18-011 TT - Vulnerability Management

Information Security Services (ISS) is a group within the University’s central IT department, Information Systems and Technology (IST). The Security Operations Centre (SOC) is a part of ISS, and is comprised of two staff members. The campus vulnerability management program falls under the SOC’s regular operations.
 
UWaterloo’s SOC is seeking to acquire a state-of-the-art system for helping to manage the campus vulnerability management program.
 
The vulnerability management program was largely stagnant for several years. It is being revamped, with new internal procedures and use-cases. The current system is running with a combination of QualysGuard Vulnerability Management and in-house systems centered on open-source solutions.
 
We would like to examine market offerings and determine if our tooling and policies are consistent with a modern vulnerability management program. The RFP to acquire the current system was in 2010, so we would like to gather more current information and decide on the sustainability of the current program using existing toolsets.