- Title
- An exploratory investigation into an Integrated Vulnerability and Patch Management Framework
- Creator
- Carstens, Duane
- ThesisAdvisor
- Motara, Yusuf
- Subject
- Computer security
- Subject
- Computer security -- Management
- Subject
- Computer networks -- Security measures
- Subject
- Patch Management
- Subject
- Integrated Vulnerability
- Date
- 2021-04
- Type
- thesis
- Type
- text
- Type
- Masters
- Type
- MSc
- Identifier
- http://hdl.handle.net/10962/177940
- Identifier
- vital:42892
- Description
- In the rapidly changing world of cybersecurity, the constant increase of vulnerabilities continues to be a prevalent issue for many organisations. Malicious actors are aware that most organisations cannot timeously patch known vulnerabilities and are ill-prepared to protect against newly created vulnerabilities where a signature or an available patch has not yet been created. Consequently, information security personnel face ongoing challenges to mitigate these risks. In this research, the problem of remediation in a world of increasing vulnerabilities is considered. The current paradigm of vulnerability and patch management is reviewed using a pragmatic approach to all associated variables of these services / practices and, as a result, what is working and what is not working in terms of remediation is understood. In addition to the analysis, a taxonomy is created to provide a graphical representation of all associated variables to vulnerability and patch management based on existing literature. Frameworks currently being utilised in the industry to create an effective engagement model between vulnerability and patch management services are considered. The link between quantifying a threat, vulnerability and consequence; what Microsoft has available for patching; and the action plan for resulting vulnerabilities is explored. Furthermore, the processes and means of communication between each of these services are investigated to ensure there is effective remediation of vulnerabilities, ultimately improving the security risk posture of an organisation. In order to effectively measure the security risk posture, progress is measured between each of these services through a single averaged measurement metric. The outcome of the research highlights influencing factors that impact successful vulnerability management, in line with identified themes from the research taxonomy. These influencing factors are however significantly undermined due to resources within the same organisations not having a clear and consistent understanding of their role, organisational capabilities and objectives for effective vulnerability and patch management within their organisations.
- Description
- Thesis (MSc) -- Faculty of Science, Computer Science, 2021
- Format
- computer, online resource, application/pdf, 1 online resource (166 pages), pdf
- Publisher
- Rhodes University, Faculty of Science, Computer Science
- Language
- English
- Rights
- Carstens, Duane
- Rights
- All Rights Reserved
- Hits: 5988
- Visitors: 6184
- Downloads: 356
Collections
RU Department of Computer Science
| Thumbnail | File | Description | Size | Format | |||
|---|---|---|---|---|---|---|---|
| View Details Download | SOURCE1 | CARSTENS-MSC-TR21-116.pdf | 1 MB | Adobe Acrobat PDF | View Details Download |