Security Performance Management
Continuous Monitoring
Cyber Insurance
National Cybersecurity

Articles in this section

See more

Server Software Risk Vector

Avatar
Ingrid
Follow
  • August 16, 2023: New Grading & Finding Behavior sections.
  • May 11, 2020: Updated risk vector description.

⇤ Diligence Risk Category

The Server Software risk vector tracks security problems introduced by software that are no longer supported. Supported software gets attention from the development team and vendor, so they can address bugs and vulnerabilities that are discovered.

This data can be used to create a rich picture about the software used by an organization, making it simple to maintain a robust, up-to-date array of server software applications in an organization’s IT infrastructure.

Learn more:

Risks

  • Leaves bugs and vulnerabilities unpatched.
  • Exposes organizations to software bugs that can be exploited by attackers and may disrupt business continuity.

Grading

See how the Server Software risk vector is graded.

Concept Behavior
Lifetime 60 Days
No Findings

– “A” Letter Grade

The use of server software is not required to improve an organization’s cyber security posture. Therefore, there’s no penalty or negative impact to the rating in the absence of Server Software findings.

Weight

(Out of 70.5% in Diligence)

 2%

Remediation

Review Server Software findings.

  • Identify out-of-date server software installations and update them.
  • Ensure the organization has critical server software set to auto-update, if applicable, and if some of the organization’s production applications depend on certain unsupported versions, their software development teams will need to integrate the newer versions into their code base.
  • Consult your operating system vendors’ software repositories and release notes for more information on supported server software for your organization.

Finding Behavior

Concept Behavior
Refresh

Automated: 8 Days

User-Requested: 2-3 Days
Remediated

A new finding is created and the old one needs to complete its lifetime.

The refresh status of the old finding becomes Asset Not Reached.

  • New findings immediately impact the grade.
  • Updated findings won’t necessarily improve the grade.
  • All BAD and WARN findings will stop impacting the grade after the last observation, as it completes its lifetime (60 days).

Related articles