Did You Remediate That? Take Control of Risk by Knowing Your Top 25 Vulnerabilities

Last updated at Wed, 09 Jan 2019 14:00:00 GMT

This is the third in our four-part series on the vulnerability management reporting capabilities of InsightVM.

When conducting vulnerability management, security practitioners obviously want to start by addressing their most dangerous vulnerabilities. By applying the Pareto Principle to vulnerability management, we can estimate that 20% of all vulnerabilities or misconfigurations cause 80% of the IT security issues that result in the most trouble. That gives those 20% of issues a much more important place in your remediation plan than any of the others.

Identifying these issues and their effect on your ecosystem is the first step in taking control of your overall vulnerability management program. But where should you begin when it comes to identifying those vulnerabilities?

The InsightVM Top 25 report

Rapid7’s InsightVM offers a Top 25 report that shows your organization’s top vulns broken down by site, domain, and asset group. It also highlights how many assets and machines these vulnerabilities affect within your organization. On top of that, you can see the quickest and simplest remediation actions you can take, such as updating to the latest versions of software. The report also helps you identify and fix low-hanging fruit as far as vulns go, so you can focus your efforts where you will have the largest impact.

The report bubbles up these largest sources of risk and includes information in the following areas:

• The vulns and total risk score associated
• Number of targeted vulns that have known exploits associated with them
• Targeted vulns with available malware kits
• Number of assets addressed by remediation
• Amount of risk reduced by remediations

The Top 25 report does more than just show you where the largest impact can be made. It also provides your team with a way to show the efficacy of their work on an ongoing basis to your organization at large.

Remediation is in the details

While the Top 25 report gives quick and easy fixes through a brief overview, you can dive even deeper with the Top Remediations with Details report. This template provides expanded information from the Top 25 report, including the percentage of total vulns resolved and the number of assets that will be affected when remediation solutions are applied. The details in this report can help you dig further into what to expect from these remediations throughout your organization.

In addition to the Top 25 report, the Top Remediations with Details report includes information on the following:

• Remediation steps that need to be performed
• Vulnerabilities and total risk score associated with the solution
• Assets that require remediation steps

Focus on what’s important to you

These reports are only just the beginning. You can leverage Remediation Projects, Live Dashboards, and more in conjunction with the Real Risk Score in InsightVM to get a holistic picture of your risk and, most importantly, how it changes over time.

InsightVM offers a wide variety of functionality to help you and your team determine where to focus your efforts to secure your organization’s assets. The Top 25 report is a great place to get started, providing details that give your vulnerability management program a jumping-off point.