topic Re: Vulnerability management aggregation tools in Tech Talk

Vulnerability management aggregation tools

Kempy — Mon, 09 Oct 2023 09:01:15 GMT

So following a discussion launched on another social media platform, I compiled a list of what tools folk were advocating over at https://github.com/kempy007/VulManAgg

Now the crux of the conversation was;

"Application security vulnerability management - which tool do you find the most useful to store, manage, and prioritize vulnerabilities?

...

I'd like to hear some honest feedback from those who have implemented these solutions. PLEASE no sales pitches or solicitation."

Some of the tools claim to be able to pull in Application scans and Network scans and even Source Code scans and to output to multiple defect tracking tools.

So my question is have I missed any worth noting, and what are your experiences with the ones you have used.

Re: Vulnerability management aggregation tools

Shannon — Mon, 19 Nov 2018 11:22:21 GMT

You might have to check the link you included; it opens a page on GITHub that displays

404 This is not the web page you are looking for.

Re: Vulnerability management aggregation tools

Kempy — Mon, 19 Nov 2018 12:33:16 GMT

A space got included 😞

Re: Vulnerability management aggregation tools

DHerrmann — Tue, 18 Dec 2018 20:44:37 GMT

We wrote our own tool.

Re: Vulnerability management aggregation tools

Kempy — Thu, 20 Dec 2018 08:48:28 GMT

You know sharing is caring!

Care to spill the details, which components did you elect to use and why.

Does it improve asset management, is it part of a GRC tool.

Why did you write your own tool, was there a lack of choice?

Re: Vulnerability management aggregation tools

DHerrmann — Thu, 20 Dec 2018 19:55:00 GMT

Hi - nope, it's not a part of Archer of any other GRC tool. It was written by one of our teams.

All vulns found are loaded into a database (I think it's MS SQL Server), and a front-end was written. All vulnerabilities are assigned a "traunch" based on their CVSS/CVE score, internal vs external, etc.

This makes it very easy to determine if remediation is overdue and we can collect really good stats to help us determine who needs "encouragement" to remediate on-time.

I can't share a ton of details, but that high level view should help you know where we're coming from.

Re: Vulnerability management aggregation tools

Kempy — Mon, 04 Mar 2019 09:05:04 GMT

If you can share a schema and BPMN chart it would be helpful to others.

Re: Vulnerability management aggregation tools

DHerrmann — Mon, 04 Mar 2019 16:32:20 GMT

Can't. It's proprietary - company intellectual property. Sorry.

Re: Vulnerability management aggregation tools

TPAASYCC — Fri, 25 Sep 2020 18:08:29 GMT

To update your list, add NorthStar:

https://www.northstar.io/how-it-works/