Vulnerability management systems, solutions and tools for cyber security
The vulnerability management system (Condor) provides the ability to understand the hardware and software vulnerabilities within your organisation’s NETWORK.
The Condor system delivers an in depth vulnerability assessment of the hardware and software running on your devices. We map devices against systems, and systems against your organisation’s risk assessment matrix to produce a network vulnerability baseline (NVB). This provides a comprehensive view of your assets, from a vulnerability, impact and associated risk perspective. The system then processes daily intelligence feeds from several industry leading sources against your NVB and alerts users of potential threats, the associated risks and recommended remediation activities.
Inventory to Alert Matching
The Condor system uses augmented client inventory data and matches this to the Alerts ingested from third party intelligence feeds to detect the location of vulnerabilities within client systems.
Vulnerability Investigation
Sapien’s analysts investigate vulnerabilities present in client systems, to determine how they work and if an exploit exists or has been exploited in the wild.
Risk Analysis
Condor Risk Analysis is an automated process, which takes into account a number of factors, including:
- Whether the vulnerability is exploitable – by matching the connectivity available to the client systems with how the vulnerability works
- Level of risk - whether impacted devices are in the critical systems identified in the risk model and if they are, what are the consequences of a successful exploit
- The severity of the vulnerability – Based on its CVSS score and CVSS Vector
NVD Matching
The Condor system matches CVE’s in the NVD database with augmented client inventory data to determine all vulnerabilities for every component in the client inventory.
Patch & Remediation Identification
Sapien Analysts maintain a current database of patches and remediations for all vulnerable components – these are security related patches only, not functionality related patches as operators will not patch for functionality as part of a vulnerability management program. Remediations are for devices which can’t be patched for operational reasons
Worst Case Vulnerability Determination
In some cases, components (such as earlier Microsoft operating systems) may have dozens if not hundreds of vulnerabilities. Sapien Analysts track and report the worst vulnerability for each component in client’s inventory so that operators can see at a glance how important it is to patch a particular component, regardless of how many vulnerabilities are present for that component.
Break Plan alerts are generated for Sapien Condor clients based on the Risk Analysis and Vulnerability Investigation results. These Alerts include identification of all systems within the client facilities which are affected, an analysis of the nature of a potential exploit and a detailed list of affected devices, their physical locations and the risk of exploitation on a device-by-device basis. Clients can set thresholds on the seriousness of events for which they want a Break Plan alert to be generated. This enables clients to plan rapid and effective responses to critical vulnerabilities
Attack Surface reports are a detailed picture of where all the vulnerabilities exist within a production facility. These reports detail:
- All vulnerable devices on a per-system basis
- what components on each Device are vulnerable.
- The worst case vulnerability (CVSS) score and the CVE for each component
- The recommended patch or mitigation for each component
3RD PARTY VULNERABILITY FEEDS
CLIENT CMDB & RISK DATA
NVD DATABASE
Inventory to Alert Matching
The Condor system uses augmented client inventory data and matches this to the Alerts ingested from third party intelligence feeds to detect the location of vulnerabilities within client systems.
Vulnerability Investigation
Sapien’s analysts investigate vulnerabilities present in client systems, to determine how they work and if an exploit exists or has been exploited in the wild.
Risk Analysis
Condor Risk Analysis is an automated process, which takes into account a number of factors, including:
- Whether the vulnerability is exploitable – by matching the connectivity available to the client systems with how the vulnerability works
- Level of risk - whether impacted devices are in the critical systems identified in the risk model and if they are, what are the consequences of a successful exploit
- The severity of the vulnerability – Based on its CVSS score and CVSS Vector
NVD Matching
The Condor system matches CVE’s in the NVD database with augmented client inventory data to determine all vulnerabilities for every component in the client inventory.
Patch & Remediation Identification
Sapien Analysts maintain a current database of patches and remediations for all vulnerable components – these are security related patches only, not functionality related patches as operators will not patch for functionality as part of a vulnerability management program. Remediations are for devices which can’t be patched for operational reasons
Worst Case Vulnerability Determination
In some cases, components (such as earlier Microsoft operating systems) may have dozens if not hundreds of vulnerabilities. Sapien Analysts track and report the worst vulnerability for each component in client’s inventory so that operators can see at a glance how important it is to patch a particular component, regardless of how many vulnerabilities are present for that component.
Break Plan alerts are generated for Sapien Condor clients based on the Risk Analysis and Vulnerability Investigation results. These Alerts include identification of all systems within the client facilities which are affected, an analysis of the nature of a potential exploit and a detailed list of affected devices, their physical locations and the risk of exploitation on a device-by-device basis. Clients can set thresholds on the seriousness of events for which they want a Break Plan alert to be generated. This enables clients to plan rapid and effective responses to critical vulnerabilities
Attack Surface reports are a detailed picture of where all the vulnerabilities exist within a production facility. These reports detail:
- All vulnerable devices on a per-system basis
- what components on each Device are vulnerable.
- The worst case vulnerability (CVSS) score and the CVE for each component
- The recommended patch or mitigation for each component
