Vulnerability Management as a Service (VMaaS)

There are tens of thousands known vulnerabilities and each year the list grows larger. Our VMaaS service centres around the continuous identification, prioritisation and remediation tracking of security vulnerabilities and critical infrastructure configuration weaknesses. This allows our clients’ IT and Security Teams to focus on timely remediation of those security weaknesses that pose the greatest risk to the business.

Asset Discovery & Classification

  • Maintain a database representation of all IT assets in the environment.
  • Periodically refresh the asset database to ensure complete coverage
  • Classify assets based on criteria that enable a strategic, prioritized approach to vulnerability management.
  • Periodically review classification to ensure accuracy of prioritization.

Threat Modelling

Based on an asset class, identify the top threats, and threat agents that class of assets is most sensitive to, linked to the attack vector most likely to be exploited by a would-be cyber-criminal.

Periodically update the model in line with the ever-changing threat landscape

Firewall Assurance

  • Provide a consolidated view of all Firewalls (and IPS’) and their compliance to policy: Rule Set and Configuration
  • Optimise firewall Rule Sets and drive the remediation of shadowed and redundant rules
  • Facilitate change tracking of Firewall Rule Set changes
  • Provide workflow for firewall rule-set changes and rule-set certification

Network Assurance

  • Extend policy compliance to network devices including Routers, Switches, Load Balancers and Proxies
  • Maintain an up-to-date view of network topology based on current network configuration
  • Perform access path analysis to discover exposures and vulnerabilities associated with poor network configuration

Vulnerability Control

  • Execute continuous vulnerability scanning
  • Perform vulnerability analytics for context and prioritisation
  • Map vulnerabilities against Threat Intelligence sources to assist with prioritisation
  • Conduct virtual attack simulations to understand the exposures associated with identified vulnerabilities

Remediation Tracking

Drive and track remediation of vulnerabilities

Provide trend reports to gauge program effectiveness

Provide advice on mechanisms to mitigate against exposures including:

  • Detection of exploitation attempts
  • Blocking access
  • Patching
  • Accepting the risk

Maintain a record of unmitigated exposures and rationale applied to risk acceptance

Contact us

Busi Mathe

Partner, PwC South Africa

Tel: +27 (0) 11 797 4875

Junaid Amra

Partner, PwC South Africa

Tel: +27 (0) 82 953 9325

Follow us