Government of Canada Guideline on Vulnerability Management

1.1 Background

The Government of Canada’s Policy on Government Security and Appendix B: Mandatory Procedures for Information Technology Security Control of the Directive on Security Management mandate departments to “implement measures to protect information systems, their components and the information they process and transmit against attacks that leverage vulnerabilities in information systems to affect their integrity and that could have an impact on their availability or confidentiality (for example, malicious code).”^{Footnote 1} This includes implementing corrective actions such as applying patches to address vulnerabilities. In addition, the Canadian Centre for Cyber Security (Cyber Centre) prioritizes patching operating systems and applications as the second most important information technology (IT) security action an organization can undertake to minimize intrusions and their impacts.^{Footnote 2}

This document incorporates foundational elements of the SANS Institute’s Vulnerability Management Maturity Model as well as the National Institute of Standards and Technology NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology) for enterprise patch management technologies. It provides specific guidance on developing, maintaining and managing a vulnerability and patch management program.

Vulnerability management (VM) is fundamentally a risk management function designed to identify, assess and mitigate information security risks associated with information technology (IT) weaknesses. By focusing on remediating or reducing risk to acceptable levels, VM enables an organization to continue delivering its mission effectively and securely. VM serves to reduce the potential for exploitation in a way that involves considerably less time and financial resources than reacting to an incident after an exploitation has occurred. Thus, a well-executed VM program aims to optimize risk management and resource allocation.

1.2 Purpose and scope

The purpose of this document is to provide guidance on developing, maintaining and managing a VM program within a Government of Canada (GC) department or agency.

This guidance aligns with the following GC documents and instruments:

• Policy on Government Security
• Policy on Service and Digital
• Directive on Security Management
• Government of Canada’s Enterprise Cyber Security Strategy
• Government of Canada Cyber Security Event Management Plan (GC CSEMP)
• Patch Management Guidance
• Security Vulnerabilities and Patches Explained: IT Security Bulletin for the Government of Canada (ITSB-96)

1.3 Target audience

The target audience for this guidance is individuals responsible for the management, analysis and remediation of vulnerabilities that affect the GC’s IT systems. This includes cyber security risk managers, VM teams, IT service owners, IT service administrators and IT security operators.

2.1 Governance

Effective VM relies on well-defined policy instruments and governance processes. These establish requirements, expectations, accountabilities, frameworks and work processes, all approved by executive management to ensure institutional support and resources. Governance documentation should include both high-level policies and tactical procedures aligned with industry best practices. In case of disputes or audits, these documents provide a record of the organization’s commitment to structured and transparent governance.

Key elements of VM governance include the following:

• Leadership commitment: Strong executive leadership (for example, departmental chief information officer, chief information security officer) support is crucial for the success of a VM program. Leaders must champion the program, allocate resources, and ensure that security is a priority across the organization. Leadership commitment sends a clear message to employees that security is important, encouraging them to take ownership and participate in the program.
• Decision-making bodies and protocols: Clarify who has the authority and responsibility to make decisions, ensuring alignment with the organization’s risk management objectives.
• Risk assessment and mitigation: Define processes and frameworks for assessing vulnerabilities and establishing mitigation activities and timelines based on risk levels.
• Performance metrics: Use metrics to measure various aspects of the VM program to serve as key performance indicators for continuous improvement.
• Compliance and documentation: Ensure adherence to external regulations and internal policies, minimizing legal and operational risks. Documentation helps communicate necessary processes and ensures that all stakeholders understand their roles and responsibilities.
• Compulsory versus recommended elements: Clearly distinguish between mandatory and recommended elements in the governance documentation.
• Service level agreements: Specify expectations and service level agreements for VM services, especially when relying on third parties.

2.2 Understanding business dependencies on IT assets

Understanding the dependencies of critical business activities on specific IT assets is essential for VM. Organizations need a comprehensive awareness of the business activities that generate value and drive their mission. This includes addressing the unique challenges of managing vulnerabilities in cloud environments. Specialized scanning techniques and security controls tailored to dynamic and shared cloud resources should be implemented. To manage vulnerabilities effectively, organizations should map their IT assets to business activities, identifying the business risk associated with each IT asset. The Canadian Centre for Cyber Security’s Suggested Security Controls and Control Enhancements (ITSG‑33) controls CM‑8 and PM‑5 emphasizes the need for methodical mapping of business activities to the underlying IT assets, ensuring that vulnerability prioritization considers both technical urgency and risk to critical business activities.

Mapping IT assets to business activities requires maintaining accurate visibility of the technology ecosystem through comprehensive asset discovery, dependency mapping, real-time inventory tracking, and integration with the organization’s change and configuration management processes and tools. Organizations must maintain up-to-date inventories and configuration management databases for their physical and virtual computing assets, including operational technology and Internet of Things assets.

IT asset management and configuration management together allow organizations to track non-compliant software deployed in IT environments. Given the complexity and multi-faceted nature of IT systems, it is essential to include all computing environments in a VM program, whether mobile, on-premises, cloud or operational technology. This includes, but is not limited to, endpoints, applications, middleware, libraries, operating systems, hypervisors, virtual machines, container engines, containers, firmware, hardware, industrial control systems, supervisory control and data acquisition systems, distributed control systems, programmable logic controllers, remote terminal units, Human-Machine Interfaces, sensors, and actuators.

The Policy on Service and Digital mandates the necessity of asset management. For further information on IT asset management, refer to Cyber Centre’s Using Information Technology Asset Management (ITAM) to Enhance Cyber Security (ITSM.10.004) (2023).

2.3 Identification of vulnerabilities

Vulnerability identification is a crucial element of VM and involves searching for vulnerabilities within networks under the department’s responsibility. Organizations gain knowledge of vulnerabilities by synthesizing data from multiple sources, such as vulnerability scanning, threat intelligence, vendor notifications, penetration testing, and CVD. Integrating threat intelligence feeds helps to stay updated on newly disclosed vulnerabilities and emerging threats, allowing for more valuable prioritization and addressing of vulnerabilities. Each source offers unique insights, and collectively they provide a comprehensive view for identifying vulnerabilities.

Organizations must perform regular and automated vulnerability scans to continually identify potential vulnerabilities and other security risks within their networks in accordance with the Directive on Security Management. Automated tools should be configured to run scans at regular intervals and after significant changes to the network infrastructure. Up-to-date VM data is essential for supporting cyber incident management, as it allows for accurate assessment of the potential or actual impacts of an incident.

Commercial VM platforms typically cannot detect flaws in custom business applications or government off-the-shelf applications. The risk-managed life cycle of these applications should include periodic targeted vulnerability assessments, penetration testing, and a CVD process to identify software flaws and configuration deficiencies.

Custom applications often rely on underlying commercial-off-the-shelf or open-source components, application programming interfaces, packages or frameworks. Application owners should be aware of these dependencies, including using a software bill of materials (SBOM) and solution architecture documentation. An SBOM is a comprehensive inventory of all software components, including libraries, tools and processes used in the development of a software product. The SBOM plays a crucial role in vulnerability management by providing transparency into the software supply chain, enabling organizations to quickly identify and assess potential vulnerabilities. When paired with software composition analysis (SCA) tools, SBOMs can significantly enhance security by scanning open-source dependencies for known vulnerabilities, risky licences and malware.

2.4 Vulnerability risk assessment

GC organizations are required to “analyze impacts of identified vulnerabilities, and implement corrective actions (for example, apply patches and updates, in accordance with defined timelines and, as required, on an emergency basis).” (Source: Directive on Security Management, Appendix B, subsection B.2.3.7.3)

Effective risk assessment is the cornerstone of any VM program, enabling organizations to prioritize mitigation activities to protect the continued delivery of business activities. The key method for this is a vulnerability risk assessment calculation tool, which should be designed based on the following principles:

• Clearly defined risk factors: Risk factors should be clearly defined and distinguishable from one another. Examples include the ease of exploitation, active exploitation in the wild, presence on IT systems supporting critical business operations, and whether vulnerabilities are on Internet-connected IT assets. It should also be indicated whether there have been existing mitigation or compensation controls implemented for each factor.
• Significant value in risk determination: Risk factors should add significant value in determining risk.
• Unambiguous scoring guide: A scoring guide should explain in unambiguous language how different scores are assessed for each risk factor.
• Transparent scoring mechanism: The scoring guide should also explain how the scores of each risk factor are combined to arrive at an overall risk score. This process should be transparent, straightforward and easy to understand.

A vulnerability risk assessment method should produce two critical pieces of analysis:

1. Overall risk score: Indicates the level of risk associated with a vulnerable asset.
2. Mitigation timelines: Specific timelines for mitigation linked to risk scores, decreasing in duration as the risk increases. These timelines should align with those of similar organizations and be effective against known threat actor exploitation speeds, as reported by vendors and intelligence sources.

There are many ways to conduct a risk assessment. For instance, the Cybersecurity and Infrastructure Agency has released the Stakeholder-Specific Vulnerability Categorization (SSVC), which is an example of using decision trees. Weighted average risk calculations are another method for conducting assessments. Appendix C provides a vulnerability risk assessment approach using weighted average risk scoring that considers the following risk factors:

• vendor risk rating
• vulnerability technical rating
• exploit maturity
• asset importance to threat actors
• asset importance to business activities
• asset external exposure

While adherence to mitigation timelines is crucial, there can be exceptions and exemptions to patching. For vulnerabilities without available patches, alternative mitigations (for example, network segmentation) or temporary workarounds (for example, disabling the vulnerable feature) may serve as interim measures. In non-zero-day situations, alternative mitigations can also be acceptable, but they must not leave the organization exposed to additional risk. Any exception to the established patching timeline should be backed by a risk assessment to confirm that the alternative measures appropriately mitigate the risk.

In some cases, risk owners may decide to accept certain risks associated with vulnerabilities. A formal risk acceptance process and risk acceptance registry are pivotal for managing vulnerabilities that cannot be immediately mitigated. This process involves documenting instances where an organization decides to accept the risk associated with a specific vulnerability rather than implementing immediate corrective actions. The risk acceptance registry should detail:

• the rationale for each acceptance decision, including an analysis of the impact versus the cost of mitigation, and whether there are controls in place that partially mitigate the risk
• the conditions under which the risk acceptance will be reviewed and potentially revisited, such as changes in the threat landscape or the availability of more effective mitigation strategies

This registry serves as a critical tool for tracking accepted risks over time, ensuring they are acknowledged, justified, and continuously assessed against organizational risk tolerance and security posture. Any risk acceptance must include an expiry date that is less than 12 months from when it is issued. This ensures a regular review and re-acceptance.

2.5 Mitigation activities

Vulnerability mitigation can take several forms, depending on the nature and severity of the vulnerability, the complexity and criticality of the vulnerable system, and even the availability of a patch. Although it may not always be possible, the preferred method is to apply the vendor-supplied patch or adjust the configuration setting to fully remediate the issue.

2.6 Metrics, reporting and compliance

A VM program should include continuous monitoring and improvement to maintain security posture against evolving threats. This includes using tools and techniques to monitor systems, perform regular assessments, and apply timely updates and patches. Metrics should evaluate the coverage, effectiveness, efficiency and compliance of the VM activities. Regular reporting on metrics will enable the organization to establish a baseline of performance. Metrics should be informed by IT service management tools so that vulnerabilities are ticketed and tracked for mitigation. Furthermore, metrics should link to a VM maturity model, which allows for a rational and transparent approach to measuring the maturity of the VM program. Maturity models assist program managers in identifying which areas are performing as desired and which areas require additional reform and investment.

Reports and dashboards enable continuous monitoring and compliance evaluation. These tools provide a snapshot of the organization’s security posture at any given moment, allowing for prompt response to emerging vulnerabilities and demonstrating adherence to regulatory requirements.

Table 2.2 outlines sample metrics.

2.7 Enabling processes

VM does not operate in isolation; it relies on a set of foundational processes that provide essential support and infrastructure. These enabling processes are critical for ensuring that vulnerabilities are identified, assessed and mitigated in a systematic and efficient manner. They create a robust framework that enhances the overall security posture of the organization by integrating various aspects of IT and security management.

The GC Enterprise Cyber Security Strategy GC Enterprise Cyber Security Strategy Annex A: Target Security Operating Model, outlines some key enabling processes that underpin a successful VM program, highlighting their roles and how they contribute to the identification, prioritization and remediation of vulnerabilities. By understanding and implementing these processes, organizations can build a comprehensive and resilient approach to managing vulnerabilities and protecting their assets.

• Change management: Change management ensures that all changes to IT systems are managed systematically by implementing policies and tools to track and document changes.
• Patch management: Patch management addresses software and hardware vulnerabilities through timely patches, regularly reviewing and applying them using automated tools.
• Configuration management: Configuration management maintains secure IT system configurations by using tools to enforce secure settings and regularly updating configurations.
• Access management: Access management controls access to IT systems to prevent unauthorized access by implementing role-based access controls and using multi-factor authentication.
• Threat intelligence: Threat intelligence involves staying informed about emerging threats and vulnerabilities by integrating threat intelligence feeds and regularly reviewing reports.
• Vendor management: Vendor management ensures that third-party vendors comply with security standards by conducting regular security assessments and including security requirements in contracts.
• Audit and compliance: Audit and compliance ensure that the organization complies with security regulations and standards by conducting regular audits and addressing any compliance gaps.
• Training and awareness: Training and awareness educate employees on security best practices and VM by developing a training program, conducting regular sessions, and providing role-specific training.

Refer to GC Enterprise Cyber Security Strategy Annex A: Target Security Operating Model for more information.

2.8 Technology considerations

For detailed information regarding the technology options and capabilities of vulnerability identification platforms, it is recommended to review NIST SP 1800-31: Improving Enterprise Patching for General IT Systems: Utilizing Existing Tools and Performing Processes in Better Ways, 1800-31B (April 2022).

Vulnerability Management Checklist

C-1: Process

The following steps should be applied when using the tool:

1. Score each risk factor.
2. Add up the scores (total out of 50 points).
3. Identify where the score is on the risk matrix for testing and remediation time frames.

Considerations when using the tool:

• Subject matter expertise is required to score factors.
• If a factor cannot be scored, then calculate the sum of other factor scores as a percentage of available points and map as follows:
  • red = 80% to 100%
  • orange = 60% to 79%
  • yellow = 40% to 59%
  • green = 1% to 39.

C-2: Risk factors

Table C.1 outlines the risk factors:

C-3: Risk factor scoring guides

The following section outlines scoring guides for several risk factors. As noted in Table C.1, the vendor risk rating and Common Vulnerability Scoring System base score are made available by the vendor and National Vulnerability Database.

C.4: Risk matrix

Table C.6 provides recommended time frames for testing and remediation of identified vulnerabilities.