Would you be surprised to learn that network device operating systems can be vulnerable to security flaws like any other software? To remediate this risk, network and security administrators need a vulnerability management program in place. Having the right processes and technology in place can save time while protecting the network security posture.<\/p>\n\n\n\n
A common approach is to split vulnerability management into two phases:<\/p>\n\n\n\n
- \n
- Build a list of affected devices and related vulnerabilities<\/li>\n\n\n\n
- Prioritize and address these vulnerabilities<\/li>\n<\/ol>\n\n\n\n
Build a list of affected devices and related vulnerabilities <\/h2>\n\n\n\n
Publicly disclosed security vulnerabilities have an assigned CVE <\/strong>(Common Vulnerabilities and Exposures) ID number and a severity level based on their impact. CVEs help you to coordinate the efforts to prioritize and address these vulnerabilities to make systems and networks more secure. Most enterprise networks have evolved over time and include devices from several vendors running multiple versions of operating systems. Knowing that a vulnerability was announced doesn\u2019t give a clear picture of the organization's correlative risk. <\/p>\n\n\n\n
Large enterprises do their best to keep an accurate inventory of devices and their state, but given that most companies have experienced mergers, IT department turnover, and are resource constrained, this inventory is rarely current. Because networking vendors typically fix security vulnerabilities by issuing a new OS version, a detailed and up-to-date inventory is paramount. Trying to conduct this analysis manually is expensive, time-consuming, and error prone.<\/p>\n\n\n\n
To make the analysis easier, faster, and more reliable, Forward provides a network devices vulnerability analysis that automatically compares the CVE information from the NIST National Vulnerability Database (NVD)<\/a> with OS version running on the devices in your network.<\/p>\n\n\n\n
This analysis provides a list of all possibly affected devices<\/strong> and related vulnerabilities. \u201cWhy possibly <\/strong>affected?\u201d you might ask. Keep on reading and you will find out why.<\/p>\n\n\n\n
The following screenshot shows an example of network vulnerability analysis in the Forward UI.<\/p>\n\n\n
\n![\"\"](\"https:\/\/www.forwardnetworks.com\/wp-content\/uploads\/2023\/10\/Enhanced-Vulnerability-Analysis-blog1.png\")
Fig 1: Forward device vulnerability analysis
<\/figcaption><\/figure><\/div>\n\n\nThe summary at the top shows the number of CVEs detected<\/strong> as well as the number of devices impacted<\/strong>.<\/p>\n\n\n\n
The table shows a summary view of the CVEs including CVE ID<\/strong>, Severity<\/strong>, Description<\/strong>, Impacted OS<\/strong>, Impacted versions<\/strong>, and the number of Possibly impacted devices<\/strong>.<\/p>\n\n\n\n
The Details <\/strong>page shows you information about devices that are impacted by that CVE like Device<\/strong>, Model<\/strong>, OS version<\/strong>, and Management IPs<\/strong>.<\/p>\n\n\n
\n![\"\"](\"https:\/\/www.forwardnetworks.com\/wp-content\/uploads\/2023\/10\/Enhanced-Vulnerability-Analysis-blog2.png\")
Fig 2: CVE details page
<\/figcaption><\/figure><\/div>\n\n\nPrioritize and address vulnerabilities<\/h2>\n\n\n\n
One of the fundamental issues is that the number of vulnerabilities and devices affected can be overwhelming, making it difficult to prioritize which devices should be updated first. Filtering vulnerabilities by severity provides some help but typically the number of Critical <\/em><\/strong>and High <\/em><\/strong>severity vulnerabilities is still so high that it\u2018s challenging to determine a starting point. This is where the notion of \u201cpossibly affected<\/em><\/strong> devices\u201d becomes pertinent<\/strong>. Some vulnerabilities can impact a device only if specific configurations are present, a specific feature is turned on, or they are deployed in a way that is explained in the CVE. This information is not in the NIST database, network engineers have to research vendor sites such as the Cisco Security Advisory<\/a> repository to get this level of detail. <\/p>\n\n\n\n
There\u2019s a better way<\/p>\n\n\n\n
Monitoring the latest descriptions and automatically checking them against the device configurations in your network is best performed by software \u2014 it frees up highly skilled engineers to spend time on proactive strategic initiatives and is far more accurate. For many NOC teams, this capability would be A dream come true<\/em><\/strong>, or Like Christmas came early<\/em><\/strong>, right?<\/p>\n\n\n\n
Well, that is exactly what Forward Enhanced Vulnerability Analysis<\/strong> provides!!<\/p>\n\n\n\n
No more manual, tedious, and error-prone hunting for those configs on every single \u201cpossibly affected\u201d device, one by one, that would take forever.<\/p>\n\n\n\n
Just an always accurate, always updated list of devices that are actually vulnerable! Remediation efforts can be prioritized based on risk severity to ensure effort is directed to keeping the network as safe as possible.The screenshot below shows the Detected based on<\/strong> field. This field indicates that there is an at-risk device in the network that matches the OS version only (OS version match<\/strong>) or is running the impacted OS version and matches the vulnerable configuration (Config match<\/strong>).<\/p>\n\n\n
\n![\"\"](\"https:\/\/www.forwardnetworks.com\/wp-content\/uploads\/2023\/10\/Enhanced-Vulnerability-Analysis-blog3.png\")
Fig 3: Filtering by detection type
<\/figcaption><\/figure><\/div>\n\n\nAdditional resources<\/h2>\n\n\n\n