Why Hybrid Work Demands a Rethink of Vulnerability and Patch Management
ManageEngine's Joyal Bennison argues that separate scanning and patching tools slow fixes for remote endpoints, and makes the case for one integrated process.
Offices have reopened, but many businesses have settled on hybrid work anyway. Joyal Bennison, product consultant at ManageEngine, argues that while a distributed workforce has clear advantages, having a large share of endpoints outside the corporate perimeter calls for faster and more effective ways of securing them.
Keeping watch for vulnerabilities on endpoints, and patching them as soon as flaws surface, matters more now than before, he says, especially given how quickly new flaws are appearing: 8,993 security vulnerabilities (CVEs) were logged in the first half of 2021 alone. Exploitation is expensive. Bennison cites the Malaysia Cyber Security Strategy (2020-2024), which estimates that cybersecurity incidents could cost Malaysia up to RM51 billion in economic losses, more than 4% of national GDP.
How the traditional process works
Vulnerability and patch management has usually relied on separate tools run by separate teams. Bennison describes the sequence. The security team runs vulnerability scanners over endpoints and raises a ticket for the IT or remediation team, listing the flaws and what needs doing. IT administrators then use patching tools to scan the network for missing patches and match the results against the security team's data to work out which patches will close which vulnerabilities. Next, IT downloads the patches from vendor websites, tests them for stability and rolls them out to production. It scans again to confirm the flaw is fully fixed and reports the status back to security, which then has to validate the result itself before the vulnerability management loop is closed.
In Bennison's view this fragmented method has several weaknesses that make it unsuitable for distributed IT, where vulnerabilities need immediate and effective action.
Where the fragmented approach fails
Slow remediation. Running several tools for patching and vulnerability management produces siloed, inefficient work. It adds complexity, duplicates scans, lengthens the time between finding a flaw and patching it, and slows risk reduction dramatically. Unsurprisingly, he says, organisations typically take more than two months to close a vulnerability once it is found. Edgescan's 2020 Vulnerability Stats Report puts the time to patch an Internet-facing system at 71 days. Since the window between disclosure and active exploitation has narrowed, organisations have to move fast, particularly with remote endpoints sitting directly on the Internet.
Inaccuracy. Point products do not work well together, so the data held by integrated tools is more likely to diverge. The practical result is that some required patches may never be fully deployed, and critical flaws may stay open.
Mounting management work. Installing and running several tools on remote endpoints is awkward and slow, because those devices keep joining and leaving the network. Managing multiple clients on remote machines can also eat into the organisation's VPN bandwidth, and several agents on one device consume system resources and hurt performance.
Trouble scaling. Modern IT changes constantly, with new remote assets added often. If just one of the agents is missing from a new remote asset, the workflow gets more complicated and security gaps are left behind.
Higher security spending. Bennison puts it bluntly: buying and maintaining separate tools for patching and for vulnerability management costs twice as much. On top of that, new staff need dedicated training on each product.
The case for one integrated process
Bennison believes organisations should now treat vulnerability and patch management as a single process. Integrated tools, he argues, remove these problems by giving every team involved the same view and better tracking of each vulnerability from detection to closure across the distributed estate. With one interface and one agent to look after, scaling and day-to-day management become much easier. An integrated product also simplifies the whole vulnerability management life cycle by matching vulnerability and patch data automatically and allowing remediation to happen directly.