Operational Roles | Vulnerability Management

Other roles to be filled in the ongoing operation of a VM program have both direct and indirect participation and contribute greatly to the program’s effectiveness. The roles are defined early in process development with more concrete modifications when hardware and software are procured. This is because the selection of technology will impact how people work, their involvement in the communications among other groups, and the nature of their interdependencies. If an automated process fulfills a key activity in a role, then the requirement for the role may be diminished altogether.

For example, at the outset it may be planned to have a role of an administrator to take discovered critical vulnerabilities and distribute the remediation requests to the appropriate system owners or administrators. However, it may subsequently be determined that the selected technology can automate this process, and therefore the role is minimized to one of monitoring.

1 Vulnerability Manager

This role is responsible for assuring the correct configuration and operation of the technology, as well as creating, monitoring, and distributing reports as needed. It is by no means a simple administrator role. The individual must be able to interpret technical reports produced by the system and to explain the cause and remediation for a vulnerability. Knowledge of operating systems, networks, and security practices is required. This individual will interact with system administrators and network managers to assure that the vulnerability identification and remediation processes meet goals.

2 Incident Manager

When vulnerabilities require attention, one person must take responsibility for remediation. It is often the owner or administrator of the vulnerable target. This individual should have insight into the configuration and operation of the target and be able to assess the impact of a change to that system. This person, known as an incident manager, will work with the vulnerability manager to complete the required remediation tasks. It is the responsibility of the incident manager to follow up on the assigned remediation tasks until they are complete. In some cases, this role in combined with the role of change manager. For example, smaller organizations may have one person to field all work for engineers and administrators. This person could be responsible for receiving incidents, coordinating changes, and distributing remediation work.

3 Change Manager

In a more complex remediation scenario where multiple systems or business functions may be affected by a complex change, the change manager will act as a project manager to oversee the full extent of the change. This manager will inform the affected parties, coordinate activities, perform testing or assure that proper testing is completed, and work with the vulnerability manager to verify compliance.

4 Compliance Manager

This role is primarily one of a recipient and end user of the VM system, and also one of the principal beneficiaries. In a normal compliance function, the compliance manager is tasked with assuring that the systems in use by the company adhere to policies and standards. This manager is generally a recipient or consumer of reports from the VM system. More importantly, in a dynamic environment the compliance manager will review trend reports to determine whether there is a continuous or repeating activity that results in a system being out of compliance. This allows the compliance manager to discover processes in the organization that may be flawed in a way that leads to repeat policy deviations.

In an environment where service level agreements (SLAs) are used to establish service levels, the VM program manager may create an SLA for the compliance manager to assure that audits take place at the required frequency and the appropriate checks are run on each target. Metrics for this are simple and easily derived from the vulnerability scan results.