Vulnerability management

Understanding what systems and software you have on your technical estate is fundamental to effective vulnerability management. It’s just as important to understand who is responsible for each system or service you identify.

Once you have identified this, it’s important to agree the tasks which the security and IT system maintainers carry out. This should include the cadence and nature for reporting on detected vulnerabilities, the time and effort system maintainers should allocate to correcting issues, and agreeing the appropriate priority of an IT incident, such as if a critical vulnerability is exploited in the wild.

The NCSC has separate guidance for organisations about Asset management but your essential aim here is to identify and monitor the systems, services, cloud infrastructure, mobile devices, hardware and software in your estate. Each category may need a different approach and it’s important to minimise gaps by not omitting a category, or conflating categories that have very different requirements and challenges.

Asset discovery, and cataloguing and managing your estate as it changes over time, is a continual process (see Principle 5 for more about regular reviews). Automating these processes means you can focus on the results. It will also help with other cyber security functions, such as incident response.
 

Obsolete and extended-support products

During asset discovery, you may find products that are obsolete or under extended support. It's important to make sure they are categorised as such, and that you take the appropriate action.

Obsolete products refer to products that are no longer in development and which don’t receive any updates. The best remediation here is to migrate to a supported product before it reaches end of life. Where this isn’t possible, you will need to manage the risks associated with obsolete products. The NCSC guidance on obsolete products can help you here.

With an extended-support product, you can pay to have the software supported for an additional period of time after mainstream support has ended. However, they may not receive fixes for all known vulnerabilities and the updates may have to be installed manually. The NCSC therefore recommends that once a product is out of mainstream support you migrate to a supported version.

Configuration management

Ensuring secure and consistent configurations across your systems is essential for security and effective operation, as attackers could use any weaknesses to gain access to your network. The NCSC has device security guidance to help organisations choose and configure devices securely, and one of the most effective security controls are application allow lists.

We recommend that you automate configuration audits, and that they provide coverage across your whole estate. Where possible, any new system should be deployed using infrastructure as code and configuration as code, to reduce the risks of misconfiguration and make remediation at scale easy. An effective configuration management process, alongside asset discovery and update management (see Principle 1), should provide situational awareness of the current versions of software and firmware installed on all your assets.