Vulnerability Response remediation overview
Summarize
Summary of Vulnerability Response remediation overview
Vulnerability Response remediation is a structured, phased process designed to help ServiceNow customers manage and automate the identification and resolution of security vulnerabilities across their company assets. This process enhances your security posture by enabling the prioritization and timely remediation of the most critical vulnerabilities.
Show less
Successful remediation requires the installation and configuration of Vulnerability Response along with a supported third-party integration, such as the Qualys Vulnerability Integration.
Key Features
- Verification of Third-Party Integration Imports: The process begins by confirming the successful import of vulnerability data from third-party sources and preset databases like the National Vulnerability Database (NVD) and Common Enumeration Weakness (CWE). Reliable imports are essential to creating vulnerable items and remediation tasks.
- CI Lookup Rules and Asset Matching: Imported vulnerabilities are matched to Configuration Management Database (CMDB) assets using CI Lookup Rules, with all assets stored in the Discovered Items module. Accurate asset mapping is critical for effective remediation.
- Review and Triage of Vulnerabilities and Vulnerable Items: Vulnerable items, which link vulnerabilities to configuration items, are assessed using rules that assign ownership, risk levels, and remediation targets. These rules can be adjusted to ensure proper triage and prioritization.
- Monitoring Remediation Progress: Ongoing tracking includes monitoring import statuses, patch implementations, deferred items, and regulatory compliance obligations. Dashboards and reports provide real-time insights into remediation trends and target attainment.
- Performance Analytics Integration: For enhanced visibility, you can leverage the Performance Analytics for Vulnerability Response application to monitor remediation metrics and trends over time.
Practical Considerations
- Prompt attention is required if imports fail, which can occur due to third-party API throttling or other issues.
- Integration status run reports are available to provide graphical overviews of import success, aiding in quick diagnostics.
- Continual review and adjustment of triage rules ensure vulnerable items are accurately prioritized and addressed.
- Tracking deferred items and closing stale detections helps maintain an up-to-date and effective vulnerability management program.
Key Outcomes
- Manageable and automated remediation processes that improve efficiency and reduce risk exposure.
- Clear visibility into vulnerability status and remediation progress across your IT assets.
- Improved alignment with regulatory compliance through tracking and reporting capabilities.
- Enhanced ability to prioritize critical vulnerabilities, ensuring resources focus on the most impactful security issues.
Vulnerability Response remediation is a phased process consisting of verifying import completion, triaging new vulnerabilities, and monitoring progress to completion. Approached in this way, remediation becomes manageable, timely, and in many ways, automated.
Understanding your security posture across company assets helps you identify the most critical vulnerabilities for remediation. This remediation process requires that Vulnerability Response and a third-party integration such as the Qualys Vulnerability Integration are installed and configured.
Verify the successful completion of third-party integration imports
The first phase in this process is to ensure that everything is working correctly. Vulnerability Response is preset to download National Vulnerability Database (NVD) and Common Enumeration Weakness (CWE) vulnerabilities. Third-party imports provide you with the data you need to create vulnerable items and remediation tasks. Successful remediation depends on the consistent and successful import of vulnerabilities and vulnerable items.
During import CI Lookup Rules match third-party assets to assets in the Configuration Management Database (CMDB). All assets are stored in the Discovered Items module. CI information is critical to solution implementation.
Integration status run reports for the supported third-party integrations are shipped with the applications to give you a graphical overview of your imports. Use this report, or create your own, to easily determine whether your latest import has succeeded. For more information about supported integrations, see Vulnerability Response integrations.
Review and triage vulnerabilities and vulnerable items
The next phase of remediation calls for the review of new vulnerabilities and vulnerable items. A vulnerable item (VI) is a detected combination of vulnerability and configuration item (CI). As vulnerable items are formed, various rules are run that assign VIs, determine the risk they pose and set remediation targets. Adjust any rules, as necessary, to ensure that the vulnerable items have been triaged successfully.
Monitor the progress of existing vulnerability remediation
- Review the status of imports for patch implementations that have not shown up and follow up with IT Operations.
- Track the progress of regulatory compliance obligations and ensure their completion.
- Review deferred item status and revise or implement fixes.
- Monitor Vulnerability Management dashboards. To review trends, view reports in real-time, and use metrics that track your remediation target attainment rates, you may prefer to monitor your processes with the Performance Analytics for Vulnerability Response application.
- Closing stale detections in Vulnerability Response.