ISO 27001: 2022 A.8.8 Management of technical vulnerabilities

This article provides additional information on how you can meet the requirement for the ISO 27001: 2022 control A.8.8 Management of technical vulnerabilities.

ISO 27001: 2022 Control Description

Information about technical vulnerabilities of information systems in  use shall be obtained, the organization’s exposure to such vulnerabilities  shall be evaluated and appropriate measures shall be taken.

Purpose

To prevent the exploitation of technical vulnerabilities in information systems.

Guidance on implementation

Effective management of technical vulnerabilities is crucial to protecting information systems. Here’s a step-by-step guide to help your organisation handle technical vulnerabilities:

Identifying Technical Vulnerabilities

1. Maintain an Accurate Asset Inventory:
   • Keep a detailed inventory of all assets, including software vendor details, software names, version numbers, deployment status (e.g., what software is installed on which systems), and responsible personnel.
2. Assign Roles and Responsibilities:
   • Clearly define roles and responsibilities related to technical vulnerability management, including monitoring vulnerabilities, assessing risks, updating software, tracking assets, and coordinating responses.
3. Monitor Vulnerability Sources:
   • Identify and regularly update information sources for tracking relevant technical vulnerabilities. Adjust these sources as your inventory changes or as new, useful resources become available.
4. Ensure Supplier Accountability:
   • Require suppliers to include vulnerability reporting, handling, and disclosure in their contracts.
5. Use Vulnerability Scanning Tools:
   • Deploy tools that are appropriate for the technologies you use to identify vulnerabilities and verify successful patching.
6. Conduct Penetration Tests:
   • Perform planned, documented, and repeatable penetration tests or vulnerability assessments by authorised personnel to identify vulnerabilities. Be cautious, as these tests can compromise system security.
7. Track Third-Party Libraries:
   • Monitor third-party libraries and source code for vulnerabilities, including this in your secure coding practices.

Develop Procedures for Vulnerability Management

1. Detect Vulnerabilities:
   • Establish procedures to detect vulnerabilities in your products and services, including external components.
2. Receive Vulnerability Reports:
   • Set up a public point of contact for vulnerability reporting, so that researchers and others can report issues.
3. Implement Reporting Procedures:
   • Create online reporting forms and participate in relevant threat intelligence or information-sharing forums. Consider offering bug bounty programs to encourage vulnerability reporting.
4. Share Information:
   • Share vulnerability information with relevant industry bodies and interested parties.

Evaluating Technical Vulnerabilities

1. Analyse Reports:
   • Thoroughly analyse and verify vulnerability reports to determine the necessary response and remediation actions.
2. Assess Risks:
   • Once a vulnerability is identified, assess the associated risks and decide on the appropriate actions, such as system updates or additional controls.

Addressing Technical Vulnerabilities

1. Implement a Software Update Process:
   • Ensure all authorised software is up-to-date with the latest approved patches. Retain the original software version and test any changes on a copy before applying them. Document all changes thoroughly.
2. Respond Quickly:
   • Act promptly when a potential vulnerability is identified, setting a clear timeline for addressing it.
3. Use Legitimate Sources:
   • Only use updates from verified, legitimate sources.
4. Test Updates:
   • Test updates before installation to ensure they are effective and do not introduce unacceptable side effects.
5. Prioritise High-Risk Systems:
   • Focus on addressing vulnerabilities in high-risk systems first.
6. Develop Remediation:
   • Create and test remediation measures, such as software updates or patches, to confirm their effectiveness.
7. Verify Authenticity:
   • Implement mechanisms to verify the authenticity of remediation actions.
8. Consider Alternative Controls:
   • If updates are unavailable or cannot be installed, consider other controls, such as:
   • Applying vendor-recommended workarounds.
   • Disabling vulnerable services.
   • Adding access controls (e.g., firewalls) at network borders.
   • Using traffic filters to protect vulnerable systems.
   • Increasing monitoring to detect potential attacks.
   • Raising awareness of the vulnerability.
9. Automatic Updates:
   • Decide whether to use automatic updates for acquired software, particularly if the vendor provides this option. Consider allowing users to control the timing of updates to avoid disruption during critical operations.

Other Considerations

1. Maintain an Audit Log:
   • Keep detailed logs of all steps taken in managing technical vulnerabilities.
2. Regular Monitoring:
   • Continuously monitor and evaluate the vulnerability management process to ensure it remains effective and efficient.
3. Align with Incident Management:
   • Coordinate vulnerability management with incident management activities, sharing relevant data and procedures.
4. Cloud Service Providers:
   • Ensure your cloud service providers manage technical vulnerabilities as part of the service agreement, with clear processes for reporting their actions.
5. Consider Defence in Depth:
   • Be aware that vulnerability scanners might not fully account for defence-in-depth strategies. Carefully review vulnerability reports before taking action.
6. User Communication:
   • If your organisation supplies software or services externally, consider releasing public advisories about vulnerabilities and providing information to software vulnerability databases.

This guide should help you manage technical vulnerabilities effectively, reducing the risk of exploitation and maintaining the security of your organisation’s information systems.