Threat and Vulnerability Management, or TVM,
provides near real-time insights that
can help you quickly discover potentially impactful threats,
vulnerabilities, and security misconfigurations
in your environment.
This video explores how to use TVM to discover and act
on this information to improve your security posture
and reduce risk.
I’ll start in the TVM dashboard.
It displays some critical information,
including the Exposure score, Secure score,
and Exposure distribution.
Exposure score reflects the overall exposure
of your machines.
Lower scores are better here.
Exposure distribution shows the amount
of machines with low, medium, and high exposure scores;
and you can select any part of the pie chart
to see a list of machines with that score.
TVM groups Secure score by categories like Application
or Security Controls.
The higher the score, the more your machines
are protected against cyber threats.
Straightforward.
You can discover recommendations to improve
the score for a particular category by selecting it.
Below the scores are the top 3 most vulnerable software
titles, and top 3 most exposed machines.
(Select Show more to see full lists of vulnerable software
and machines.)
The primary way to improve the organization’s Secure score is
by acting on TVM recommendations.
That’s coming up next.
On the TVM dashboard, you see the Top security
recommendations based on their impact to the exposure
and secure scores.
This is where I’m going to start discovery.
You’ve probably already noticed the little icons beside each
recommendation.
There are three of them.
The first is a bullseye, or target that
represents breach insights.
This indicates a recommendation that’s related to an active
alert in your organization that was generated by the EDR
component.
The second is a bug icon, representing threat insights.
It’s an indication that one or more vulnerabilities tied
to this recommendation has an external threat associated with
it.
The last is the lightbulb icon, which represents recommendation
insights.
When available, these give you insights about the provided
recommendations.
For now, I’ll select the top recommendation to see more
information about it.
That includes a description, vulnerability details,
plus individual vulnerabilities that
are addressed by following this recommendation.
And the impacted machines.
Select Remediation options to request a remediation
for this recommendation.
You have the option to open a ticket directly
in Microsoft Endpoint Manager or ServiceNow,
making it easy to communicate with the IT team
to get this configuration change applied.
If I want to create an exception for this recommendation—maybe I
need more time to consider it—I can select Exception options.
It prompts me for justification, context information,
and how much time I need for the exception.
Selecting Open software page takes me
to the full software details, including quite a bit
of additional information.
You can see all the related recommendations,
discovered vulnerabilities, the machines
which have it installed, and the version distribution
in your environment.
Coming up, I’ll demonstrate how to keep track of your TVM
remediations and exceptions.
How do you keep track of all your remediation actions
and exceptions?
TVM has a solution for that.
Open Remediation in Threat and Vulnerability Management.
Through integration with Endpoint Manager
and ServiceNow, the Remediation activities tab
provides continuous updates on the progress
of each remediation activity.
And once all systems have been updated,
it automatically marks the activity as completed.
The Exceptions tab provides a list of exceptions.
In either case, select an item to view more information
about it in the side pane.
In the next segment, I’ll show how to examine weaknesses
in your environment by using TVM.
The Weaknesses page provides a list
of all known vulnerabilities.
There are thousands of them, but filtering the list
helps to prioritize it for the task at hand.
In this case, I’m interested in critical,
recent vulnerabilities that specifically affect
my organization.
Select a vulnerability to see its details,
including a description, it’s severity,
and the related software.
At the bottom of the vulnerability’s details side
pane, you see a list of the machines exposed to this
vulnerability; and you can quickly pivot from
the vulnerability to an exposed machine for more information
about it.
On the machine details page, notice that there
are some familiar tabs?
We’ll look at those next.
Machine detail pages provide TVM-related information
specific to the selected machine.
This is especially helpful during investigations
or when improving the security posture of high-value machines.
First, the Security recommendations tab
offers an all-up view of the security recommendations
for the machine.
Second, the Discovered vulnerabilities tab
shows any unmitigated CVEs.
And last, the Missing KBs tab shows updates missing from it.
Remediating these issues will improve the security posture
of the machine, reducing its exposure
and contributing to a higher overall secure score.
TVM offers near real-time insights
that help you to quickly discover
potentially impactful threats, vulnerabilities, and security
misconfigurations in your environment.
And integration with Endpoint Manager and Service
Now helps to make their remediation simpler.
For more information, see the TVM documentation
on Microsoft Docs.