I just read the 14-page report, "Comparing vulnerability and security configuration assessment coverage of leading VM vendors" by Principled Technologies. Tenable marketing team actively shared it last week.

The main idea of the report: Tenable covers more CVEs and CIS benchmarks than Qualys and Rapid7.

So, my impressions:

1. Hallelujah! Finally, a comparison of Vulnerability Management products based on something measurable - on their Knowledge Bases. And at least one VM vendor is not afraid to use it in marketing and mentions the competitors directly. This is a huge step forward and I hope that this is the beginning of something more serious. We really need to start talking more about the core functionality of VM products.

2. However, this particular report is just a Tenable advertisement. This is not even hidden. I really like Nessus and Tenable, and believe that they have a very good Knowledge Base, but reading on every page how great Tenable's products are is just ridiculous. It would be much better to read it in more neutral form.

3. Using only the CVE IDs for comparing Vulnerability Knowledge Bases is NOT correct (strictly speaking), because for many software products most of vulnerabilities do not have CVEs, only the patch IDs. CVE-based comparison also doesn't distinguish types of vulnerability checks: remote banner-based, remote exploit-based and local. To make a reliable comparison, it's necessary to map all existing vulnerability detection plugins of VM products, but this is MUCH more difficult.

4. CVE-based comparison in this report is not really informative. They only compare absolute numbers of IDs grouping them by year, software product (cpe) and cvss v2 score. Why is this wrong? If VM vendor A covers 1000 CVEs and vendor B covers 1000 CVEs, this does not mean that they have the same database and it is quite complete. The real intersection between the KBs may be only 500 IDs, so these vendors would be able to detect only a half of each other's vulnerabilities. It matters, right? In my old express comparison of Nessus and OpenVAS Knowledge Bases I demonstrated this and tried to suggest reasons why some vulnerabilities are covered by some vendor and others are not. If you compare CVEs as sets of objects, it turns out that each VM product has own advantages and disadvantages.

5. CIS-based comparison in this report uses only information about certificated implementations from the CIS website without regard to versions and levels. CIS Certification is an expensive and complicated procedure, that is NOT mandatory and does not affect anything. I once implemented many CIS standards for Linux/Unix in PT Maxpatrol. Well, yes, they are not certified and you won't see them on the CIS website, but does this mean that they are not supported in the VM/CM product? Of course not! So, it's a very strange way of comparing Compliance Management capabilities.

In conclusion, the idea behind this report is good, but the implementation is rather disappointing. If one of the VM vendors, researchers or customers wants to make similar comparison, public or private, but in a much more reliable and fair way - contact me, I will be glad to take part in this. 😉

#PrincipledTechnologies #Tenable #Rapid7 #Qualys #CVE #CIS #VulnerabilityManagement #ComplianceManagement #CPE #CVSS #PositiveTechnologies #MaxPatrol #OpenVAS #Nessus

I decided to make a review of several Vulnerability Management market news that I recently read.

#Tenable made a press release about the upcoming Lumen features ("Remediation Maturity", "Mitigations", "Predictive Scoring"). This all sounds pretty cool. The only thing is, as usual, what kind of data they analyze, how good the data is, and how good the methods of analysis are. Most likely, it will remain a black box. Unfortunately.

Tenable also made a press release that they became partners with Central for Internet Security. Maybe Tenable will become the only VM vendor associated with #CIS Controls IG1 “Cyber Hygiene”, but who knows. I really don't understand what is the Center for Internet Security nowadays. These guys for a long time were combining best practices for software & operating system into security standards, and controlling the implementation of those standards among Compliance Management vendors. At the same time, they were a Compliance Management vendor themselves (CIS CAT). A bit weird, but ok. But after they became a kind of regulator, with acquisition of SANS 20 and MITRE OVAL repository, the role of Central for Internet Security is completely unclear to me.

#Rapid7 released a blog post "Why Every Organization Needs a Vulnerability Management Policy". In short, it can be useful as a guide describing how to sell the idea of Vulnerability Management process to your c-level management. In this article, I saw three groups of reasons:
1. Real security. "technical infrastructures stay more secure, which helps them [organizations] reduce risk in an environment filled with cybercriminals".
2. Compliance. "...any corporation with little focus on vulnerability management runs the risk of fines due to falling out of compliance"; "many regulators first look for the existence of a policy as part of any auditing process"; "a clearly defined vulnerability management policy holds the different technology teams at a company responsible for internal compliance"
3. Corporate culture and IT/Dev benefits. "One result of this proactive approach [to VM] is higher system uptime"; "Regular, proactive feature improvements in software applications play a key role in the success of those companies that thrive on an innovative culture. Seamlessly integrating software patches and enhancements is a must for these businesses, and a strong vulnerability management policy helps this integration happen in a secure fashion"; "providing innovative applications and services to their customer base without burning development cycles dealing with security issues"

#Qualys released a tool that "report the deployment status of Cloud Agent across all vCenter-managed virtual machines". It's great that they did it. The only thing I want to mention is that this is a good illustration of a task (“controlling agent installation”), which is not really a part of Vulnerability Management process, but without this task the Vulnerability Management process simply won't work. So such automation should be done by someone on vendor's or customer's side.