Managing and fixing vulnerabilities gets easier with ObsidianPro

Cloud-based platforms like ObsidianPro VMS help enterprises identify and address critical cyber security vulnerabilities on priority, with minimal business impact.

Globally, organizations are adopting digital technologies more and more. This has exponentially broadened their ‘attack surface’ and exposure to cyber security risks, with cybercriminals waiting to exploit vulnerabilities. It can take an average of 7.5 days to fix a vulnerability in app security; hackers can use these loopholes within the week. Such a compromise can erode business value, negatively impact customer trust and cause reputation loss. Hence, real-time vulnerability management is critical for enterprises, irrespective of scale or maturity.

Vulnerability management needs a secure project management system

Vulnerability management is the process of identifying, evaluating, and addressing vulnerabilities in applications or software. This proactive approach strengthens the company’s defenses by finding and fixing weak spots. Vulnerability management is done through multiple aspects, using tools as well as manual and automated testing.

Managing and fixing vulnerabilities includes coordination with multiple internal teams and external security experts. Project management aspects like reporting and coordination are often done via email or stored in shared drives. This in itself is a grave risk, it presents a ready-made list of vulnerabilities, and the solutions that the organization is working, to malicious actors. Even if this coordination is done using a third party project management tool, the risk remains, based on their servers and data protection.

Obsidian has created a secure, cloud-based platform for vulnerability management processes in application security. The real-time platform can help track and address critical issues on priority, with in-built project management and communication between the teams.

Why a Vulnerability Management System (VMS)?

The manual way of managing vulnerabilities and commonly used project management tools are not ideal options due to several reasons. A real-time, cloud-based vulnerability management solution such as ObsidianPro VMS addresses all these practical issues with a convenient and time-conscious solution.

• Security aspect: In security, application, and network penetration testing, customers are notified of vulnerabilities by email. These emails, if intercepted and not encrypted, can be easily exploited by attackers.
• Tedious process:  Coordination can be time-consuming, if you account for manual filling of excel sheets and the time taken for the team to clarify or respond. There is also no single dashboard which presents visibility on the status of vulnerabilities identified.
• Lack of standards: Every vulnerability has a severity level. On many occasions, the tester assigns the severity levels without any specific measures or using parameters specified by the customer, who may not be fully updated on current risks. Often, this is not well organized and done using an excel sheet, word document, or notepad. As a result, companies could miss out on valuable industry pertinent parameters or risk mis judgement in the severity of vulnerabilities.

ObsidianPro : the 360-degree VMS

ObsidianPro VMS is a business-to-business (B2B) vulnerability management system (VMS) developed by Obsidian Security. It is available to customers who engage with the firm as a managed security service provider (MSSP) for penetration testing engagements.

ObsidianPro VMS has a unified dashboard that keeps track of vulnerabilities, their status, and the actions due from various team members. The intuitive platform gives companies a 360-degree view of vulnerabilities reported across different projects to all the stakeholders – developers, programmers, leadership, and compliance teams. The dashboard includes vulnerabilities identified, categorization by severity and impact, notification of critical priority issues, and supporting technical material.

When a client signs up for any vulnerability management with Obsidian, the team runs a checklist to understand the context and specific risks related to the business and industry. They deep dive into:

• The particular industry
• Nature of the use case
• The front-end customers
• How back-end operations work
• Any sensitive operations or information in the applications
• Risks that the customer’s stakeholders would face if there are security vulnerabilities identified

A single point of contact is assigned for the customer to have an easy interaction, and the project manager initiates on boarding to the ObsidianPro VMS portal.

The ObsidianPro VMS platform offers project management and security throughout the vulnerability management process.

Tight security controls: Obsidian is an ISO-27001 certified organization with information security management policies that govern how we deal with customer data. As a best practice, the firm has a 60-day data retention policy. As part of the penetration testing, all project-specific data is deleted once a project is complete.

The organization has several security controls to ensure that data stored in the VMS is entirely secure, with an AES 256-bit encryption. Another excellent security layer is built in by cloud service providers right out of the box. Amazon Web Services (AWS) handles the encryption keys, and Obsidian has no encryption and decryption keys. All customer passwords are MFA-enabled. There are few chances of an attacker trying to hack into a particular account even if customers lose their credentials.

Industry standards to raise severity for a particular vulnerability: The ObsidianPro VMS platform uses industry standards to prioritize vulnerabilities. When a standard such as the CVSS score is employed to define severity, it removes any biased opinions. Vulnerabilities are color-coded based on severity – green for low severity, yellow for medium, red for high, dark red to emphasize the criticality of the issue. This helps companies to address critical problems on priority.

Individual permissions as per expertise: ObsidianPro VMS defines granular-level permissions for collaborators on a project, whether team members, or vendors performing development or support activities. This ensures that members with specific expertise can be allocated a critical problem or vulnerability.

Dashboard with real-time view of status: The platform provides customer-specific and project-specific dashboards. This provides full visibility of who has performed what activity, a picture of issue-specific sample codes, and assessments pertaining to particular issues.

Automated notification of critical issues: When a critical issue which could have a high-level impact on the customer’s business is identified, we report it on priority after an internal review. The customer will receive an automated notification on the ObsidianPro VMS portal. We also send an email if the customer is not active on the portal. This makes it easy for the customer track and assess what their teams need to address immediately.

Extensive technical support material: Along with standards, ObsidianPro VMS has a checklist to help network teams understand technical details about a particular vulnerability. This includes capturing screenshots/photos of proof of concept or videos (based on the complexity). There is also a detailed description of a particular vulnerability and recommended remedial steps. Standard references in case of similar issues or use cases faced, and external references are also given in the ‘Reference’ section. 

Rigorous quality checks: Ob has incorporated stringent quality checks at every stage of the vulnerability management process. Information and issues are discussed with internal experts to make the right assessments and identify vulnerabilities. Information is streamlined through the project manager to ensure an easy point of communication.

Seamless interactions: The ObsidianPro VMS tool allows interaction between the customer team, Obsidian project team and others. Customers can simply comment on the portal if they have any enquiry, and Obsidian’s team will respond.

In the digital world, vulnerability management is a business-critical aspect of security for every enterprise, irrespective of industry segment, or whether large or small. Information that is shared using a cloud-based vulnerability management tool such as ObsidianPro VMS doubly secures classified information, plus streamlines the whole process, making it easier and more efficient for everyone involved.