0

Our management wants to know twice a week which of our networking equipment like our Cisco ASA firewalls, routers are missing patches for the vulnerabilities.They also would like a report when needed on a short notice like 30 minutes before a meeting.

I know a networking team member can go to each networking equipment, log in to the device, open a command line interface, get the version of software running and see if that is the latest version released by Cisco or not, but this is a manual process and we have lot of Cisco devices so doing this would take up lot of time from the networking team. We have around 400 networking devices (switches, routers, access points, controllers, ASA firewalls) mostly Cisco and some Palo Alto equipment.

We have Solarwinds modules NCM, NPM, SEM, SAM, VNQM, NTA, engineer's toolset which are on version 2019.4

  1. Is there a quick way using the Solarwinds modules we have to determine patch levels of our networking equipment, ASA firewalls, Aggregation Services Routers, VPN concentrators, Firepower Threat Defense etc. to see which device is vulnerable to which vulnerabilities which are shown by CVE numbers like CVE 2020-3452? If so, how? Our networking team is understaffed so does not have time to figure out how to do this using the Solarwinds modules we have. If they are given step by step instructions on how to do this, they may configure it for us. This is to make sure a vulnerability like CVE 2020-3452 is patched in a week or sooner and if takes longer than a week, management is aware so they can assign more resources to the networking team, change project priorities etc.

  2. Can we set up automated reports using the Solarwinds modules we have so we know our ASA firewall is vulnerable to CVE XYZ which was released yesterday? If so, how? Our networking team is understaffed so does not have time to figure out how to do this using the Solarwinds modules we have. If they are given step by step instructions on how to do this, they may configure these reports for us. This is to ensure we are addressing latest vulnerabilities and can know how quickly the devices are patched.

  3. How else can we ensure we are aware of latest vulnerabilities released for Cisco, Palo alto using the Solarwinds modules we have? We don't want an auditor to ding us for not patching within a reasonable time frame but not overburden the networking team who are overwhelmed with their daily project work in addition to patches which are released sporadically.

1
  • Network Configuration Management NCM includes firmware version reporting (even updates on some devices) - should be pretty straightforward. You'd still need to check for current versions and vulnerabilities though. I'd recommend running a version check list at least once a month. – Zac67 Nov 16 '20 at 11:15
3

Is there a quick way using the Solarwinds modules we have to determine patch levels of our networking equipment, ASA firewalls, Aggregation Services Routers, VPN concentrators, Firepower Threat Defense etc. to see which device is vulnerable to which vulnerabilities which are shown by CVE numbers like CVE 2020-3452? If so, how?

Yes and no. You can easily create a report (there may even be a built-in one) to list the software version of your devices. But you will have to manually compare the versions to security advisories to see if specific CVE's affect them. Each manufacturer does it differently.

Can we set up automated reports using the Solarwinds modules we have so we know our ASA firewall is vulnerable to CVE XYZ which was released yesterday?

If you run your version report regularly (monthly, for example), you should be able to determine this quickly.

Our networking team is understaffed so does not have time to figure out how to do this using the Solarwinds modules we have.

If your networking team doesn't think this is important, I'm afraid we can't help you. This is a management problem that technology can't solve. If your organization wants to comply with regulations, you'll have to spend the time. Frankly, in the time you spent researching and writing this question, you probably could have figured it out.

We don't want an auditor to ding us for not patching within a reasonable time frame.

You are missing an important step here: You need to analyze each vulnerability to see if it applies to you and what your severity rating is (different from the manufacturer). This takes time because you need to analyze the vulnerability in the context of your network. Not every CVE is equally important.

Here are two examples to explain what I mean:

  1. There was a recent vulnerability that affected Cisco routers. The vulnerability was that an attacker could interrupt the boot process on the router and inject malicious code. This vulnerability was rated "high." Although the vulnerability was rated high by Cisco, in our network, we rated it "low." Why? Because we had other controls that mitigated it. You needed physical access to the routers in order to exploit it. Our routers are in a data center with restricted access, so in our judgement, this was not a "high" risk.

  2. Another vulnerability affected IKEv2 IPsec tunnels. This was also rated high. But we don't have any IKEv2 tunnels, so this vulnerability doesn't affect us.

My point is you need to analyze the vulnerabilities so that you are not scrambling around trying to mitigate every single one as if it's a matter of life or death. Some are important, but many are not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.