What do you do if you suspect network security vulnerabilities in your workplace?

We live in a world of assume breach. So all our security appliances should be configured to detect vulnerabilities real time. In which case, automatic notifications are sent to SecOps. These notifications includes three critical pieces of information: 1) the asset details impacted 2) the vulnerability details including CVE if any 3) the remediations steps or the fix. For network vulnerabilities, the first thing to do is to determine if the vulnerability is not a false positive. Next we need to determine the impact on our environment. Sometimes vulnerabilities can be legitimate but has no impact on the environment. If the vulnerability is valid with impact we need to isolate the affected segments and remediate.

Identify and document suspected vulnerabilities, alert IT or security teams, perform an initial assessment, contain the breach, conduct a thorough investigation, remediate vulnerabilities, update security policies and training, monitor the network for new threats, and prepare a detailed report. Regularly review and improve cybersecurity practices, tools, and training programmes based on emerging threats and lessons learned from past incidents. This process ensures a secure network, prevents security breaches, and helps organisations maintain a robust security system.

If you suspect network security vulnerabilities in your workplace, report the issue, conduct a security audit, implement security controls, apply security patches and updates, limit access, educate employees, and monitor network activity to identify and mitigate potential threats.

First of all, identify vulnerability issues carrying out a black/gray pentest. Second, close the back doors and run Pentest's indicated procedures.

Reporting a vulnerability on-time, is an essential step towards vulnerability management. As this helps the vulnerability management team to investigate and mitigate as required, before it wide spread and becomes an emergency.

je contacte immédiatement l'équipe de sécurité informatique ou le responsable par téléphone ou via un canal dédié. J'envoie un email détaillé et utilise les outils de reporting interne pour consigner officiellement l'incident.

Vulnerability management is a part of the change management typically. But when assessed as Sev 1 or Sev 2, you might want to consider treating it in a similar fashion as your security incident management process (actors may be different). Automations or specialized tools can help very much to detect and flag potential issues to the appropriate support team... for a timely assessment and remediation plan deployment. You may want to identify in your organization some key actors that can act as a close contact hub with your technical teams, security and business lines. This will help speed up getting a diagnostic, prioritize, and make a decision for deployment of remediation.

Durante el proceso de monitorear un entorno, al momento de identificar una vulnerabilidad y realizadas las investigaciones correspondiente se informa de manera inmediata al responsable de realizar las remediaciones para que se proceda con el accionar. Posterior a las remediaciones se debe continuar con el monitoreo y realizar escaneos y hardening para validar que la vulnerabilidad identificada ha sido remediada.

Upon identifying a potential security vulnerability, prompt reporting is paramount. Notify the relevant personnel, typically the IT department or security officer, immediately. Offer clear, concise details of your observations, supplemented by any documented evidence. Avoid attempting to resolve the issue independently unless authorized and proficient, as this may worsen the situation or breach company protocols. Swift and accurate reporting ensures expedited resolution, safeguarding network integrity.

When discovering a network vulnerability, stay calm and assess its scope and impact. If actively exploited, contain the breach by isolating affected systems and applying temporary fixes. Assemble a response team and document all actions and communications. Inform key stakeholders with clear, factual updates to avoid unnecessary alarm. Implement patches or fixes promptly, then monitor systems to ensure the issue is resolved. Conduct a post-incident review to learn and improve processes. Update security policies and train staff accordingly, maintaining transparency with customers and partners if necessary to preserve trust.

If your organization is mature enough to have a good grip on security risks, you may be lucky. If not, you better have a strong security incidents and change management process. You want to have control on how to communicate and when. The worst thing is to avoid answering or providing inaccurate information to your clients or your management. It is recommended to set rules of engagement on the communication side. If you have to communicate outside of your organization you want to make sure to control the message. Otherwise you may impact your corporate image considerably.

Las brechas que sean identificadas dentro del entono de la organización es investigado primeramente por especialistas de seguridad para validar que no se trata de algún falso positivo, de esta manera se evita causar ruido, luego de tener la información necesaria se procede a con la comunicación únicamente a los autores involucrados que deben participar en la remediación y los líderes.

Maintaining composure is crucial when suspecting a security breach. While anxiety may arise, refrain from instigating panic among colleagues. Prioritize confidentiality; disclose the matter solely to relevant parties like your supervisor or the IT department. Avoid circulating rumors or unverified information, as these can foster unnecessary anxiety and impede effective response efforts. By exercising discretion, you contribute to a focused and efficient resolution process, minimising disruption and safeguarding workplace morale.

While you may not work in cybersecurity, it's crucial to understand that security is a collective responsibility. Users often serve as the first line of defense by spotting unusual activities. Therefore, it's important to promptly report any irregularities to the appropriate department without causing unnecessary alarm or disruptions among colleagues. Maintaining composure during such incidents is vital for a swift and effective response, ensuring minimal impact on daily operations and overall security posture.

Es importante contar con herramientas que te permita aislar los activos infectados, para sacarlos de la red y no se propague lo infectado, de esta manera se mantiene la evidencia para realizar las investigaciones correspondientes y dar con la causa raíz.

Preserving evidence of a security vulnerability is paramount. If you encounter suspicious emails or files, refrain from altering them; secure the evidence promptly. Avoid deleting or modifying potentially compromised files, as they may be vital for forensic analysis. Unsure of proper procedures? Seek guidance from your IT department. Preserving evidence integrity is pivotal for comprehending the attack's scope and method, facilitating effective response measures.

Je suis ces étapes : 1.Je m'abstiens de modifier, supprimer ou déplacer les preuves afin de préserver leur intégrité. 2. Si possible, je prends des captures d'écran ou des copies des preuves, en veillant à inclure toutes les informations pertinentes. 3.Je stocke les preuves dans un emplacement sécurisé, tel qu'un dossier protégé par mot de passe ou un système de gestion de cas, pour éviter tout accès non autorisé. 4.Je consigne toutes les actions prises concernant les preuves, y compris les captures d'écran, les copies et tout accès ultérieur, afin de documenter la chaîne de contrôle. 5. Je signale rapidement les preuves sécurisées à l'équipe de sécurité informatique ou aux autorités compétentes pour une enquête approfondie.

If you encounter suspicious emails, files, or any other evidence that suggests a security vulnerability, it is imperative that you take steps to secure this evidence without making any alterations. Avoid deleting or modifying potentially compromised files, as they may hold crucial information needed for forensic analysis. Preserving the integrity of this evidence is essential for understanding the scope and method of any potential attack or breach. Any tampering with the evidence can compromise the investigation and hinder our ability to identify and mitigate security threats effectively.

Following up after reporting a vulnerability is crucial for effective resolution. Respect IT procedures and response times, recognizing the complexity of such matters. Keep abreast of the investigation's progress and any necessary actions, like password changes or heightened vigilance. By staying informed and engaged, you contribute to a swift and thorough mitigation process, bolstering network security and resilience.

Se debe mantener seguimiento constante para que las remediaciones sean realizadas, para esto utilizar registros de control de cambios e implementación, criterios de aceptación en donde se contemplen las tareas correspondientes de seguridad, de esta manera nos aseguramos que las remediaciones se hayan realizado y al finalizar se realicen las pruebas necesarias para confirmar que la vulnerabilidad identificada fue subsanada. Es importante contar con procedimientos definidos para la gestión de vulnerabilidad, hardening y pruebas de penetración para una adecuada atención y monitoreo constante del entorno.

Je crée un ticket, attribue des responsabilités, communique régulièrement, évalue les progrès, documente les solutions et participe à des revues post-mortem pour résoudre efficacement les problèmes de sécurité réseau tout en renforçant la posture de sécurité globale de l'entreprise.

It is imperative to stay engaged with the IT department or security team post-reporting to ensure prompt and effective resolution of the identified vulnerabilities. This includes respecting their procedures and response timelines, acknowledging the complexity of these issues, and maintaining open communication throughout the investigation. To effectively follow up: 1- Respect Procedures and Response Times 2- Stay Informed 3- Maintain Communication By following these recommendations, you contribute to a collaborative effort aimed at safeguarding the organization's network security. Your diligence and cooperation are vital in addressing and mitigating potential threats effectively.

Here are my 4 simple strategies that I would recommend. 1. Engage Stakeholders: - Identify key stakeholders. - Collaborate on a security strategy. 2. Implement Security Controls: - Deploy multi-layered security. - Keep software updated. 3. Monitor Continuously: - Use real-time monitoring tools. - Conduct regular audits. - Stay updated on threats. 4. Conduct Regular Assessments: - Schedule vulnerability tests. - Engage third-party experts. - Prioritize based on severity.

"How often have I said to you that when you have eliminated the impossible, whatever remains, however improbable, must be the truth?" If you suspect there are network vulnerabilities, you are likely have a network that is powered on. The lifecycle of vulnerabilities and having usable networks limits the potential for 0 vulnerabilities. To really address vulnerabilities you need to establish roles and responsibilities, set clear expectations on remediation, and establish continuous assessments with clear metrics. Then do that for the rest of your life. Enjoy

You always have to keep cost in mind and be respectful with tact when you tell people about issues. A security person is always going to find things that can be better. We need to be able to solve problems without building better mouse traps. Don't ever talk about vulnerabilities as if they aren't a sensitive subject. A security practitioner is always a salesperson. You have to sell the idea of using resources for a thing that makes money in order to make it secure. You have to sell yourself as a professional who can be counted on to deliver the right answers consistently that match the budget, solve the problems, and don't reinvent the wheel. If you have something and you want others to sell it make sure you don't set them up for failure.

5. Feed back in any lessons learned- whether technical, procedural or in personnel skills. This will ensure all of your efforts in Point 1-4 are recognised and acted upon.