1 of 8

In With the New,

Out with the Old

Maddie Osei: Information Security and Business Analyst

Vladimir Baghdasaryan: Incident Response Security Specialist

June 18^th, 2024

Addressing Cybersecurity Vulnerability Risks and Managing Legacy System Vulnerabilities in the University

2 of 8

Overview and Objectives

Overview

In today's fast-paced tech world, universities face a dual challenge:
Addressing emerging vulnerability risks while managing the vulnerabilities inherent in legacy systems

Objectives

Understand vulnerabilities
Explore mitigation strategies and approaches including communication
Gain insights into new findings and emerging threats
Brainstorm actionable strategies to fortify institutions.

3 of 8

We have many types including Software vulnerabilities, Configuration vulnerabilities and Human vulnerabilities!

On April 2024, a critical vulnerability was identified in the PAN-OS GlobalProtect Gateway, a widely used security software application for firewalls.

On May 22, 2024 - Veeam Backup Enterprise Manager prior to version 12.1.2.172 could allow an unauthenticated attacker to log in to the web interface as any user.

Real-life examples from universities:

Stories of vulnerabilities affecting users and institutions

Types and examples of Vulnerabilities (Institution and User Stories):

What is Vulnerability Management?

Vulnerability Management is the process of identifying, evaluating, treating, and reporting on security vulnerabilities in systems and the software that runs on them.

Why is it Crucial for Universities?

Protects sensitive academic and personal data
Ensures compliance with legal and regulatory requirements
Maintains the integrity and availability of IT services as well as preventing reputational damage.

What is Vulnerability?

Vulnerabilities are essentially holes in our environment, just like a Swiss cheese.
Such as misconfigurations, software defects, physical security issues and legacy applications.

4 of 8

Critical Asset Prioritization and Remediation Strategies

Identifying and Inventorying Critical Assets:

Conduct thorough asset inventory audits.
Categorize assets based on their criticality to operations.
Use tools and software for accurate asset tracking.

Prioritizing Vulnerabilities: How do we determine which vulnerabilities to address first?

Assess the potential impact of each vulnerability.
Use risk assessment frameworks to prioritize.
Focus on vulnerabilities that pose the greatest threat to critical assets.

Remediation Strategies:

Develop a remediation plan for each prioritized vulnerability.
Monitor and reassess vulnerabilities regularly by establishing the need to create plans for regular patch management as an integrated process in IT ops.

5 of 8

Cyber Security Awareness and Communication

Proactive vendor monitoring for zero-day vulnerabilities

Regularly update staff and students on vulnerabilities by using multiple channels: websites, listservs, newsletters.

Raising Awareness on Vulnerabilities and Advisories/ Communication Channels:

6 of 8

Challenges and Pitfalls in Vulnerability Management

Communication gaps between IT and other departments.

Ensuring timely updates and patches

Legacy systems/applications and their limitations

Difficulties in implementing new guidelines

7 of 8

Questions on Maturity and Asset Inventory:

Discuss the maturity of vulnerability management practices

Tips on building and leveraging asset inventories

Highlight best practices from audience contributions

8 of 8

Thank You

Maddie Osei:

m.osei@utoronto.ca

Vladimir Baghdasaryan: vlad.Baghdasaryan@utoronto.ca

For any questions, please reach out to Omar Khan: @omarkhan.khan@mail.utoronto.ca

June 18^th, 2024