Industrialising a public financial institution's vulnerability management

The challenge

The IT department of a public financial institution had to replace its vulnerability scanning tool, and take over an existing process that was neither automated nor documented.

What we did

• Scoping, tender and negotiation, then integration of the new tool.
• Ran the vulnerability service centre: scan requests from the owners of 350 applications, planning and tracking in the ticketing tool, on-demand scans of more than 2,000 servers and devices.
• Detailed study of critical vulnerabilities (high score, proven exploitability, network exposure), fix prioritisation and input on exceptions.
• Formalised the on-demand scanning process, to make it repeatable and ease the onboarding of new analysts.
• Automated reporting for each technical owner.
• Ran the governance committees.

What changed

• A tooled, repeatable and documented vulnerability scanning process.
• Reports produced automatically for each technical owner.
• The activity taken over by the internal teams at the end of the engagement, thanks to complete documentation.