Proactive Vulnerability Management

Industry:
Healthcare / MedTech

Position:
Vulnerability Management Specialist

Responsibilities:

• Establishing a vulnerability management system for software development, deployment, and IT infrastructure
• Creating SBOMs using Cyclonde-DX and integrating them into CI/CD
• Source code analysis using SonarSource—coordination with developers
• Linux infrastructure configuration vulnerability scans using Lynis
• Vulnerability analysis using Dependancy-Track
• Docker container vulnerability scans using Trivy
• Kubernetes configuration vulnerability scans based on the CIS Framework using kube-Bench
• Preparing management reports and planning mitigation strategies
• Documentation of the procedure and results based on the identified risk (risk analysis) and using indicators such as exploitability and likelihood of occurrence (based on CVSS)

Industry:
Banking / Finance

Position:
IT Security Analyst

Areas of Responsibility:

• Design, implementation, and continuous improvement of related processes and metrics for managing vulnerability management
• Operation and further development of the Tenable Security Center vulnerability scanning platform
• Planning and coordination of the Nessus agent rollout
• Planning and conducting vulnerability scans in Windows and Linux environments (Windows Client/Server, Debian, Red Hat)
• Analysis and assessment of identified vulnerabilities based on their criticality and impact on the company
• Coordinating measures for sustainable vulnerability remediation and options for risk mitigation

Industry:
Industrial Group

Position:
Project Manager

Areas of Responsibility:

• Design, implementation, and continuous improvement of related processes and metrics for managing vulnerability management
• Setup, operation, and documentation of the Tenable Security Center Plus vulnerability scanning platform in an isolated (“air-gapped”) network
• Planning and installation of Nessus agents, as well as coordination of the expanded rollout on Windows and Linux
• Creation and implementation of scan policies tailored to specific objectives
• Planning and conducting vulnerability scans (both local and network-based)
• Analysis and assessment of identified vulnerabilities based on their criticality and impact on the company
• Coordination of measures for sustainable vulnerability remediation and risk mitigation options

Industry:
Banking / Finance

Position:
Project Manager

Areas of Responsibility:

• Analysis of the identified deficiencies from the BaFin §44 IT special audit, as well as the development of management action plans and strategies to address risks for the project stream “Vulnerability Management”
• Development of detailed action plans and a roadmap for the sustainable resolution of the deficiencies
• Design, implementation, and continuous improvement of related processes and metrics for managing the vulnerability
• Setup, operation, and further development of the Tenable Security Center vulnerability scanning platform
• Planning and coordination of the Nessus agent rollout
• Planning and execution of vulnerability scans
• Analysis and assessment of identified vulnerabilities based on their criticality and impact on the company
• Coordinating measures for sustainable vulnerability remediation and risk mitigation options

Industry:
Banking / Finance

Position:
Project Manager

Areas of Responsibility:

• Design, implementation, operation, further development, and globalization of a vulnerability scanning platform (Tenable.sc / Nessus) in a KRITIS-relevant environment
• Integration of the vulnerability scanning platform’s results into a centralized vulnerability management consolidation platform (Kenna)
• Monitoring the operational status and troubleshooting the vulnerability scanning platform
• Design, implementation, and continuous improvement of related processes and metrics for managing vulnerability management
• Establishment and continuous refinement of a reporting system to manage vulnerability remediation and metrics for evaluating process quality
• Communication and timely tracking of the remediation status of identified vulnerabilities with responsible stakeholders
• Analysis and risk assessment of the current security situation regarding published vulnerabilities, taking into account attack scenarios, threat activity, and available malicious code
• Coordination of measures for sustainable vulnerability remediation and consultation regarding risk mitigation options in compliance with service level agreements
• Oversight of the provider responsible for identifying vulnerabilities in externally accessible infrastructure
• Coordination between internal teams and the external provider regarding required resources and information

Industry:
Banking / Finance

Position:
Consultant

Areas of Responsibility:

• Design, implementation, and operation of a vulnerability scanning solution based on Tenable Nessus in a KRITIS-relevant environment
• Monitoring the operational status and troubleshooting the vulnerability scanning platform
• Design, implementation, and continuous improvement of related processes in the area of patch and vulnerability management, as well as metrics for process control
• Establishment and continuous refinement of a reporting system to manage vulnerability remediation and metrics for evaluating process quality
• Communicating and promptly tracking the remediation status of identified vulnerabilities with responsible stakeholders
• Analysis and risk assessment of the current security situation regarding published vulnerabilities, taking into account attack scenarios, threat activity, and available malicious code
• Coordinating measures for sustainable vulnerability remediation and providing advice on risk mitigation options while adhering to service level agreements

Industry:
Security Operations

Position:
, Project Associate

Responsibilities:

• Compilation of the software and hardware inventory
• Integration of clients into a centralized monitoring system
• Conducting automated and, when necessary, manual vulnerability scans
• Conducting vulnerability analyses
• Processing the results of vulnerability analyses and identifying vulnerabilities
• Detailed documentation of technical details

The cost of professional vulnerability management depends primarily on two factors: First, the number of IP addresses to be scanned—that is, the systems, end devices, or network components that are to be actively checked for vulnerabilities. Second, the consulting effort, measured in person-days. This arises, for example, from the manual validation of critical vulnerabilities, the creation of risk-based action plans, or custom reporting requirements.

In practice, we find that approximately 53 percent of our client projects fall within a cost range of 399.00 euros to 1,999.00 euros. This applies primarily to standardized vulnerability scans with a clearly defined scope. For more stringent regulatory requirements such as DORA, ISO 27001, or NIS2, or for more complex IT infrastructures, the effort required increases accordingly. This applies in particular to custom scan guidelines, integration into an existing ISMS, or supplementary workshops.

A brief scoping discussion is usually sufficient for a realistic estimate of the effort involved. Afterward, you’ll know exactly what to expect.

Effective vulnerability management consists of several coordinated processes that work together to ensure the continuous detection, assessment, and remediation of vulnerabilities:

1. Asset & Inventory Management
The foundation of any vulnerability management program is a complete and up-to-date inventory:

• IT assets, including network zones, asset class, and environment
• Integration with CMDB or central inventory
• Lifecycle information (e.g., operational, testing, decommissioned)

2. Vulnerability Scanning & Assessment

• Planning and execution of vulnerability scans (e.g., by interval, asset class, scan type)
• Assessment by criticality, e.g., using CVSS or VPR
• Identification of new vulnerabilities (e.g., zero-day vulnerabilities)

3. Reconciliation & Reporting

• Reconciliation of scan results with the asset inventory
• Escalation procedures for missing or misconfigured assets
• Reporting to IT, the CISO, and management

4. Scan Policy Management

• Maintenance and review of deployed scan policies
• Regular adaptation to new threats or internal requirements
• Documentation of exceptions (e.g., production-critical systems)

5. Interface with Patch & Risk Management

• Close integration with patch processes for risk mitigation
• Integration into the overarching risk management framework (e.g., BIA, risk acceptance, risk transfer)

Effective vulnerability management requires clear lines of responsibility.
Typically, the following roles are involved:

• Information Security Officer (ISO):
  The ISO bears overall responsibility for vulnerability management. He defines the objectives, steers the process, and ensures that all measures are documented and correctly implemented. In the event of deviations, he initiates corrective actions.
• Vulnerability Management Engineer:
  The VM Engineer is responsible for technical implementation:
  - Configuring scans (e.g., scan type, frequency)
  - Maintaining the scanner infrastructure
  - Providing support for issues that arise during execution
• Asset Owner:
  The Asset Owner is responsible for the systems being scanned. They evaluate the results and decide on:
  - appropriate countermeasures (e.g., applying patches)
  - alternative measures or risk acceptance (in consultation with the ISO)
• IT System Engineer:
  The IT Engineer technically implements the measures, for example by:
  - applying patches
  - implementing mitigation measures
  The goal is to effectively reduce or completely eliminate risks.

The frequency depends on the criticality of your systems, regulatory requirements, and the size of your IT environment. In practice, the following intervals have become standard:

• Critical systems / Cloud / Internet-facing → weekly or daily
• Production systems → monthly
• Low-impact systems / internal test systems → quarterly

According to ISO 27001, BSI Basic Protection, and DORA, regular vulnerability scans are mandatory.

Our tip: Vulnerability Management Scans as a Service solutions offer a scalable way to implement automated scans at the desired frequency.

Common vulnerability management tools include:

• Tenable Nessus / Tenable.io / Tenable.sc
• Qualys VMDR
• Rapid7 Nexpose / InsightVM
• OpenVAS (Greenbone)

In addition, many companies rely on complementary systems for integration, such as Jira, ServiceNow, Excel exports, CMDB systems, and asset management platforms.

We’re happy to assist you with selection, integration, and configuration, including compliance-compliant scan policies.

With Vulnerability Scanning as a Service (VSaaS), a cloud-based platform handles continuous vulnerability management:

• Automated scans at defined intervals
• Prioritization based on risk and business impact
• Dashboard overview for the CISO, IT, and management
• Optional: Recommendations for action & mitigation support

VSaaS reduces manual effort, ensures transparency, and facilitates compliance with regulatory requirements.

Choosing the right type of scan is crucial to the quality of your vulnerability analysis. Different methods are used depending on your system environment, security requirements, and scan objectives. We’re happy to assist you in selecting, configuring, and evaluating the appropriate scanning methods.

1. Network-based scans
Network-based vulnerability scans analyze a system “from the outside” without logging in. Depending on the configuration, either a typical selection of ports or the entire port range (1–65535) is scanned. The focus is on publicly accessible ports, services, and network-based vulnerabilities.

This scanning method is particularly suitable for:

• identifying exposed systems
• testing firewalls and access controls
• use in DMZs, externally accessible systems, or cloud environments

Important to know:
Since the scanner does not have access to the operating system, local vulnerabilities (e.g., outdated libraries, insecure configurations, unpatched software) remain undetected. For more in-depth analysis, we recommend supplementing with authenticated or agent-based scans.

2. Authenticated Scans
Authenticated vulnerability scans access the target system directly. For example, via SSH (Linux/Unix) or SMB (Windows). This enables a more comprehensive security assessment, as it detects not only external services but also local vulnerabilities, outdated software packages, and misconfigurations.

These scans are particularly suitable for:

• production servers and security-critical systems
• checking for internal vulnerabilities at the operating system and application levels
• environments with high regulatory requirements (e.g., ISO 27001, NIS2, DORA)

Note:
Authenticated scans require privileged user accounts on all target systems, typically with root or administrator privileges. For Windows systems, a central scan user can be used for domain environments. The credentials must be kept particularly secure, as they grant extensive permissions.

3. Agent-Based Scans
Agent-based vulnerability scans rely on local software agents that are installed directly on the target systems. This method is particularly suitable for assets that are not permanently accessible, such as laptops, mobile devices, or work-from-home systems. The scans run minimally invasively in the background and automatically transmit the results as soon as a network connection is established. This enables reliable vulnerability analysis even outside of traditional network structures.

Typical use cases:

• Remote workstations, field service devices, mobile clients
• Systems with limited availability or isolated network connections
• Complement to network-based and authenticated scans for comprehensive coverage

Important to note:
Deploying and maintaining the agents requires technical effort. Additionally, agent-based scans do not detect network-based vulnerabilities (e.g., openly accessible ports). Therefore, they should always be part of a combined strategy.

Vulnerabilities can be broadly classified into the following categories:

• Technical vulnerabilities (e.g., outdated software, misconfigurations, unprotected services)
• Process-related vulnerabilities (e.g., missing updates, unclear responsibilities)
• Human vulnerabilities (e.g., phishing, social engineering)

Tenable Vulnerability Management is a platform solution for automated vulnerability detection and assessment. It is based on the well-known Nessus tool and is used by companies worldwide.
Tenable detects vulnerabilities, assesses risks (e.g., via CVSS), and provides recommendations for action.
We’d also be happy to assist you with the integration and configuration of Tenable instances.

A vulnerability scan is an automated analysis designed to identify potential vulnerabilities in systems, applications, and networks. The goal is to quickly and comprehensively detect known security vulnerabilities.

A penetration test (pentest), on the other hand, simulates a targeted attack. It is usually performed manually to test real-world exploitation scenarios.

In short:

• Vulnerability scan = broad, automated, regular
• Penetration test = targeted, manual, in-depth

Both measures complement each other. Typically, a pentest builds on a prior vulnerability scan.