The Patching Paradox: Decoding the Metrics of Remediation

The Paradox of Tracking Security Work

When it comes to cybersecurity, preventing problems before they are exploited is often easier and more cost-effective than responding to incidents. Fast patching and following best practices in cloud instances and application deployments can help eliminate vulnerabilities before attackers can take advantage of them. However, despite the clear benefits of proactive security measures, tracking and demonstrating the value of this work can be a challenge.

The Difficulty in Tracking and Demonstrating Value

For chief information security officers (CISOs) seeking to prove their value to company leadership, individual patches are often considered too small and technical to capture their attention. It is crucial to present metrics that highlight the broader impact of patching and remediation efforts over time, highlighting specific business and security problems that require attention.

One commonly used metric in the cybersecurity community is mean time to remediate (MTTR). MTTR measures the average time it takes to implement a patch after its announcement, providing an overall measure of implementation speed. However, MTTR alone does not provide detailed insights into the effort invested or the problems encountered during the patching and remediation process. Additionally, it does not differentiate between critical security vulnerabilities and minor issues.

The Limitations of MTTR

MTTR treats all types of issues equally, regardless of their severity. To address this limitation, some CISOs opt to track MTTR for critical vulnerabilities separately to demonstrate their prioritization and swift handling of serious issues. Moreover, the challenge lies in the fact that deploying a single patch may not be sufficient to address an issue entirely. Often, multiple patches, configuration changes, and alterations are necessary to consider an issue “fixed.”

Furthermore, changing the metric’s name to “mean time to reboot” can provide a clearer understanding of when the patch process is completed, especially for critical systems that require specific downtime windows. This relabeling ensures that company leadership recognizes the impact of the patching process on overall security.

Expanding Metrics for a Comprehensive View

Beyond MTTR, there are other metrics that CISOs can utilize to gain a more comprehensive understanding of the patching and remediation process. These metrics provide insights into the operational efficiency, risk prioritization, and collaboration within the organization.

Mean time to detect (MTTD) measures how quickly the security team can identify and report the current patching status, particularly when new vulnerabilities are released. MTTD reflects the team’s ability to translate external vulnerabilities, such as those issued during Patch Tuesday, into actionable internal reports.

Mean time to prioritize (MTTP) focuses on the team’s ability to prioritize issues based on their risk level. Given the multitude of patches and updates, it is essential to distinguish the critical risks from less urgent ones. MTTP assesses the team’s understanding of the organization’s assets and their ability to prioritize fixes based on deployment approaches, mitigation plans, and business operations.

Mean time to communicate (MTTC) is a new metric that measures the speed at which the security organization can collaborate with other departments responsible for IT operations and patch implementation. While the security team may identify vulnerabilities, they may not directly handle the patch deployment process. Effective communication and collaboration across teams are crucial for efficient and timely patch rollouts.

Concentrating on the Biggest Risks

It is important to note that not every update poses a significant risk. By examining the findings from Qualys’ “2023 TruRisk Research” report, it becomes evident that a vast number of potential issues do not result in exploitation. In many cases, thousands of potential problems can be narrowed down to address the most substantial risks. MTTP helps identify and prioritize the most critical vulnerabilities, ensuring that resources are allocated strategically.

Improving Collaboration and Business Alignment

Tracking MTTC not only helps IT security flag operational performance but also reveals areas where cross-team collaboration can be enhanced. Large enterprises with multiple teams responsible for specific technology areas must communicate effectively to ensure efficient deployments. MTTC can highlight potential issues related to risk and conflicting priorities, enabling the company to improve its overall performance. This can also serve as an opportunity to align teams around incentives that prioritize security and risk management in their respective goals.

Demonstrating the Value of Security to the Business

Over time, tracking the success and effectiveness of the patching and remediation process can demonstrate the value of risk management and IT security processes. It can initiate conversations about broader security attitudes, including involving security earlier in the software supply chain and development lifecycle and fostering collaboration for “secure by default” workflows.

Adoption and Implementation Challenges

To successfully track and showcase the value of security efforts, a collaborative effort is required across the entire organization. The CISO and the Chief Information Officer (CIO) must agree to adopt these metrics as the standard for managing the business and implement them across all teams. Additionally, any challenges or friction caused by deploying patches faster than the IT/operations teams prefer must be addressed. Automating the patching process can also streamline operations, allowing teams to focus on risk mitigation collectively.

Addressing these challenges requires a companywide commitment, making it a collective responsibility rather than solely burdening the CISO. By establishing and consistently utilizing the right metrics, the value of security measures can be effectively demonstrated and ingrained within the organization’s culture.