General

Vulnerabilities management is a software solution that enables automatic detection of predefined security gaps. Due to increasing threats on the Internet and deprecated and unupdated programmes, vulnerabilities management combines all these points and offers centralised management to prevent problems: Vulnerabilities found in your network are clearly listed and displayed, and also provide insight into the individual clients affected by the security gaps.
Vulnerability Management is full integrated into ACMP and essentially goes through three steps: First, the ACMP Server must download or update the vulnerability definition file. Then, the vulnerability scanner must run on the client. Once the scan has been completed, the findings are transmitted to the ACMP Server and are available for continuing evaluation in ACMP.
The entries are summarised for you in a table, in a grid. There you will find various info about the vulnerability (CVE ID and caption), as well as the respective severity and how many clients are affected by the security vulnerability.

If you see a need for action to eliminate the vulnerabilities found, you can now create dynamic containers that can then be sent to the affected clients using a Client Command, a Windows Update Collection or a Managed Software Updates Alternatively, you can also send the desired action directly to the affected clients. The aim of vulnerability management is to identify potential security vulnerabilities so that they can be eliminated.

Strucuture of Vulnerability Management

The Vulnerability Management plugin consists of various tabs, starting with the dashboard, where you can view relevant information about vulnerabilities in your company in a clearly summarised form (see "The Dashboard in Vulnerability Management"). The detected Vulnerabilities tab lists all security vulnerabilities that have been discovered on at least one client in your environment. Under globally excluded Vulnerabilities, you will find vulnerabilities that have been excluded globally (for all known findings and possible future ones). This affects the entire vulnerability. Locally excluded Vulnerabilities are only explicitly excluded for the selected clients and not for all of them.

Preparations for Vulnerability Management

A few preparations are necessary before vulnerability management can be put into operation:

Pre-Configurations:

Assign permissions

To be prepared for later work in Vulnerabilities Management, you should check the user permissions in advance to ensure that they are correct. To do this, open the permissions for the respective user group or user in User Management (System > User Management). To do this, navigate to the wizard page "Rights of the user" > Security > Vulnerability Management and tick the necessary checkboxes. In order to be able to use all functions of the plugin, you should assign full rights (e.g. to exclude vulnerabilities later or to reverse this exclusion).

Once you have completed the necessary preparatory work, you can begin the actual task. Navigate to Vulnerabilities Management (Security > Vulnerabilities Management) and first ensure that the definition files are current. To do this, click on the ribbon bar Update vulnerability definition file. The scheduled server task will start shortly. You can view the status of the job directly in the dashboard, in the Download Statistics widget. Otherwise, no data is available yet and the widgets remain empty.

The dashboard in Vulnerability Management

The dashboard in Vulnerabilities Management consists of several widgets that provide you with important info at a glance. The following widgets are available by default:

• Download statistics
• All Clients grouped by severity
• Clients with most vulnerabilities
• Vulnerabilities affecting most Clients
• Vulnerabilities with highest score

If the widgets have not yet been filled with dates, you may need to take the necessary precautions mentioned above.

Properties of the fields in the Vulnerability grid

Below you will find explanations and meanings for the fields that provide a summary of the information in the vulnerability grid.

Weighting and severity of Vulnerabilities

A CVE vulnerability (Common Vulnerabilities and Exposures) is a known security vulnerability within software or hardware that poses a risk that attackers could gain unauthorised access and thus compromise systems. Each of these security gaps is assigned a unique CVE ID, which makes it identifiable worldwide. In accordance with international standards, vulnerabilities are assigned both a severity rating and a numeric weighting so that an user can classify the risk. In Vulnerability Management, you can find the necessary info in the widgets and in the tabs Discovered Vulnerabilities and Global/Locally Excluded Vulnerabilities.

For a better understanding, you will find a table below with the entries, as well as a classification of the severity level and a description.

Detected Vulnerabilities

The Detected Vulnerabilities tab lists all vulnerabilities found on at least one client in your environment. The workspace is divided into two areas: the upper area contains a tabular list of the results, while the lower area shows a detailed view of a selected vulnerability. Using the drop-down menu above the grid, you can also influence the set of results by displaying either only the security vulnerabilities discovered on the clients or all published vulnerabilities. The former option is preselected by default.

Actions can be conveniently executed via the ribbon bar or from the context menu. Here you can decide, for example, whether to exclude a security vulnerability globally or locally. An exclusion is used to remove irrelevant vulnerabilities from the count. Global exclusions apply to all known and possible future findings of a vulnerability (all clients), while local exclusions only apply to the selected clients. Select the desired number of vulnerabilities in the grid and select the respective button for a global () or local () exclusion of the vulnerability and enter a reason for the exclusion. Refresh () the current view of the discovered vulnerabilities or create a container for the selected vulnerability directly from the window (). The action Add selected vulnerabilities to an existing container also allows you to add selected vulnerabilities to an existing container. If you have already created a container for a vulnerability, you can navigate to it using the Switch to Container button; otherwise the button will be greyed out.

The grid contains various details about the vulnerabilities detected, providing you with initial notes on the severity, the affected Clients and the time when the vulnerability was detected. A detailed list of the properties of the fields in the grid can be found here.

At the bottom, you will find three more tabs with detailed information about the selected vulnerability: General, Affected Products, and Affected Elements.

Create Container for a Vulnerability

From Vulnerability Management, you can create a container for a security vulnerability directly. This can be done either via the context menu or via the action  Create Container in the ribbon bar.

To create a container, you must first select a vulnerability from the grid and then click on the action. The wizard for adding a new ACMP container opens. The main difference to the regular creation process is that the Name field is already filled in with the CVE ID and the vulnerability has been inserted under the dynamic client link. Once you have created the container, the view automatically switches to the containers (Client Management > Containers) and you will see a list of clients that fall under the vulnerability. Alternatively, you can also access it via the action  Switch to Container in the ribbon bar.

Global and locally excluded Vulnerabilites

You can specify global and locally excluded Vulnerabilities by clicking either global () or exclude locally () under Detected Vulernabilities in the ribbon bar. The process for both types of exclusion is identical: Select the vulnerability or vulnerabilities you want to exclude in the grid and click the corresponding button. Enter a reason for the exclusion and confirm the window with Yes. You can then see the reason for the exclusion in the grid field in the other tabs (global or local).

In the event of a global exclusion, the discovered vulnerability is removed from the table and listed in the other tab (global).
Exclusions are used to remove irrelevant vulnerabilities from the count. In the case of a global exclusion, the entire vulnerability is excluded for all known findings as well as for possible future ones. In the case of a local exclusion, a security vulnerability is explicitly excluded only for the selected clients. Regardless of whether a vulnerability has been excluded globally or locally, the clients are still scanned for this vulnerability.

To undo or remove an exclusion, select the vulnerability in the relevant tab (global or locally excluded vulnerabilities) and then click on  Remove exclusion in the ribbon bar or open the action field via the context menu. Confirm the security question here as well so that the security vulnerability is removed and listed under the Discovered Vulnerabilities tab.

If you would like to edit the reason for an exclusion afterwards, you can do so using the context menu action of the same name (Edit Reason for Exclusion).

Vulnerabilities in the Client Details

The vulnerabilities of the selected client can be displayed via the client details (selected Client > Client Details > Software > Security > Vulnerabilities). From this view, you can see when the last client scan took place and the timestamp of the vulnerability definition file, i.e. when a new file was last imported. In addition, all detected and possibly already excluded vulnerabilities are listed in the named tabs.

Thanks to the dashboard and the "Vulnerabilities grouped by severity" widget stored here, you can see the selected info about the selected client sorted and grouped.

Actions in the client details can only be executed via the quick selection menu at the top. The view is divided into individual tabs and the vulnerabilities listed in a table. If you select a vulnerability in the grid, you can find detailed information in the lower area.

Vulnerabilities History

Starting with ACMP version 6.9, you have the option of displaying the vulnerability history using the display fields. To do this, use "Clients" as the query base and then select the fields to be included in the query from the left-hand navigation bar (Available Fields > Vulnerabilities > Vulnerabilities History) and insert them on the right-hand side.

Complete the remaining wizard and specify any continuing configurations if necessary.

Important information about vulnerabilities discovered on a client is stored in historical data, allowing you to track the development of your vulnerability management or retrieve this information in the event of an audit. As soon as a new vulnerability is found on a client, a new dataset is created in the history and listed below. This includes, for example, info about when the scanner first found a vulnerability (display field "First vulnerability found") and when it last detected it ("Last known finding"). For more accurate tracking, both the date and time are stored.

The properties of the fields found here can be found in the following table.