The Unpatchables

In a perfect world, there would be no vulnerabilities.  In a perfect patching world there would be a patch for every vulnerability and we would always be able to patch all of our systems as soon as a patch was available. In the real world we do the best we can and struggle with testing cycles, incompatibilities, and legacy applications which means sometimes we have to leave insecure and unpatched systems in production.

There are a variety of situations that can cause exposure:

• Some patches break needed applications or cause compatibility problems
• Patches may not yet be available for a vulnerability but the systems must stay online and exposed Legacy applications or operating systems may still be required (for example Internet Explorer 6 may be required to access a legacy web application, probably running on a legacy web server)
• A maintenance window may not be immediately available when patches are released
• Systems in development environments may be vulnerable during development and testing phases

 These vulnerable systems can be hardened and some mitigation may be possible, but they will always require close monitoring to make sure that they are not compromised.

Tenable's Unified Security Monitoring (USM) simplifies the monitoring process thorough instrumentation of sensitive or targeted systems. A dashboard such as the Threat Matrix could be tuned to deliver the insight needed to evaluate and monitor these exposed systems.

It is important to carefully monitor widely accessible systems for unusual activity including unexpected system changes, unapproved scanning, or intrusion events. This also applies to systems that have restricted access with the addition of monitoring for new host relationships and unexpected file access- activities that could indicate not only attacks, but misconfigured network segregation that exposes these systems.

Using a combination of active and passive scanning with Nessus and the Passive Vulnerability Scanner (PVS), log aggregation and normalization with the Log Correlation Engine (LCE), and SecurityCenter for correlation, reporting, and alerting, Tenable’s USM offering can provide the insight you need to evaluate and monitor unpatched, exposed systems.