#Osquery vulnerability management update

Audit & Disable Unneeded Local User Accounts.While you are deep cleaning don’t neglect your client systems and take care of them. If you don’t have a centralized logging system I recommend looking at Wazuh which is based on OSSec and uses ELK. Other IoT Devices (Why not patch the coffee machine in the break room?)Īfter you get everything patched it is a good time to review your centralized logging systems and make sure you are getting all the logs you may need.

#Osquery vulnerability management update

Now is probably a good time to take some time and try to get back to the office before everyone else and update those devices that are always in use or hard to patch when people are in the office. For your internal network, I suggest looking at Rumble Network Discovery by HD More and for your external network, look at Intrigue from Jonathan Cran. One of the most important things you can do is to get a good understanding of what is actually live on your network. While we prepare for the future and potentially returning to our offices, here is a list of things you and your teams should look at “deep cleaning”. But you can’t patch them if someone is using them, and someone is always using them. This could be one of the few times (hopefully) in our career that we have time to do a reset.Ī big challenge in modern vulnerability management is that there are some assets that we never really get around to maintaining and patching. One of the biggest complaints I have had and heard as a security professional - never having the time to do the needed maintenance to systems. The other weekend, as I was out grocery shopping, I saw my favorite local Mexican restaurant with their doors propped open as they deep cleaned their restaurant.