.2.3: Technical compliance review
ISO 27001
14.2.8: System security testing
ISO 27001
ID.RA-1: Asset vulnerabilities
NIST CSF
PR.IP-12: Vulnerability management plan
NIST CSF

Regular monitoring of the vulnerability management process

Critical
High
Normal
Low

The technical vulnerability management process is regularly monitored and evaluated to ensure its effectiveness and efficiency.

Connected other frameworks and requirements:
12.6.1: Management of technical vulnerabilities
ISO 27001
ID.RA-1: Asset vulnerabilities
NIST CSF
PR.IP-12: Vulnerability management plan
NIST CSF
8.8: Management of technical vulnerabilities
ISO 27001

Management process for software updates

Critical
High
Normal
Low

Software updates should have a management process in place to ensure that the latest approved patches and application updates are installed on all approved software. Earlier versions of software should be retained as a precaution.

Connected other frameworks and requirements:
12.6.1: Management of technical vulnerabilities
ISO 27001
8.8: Management of technical vulnerabilities
ISO 27001

Evaluating and testing patches before deployment

Critical
High
Normal
Low

Once a vulnerability is identified, suppliers often have significant pressure to release patches as soon as possible. Therefore, the patch may not adequately address the issue and may have harmful side effects.

In evaluating patches, e.g. the following things should be taken into account:

  • whether the patch can be pre-tested properly?
  • whether it is wise to expect experience from other repairers?
  • whether the patch is available from a trusted source?
  • what are the risks of installing the patch and delaying the installation?
  • whether other actions are needed, such as disabling vulnerability features, increasing monitoring, or reporting about the vulnerability
Connected other frameworks and requirements:
12.6.1: Management of technical vulnerabilities
ISO 27001
8.8: Management of technical vulnerabilities
ISO 27001
No items found.