New Preview Capability - Security Vulnerabilities

[IainCaldwell]

Lansweeper is delighted to announce new capabilities in the security vulnerabilities space. Building on the foundations of our world-class scanning technology Lansweeper has enhanced our software scanning to normalize and enrich with NIST standard naming and identification. This enables Lansweeper to offer value add capabilities matching clients' software against NIST vulnerabilities databases.

This is a preview feature and will be iterated frequently over the next few months before the official release. Please use this space to give suggestions +ve or -ve to help us improve the product.

[Cole]

Is there a way to Ignore an asset from vulnerability scanning? We have some old XP, 7 machines that control equipment that can't be upgraded/patched. I don't want to remove the vulnerability from scanning other machines.

[edu_ayus]

@Cole , as I mentioned below to dtracey, we are adding the vulnerabilities cause in a more comprehensive way. That, for example, will allow filtering by OS the vulnerabilities view. Another way to filter them, which you can already apply, is defining a state for those assets (e.g. EOL_asset) and creating a customize view filtering that state  (using the asset state filter).

I hope this helps you.

[Cole]

edu_ayus, well filtering thru a report is one thing, but I am more talking about excluding the asset from even being scanned which is much different. One big reason I went to the cloud was for security vulnerabilities and I hope lansweeper continues to work this part of it. Another big issue has already been mentioned is vulnerability showing up on computers that have been patched by a later update/patch that included the previous vulnerability. Thanks for your help.

[dtracey]

Is there a way to filter vulnerabilities by operating system ?

[edu_ayus]

Hi @dtracey ,

This is not possible yet, but it is a functionality already in our roadmap (short-term). We will provide the element/s causing a vulnerability(HW, OS, or SW) in a more explanatory way. This will allow easily filtering the vulnerabilities by OS as you are requesting.

[wcb]

"whoami" previously suggested custom labels or additional predefined statuses. Along these lines, I would push for a free text field to note a couple of quick details like which security team member is investigating and perhaps a service ticket number from our help desk.

A strict "assign to" of an existing user could be better though as that would be easy to use as a custom filter for the CVE list.

I would also suggest being able to apply the ignore option to individual assets under each CVE as we clear them or find that is a false positive for that asset. Perhaps ignoring the CVE at the top level would mark all currently identified assets as "ignore". This way if another asset later matches on this CVE it is not overlooked. It may not be a false positive for that added asset.

[sj1]

Is there any plans on enriching the vulnerability information on whether or not it has been actively seen used in the wild? Perhaps using something like the Known Exploited Vulnerabilities Catalog published by CISA.

Known Exploited Vulnerabilities Catalog | CISA

[Jeepinat0r]

Following...  This is a critical piece of info that helps us prioritize remediation efforts.

[edu_ayus]

Hi @sj1 ,

Indeed we are already working to enrich our vulnerability information, and one of the feeds we will use will be the CISA catalog, as you suggested.

I don't have an exact timeframe for it, but it will be in the coming months.