Risk-Based Vulnerability Management

We recommend conducting scans once a week. This is the best security practice.

We conduct analysis of IT assets, cloud resources, containers, web applications, misconfigurations, network anomalies, and shadow IT. We check configurations of operating systems, software, network equipment, hypervisors, databases, etc., following CIS, DISA STIG, MSCT, and other best practices.

We prioritize vulnerabilities using machine learning algorithms based on CVSSv3 (Common Vulnerability Scoring System), as well as over 150 data sources, including vulnerability usage precedents, hacker activity (including tracking hacker resources), exploit complexity, vulnerability age, etc., with daily updates. Combined with an algorithm to calculate the criticality of an information asset for a specific organization based on "business goals," device type, interdependencies, impact, and placement in the infrastructure, our clients can proactively respond to threats, focus on critical vulnerabilities, and maximize resource utilization for their remediation.

The Risk-Based Vulnerability Management service is built on the most effective vulnerability detection and prioritization technologies and is cloud-managed. The Netwave team employs active scanners, agents, passive network monitoring, cloud connectors, and CMDB integrations. All of this helps maximize scanning coverage in the infrastructure and virtually eliminate blind spots. This combination of sensor types helps track and assess not only known but also unknown assets and their vulnerabilities, including assets that are difficult to scan, such as remote worker devices, which are analyzed by agents.

The service deployment and delivery process consists of six stages:

1. Solution demonstration and goal definition: We introduce clients to the service's capabilities, demonstrate how the solution meets the company's requirements for identifying and managing IT risks, provide Proof of Value (POV), deploy the service on a test group of information assets, and generate a report based on the results.
2. Planning: Our team forms an implementation project considering the client's IT assets, network topology, and business logic of interaction. During this stage, we determine the service's content and scanning frequency.
3. Service deployment: Netwave specialists install the necessary components in the client's IT infrastructure and configure them, including connecting to cloud resources, scanning policies, report templates, and the client's dashboard information panels.
4. Risk-based vulnerability management: At this stage, our team accomplishes the following tasks:
   • Asset inventory: Prioritizing assets according to their role and criticality for the company, as well as their location in the topology.
   • Scanning for vulnerabilities and misconfigurations in line with best practices. This phase involves direct vulnerability searching, analysis, and prioritization of vulnerabilities in information assets.
   • Creating reports and periodically comparing the current and previous infrastructure states regarding vulnerabilities.
5. Report delivery and vulnerability remediation: Our team produces comprehensive reports on all identified vulnerabilities, along with instructions for their remediation, prioritized based on real risks to the company. We provide the client with a detailed list of actions to help reduce risks. Additionally, we deliver results of checks on operating system configurations, network equipment, servers, hypervisors, etc., following CIS, DISA STIG, MSCT, and other best practices. The client can address identified vulnerabilities independently or delegate this task to our team as an additional service.
6. Change verification: We conduct "Remediation Scans" to confirm the resolution of vulnerabilities that were addressed.