Re: Vulnerability Mitigation Management

Hello,

You can apply the following Process

1] DisCovery
- Identify vulnerabilities in your network
- identify threats

2] Prioritize and Determine Risk - based on vulnerability data and
threat that was gathered during discovery process

3] Mitigate Risk
- Implement Access-controls
- Patch updating 
- eliminate problems

4] Monitoring
- monitoring network 
- patch management

hope those process will work. If your concern is Cost tools like SNORT
and NESSUS will help you ALOT =)  in doing network discovery, vuln
discovery, passive scanning etc...

Abraham

On 4 Nov 2004 15:57:57 -0000, infosecgod@gmail.com <infosecgod@gmail.com> wrote:
> In-Reply-To: <BAY1-F22qYYrX0cIUP30000750a@hotmail.com>
>
>
> > I recently began working for a large corporation and have been given the 
> > task to >develop a vulnerability mitigation management 
> > system/program/process.
>
> A daunting task to say the least
>
> > some feedback from anyone who has experience in this area and/or has used 
> > any >technology for this purpose.  I welcome any discussion or thoughts.
>
> Tenable Network Security has a commercial tool that front-ends Nessus as well 
> as using passive VA scanning and data from snort and other IDS â it has a 
> system for tracking vulnerabilities, assigning remediation and tracking the 
> work and it is not too expensive.  I am sure that other commercial tools 
> provide simlar function but I have not used them in this capacity.
>
> J