Schwachstellen/en

In HITGuard a vulnerability analysis is a record of deviations from a desired target state. It is also called a "review". It is the central building block for detecting, assessing and specifically treating problems, weaknesses or deviations. This article describes how you carry out a review from initial creation to completion, how you reassess results later and how you evaluate the results.

As an expert or professional user you will find all reviews under Risk management → Vulnerabilities. You see all reviews that were created in this management system. You can create new reviews or send them out to be answered. Likewise, you can also download the reviews as a PDF or Word report.

Deviation analysis and review result

A review records the deviations from the target state. This often takes place in the form of questionnaires, whereby audit questions answered negatively are then treated as deviations. Detected deviations can be provided directly with measures (for elimination) and controls (for monitoring) and assigned to a risk.

HITGuard distinguishes two types, which run largely the same in the wizard:

• Gap analysis: A questionnaire-supported review on the basis of a knowledge base. With the structured questionnaires you can, for example, determine the degree of fulfillment of a norm. As a result, changes in the template knowledge base later impact the gap analysis, for example when the template is revised and updated. In deviation analyses, this can play a role, for example, in reassessments (see below).
• Review result: Entering findings without a template, for example from the report of an external auditor. Here you do not access a knowledge base, but enter everything - question answer and justiication - directly into the system.

Example: You enter the findings from an external pentest as a review result. If you instead want to check the maturity level according to ISO 27001 or the BSI IT-Grundschutz compendium yourself, you choose a deviation analysis with the appropriate knowledge base.

Step-by-step guide

Overview of the reviews

Regardless of the type of review, the steps in the wizard are essentially the same:

1. Create and save review
2. Add test objects and activate review
3. Answer review objects (or request answering in the self assessment)
4. Treat deviations
5. Complete review

Step 1: Create review

Under Risk management → Vulnerabilities Experts and Professionals can create reviews. To edit, double-click a review. You create a new review via the Plus button:

• Gap analysis: Click directly on the Plus button.
• Review result: Open the dropdown menu with the small triangle on the plus button and select Enter review results.

Create review – step 1

In the first step you record the master data of the review. Here we explain all fields:

Mandatory fields:

• OrgUnit: The organizational unit responsible for the review, or the organizational unit being reviewed.
• Name & description: Record here what the purpose of the review is.
• Interview partner: These are the people who give you the answers to the questions in the review. If you set "Self-Assessment" for the type of review, the users in this field later receive the e-mails that request them to answer the questions. As with the responsible person, HITGuard fills this field with the responsible person from the organizational unit. However, you can also enter any number of other regular HITGuard users.

Further fields:

• Note: Further notes, e.g. on the execution.
• Lead auditor: Main responsible person of a review. When you create the review, HITGuard automatically enters your user here.
• Co-auditors / accompaniment: Subject matter experts who are brought in to the review for special topics.
• Responsible persons: The responsible persons of the organizational unit or the area. Just as with the Interview partner field, HITGuard fills this field with the responsible person from the organizational unit.
• Start and end date: Planned time span. Every review requires both dates. For self assessments (see below) the end date is called answering deadline.
• Type: Controls how the review is carried out (see below). This setting can only be changed in the Draft status.
• Workflow plans: Shows in how many workflow plans the review occurs as active or paused. Links can be set, removed or paused here.
• Created by workflow plan: Refers to the triggering workflow, if the review was created automatically.
• Change log: Records who edited, changed the status or completed it, and when.

Type of review:

• Interview: The review is carried out together with the interview partner. The interview partner can view it, but not change it.
• Self assessment: The interview partner answers the topics independently. The lead auditor requests the answering via the Request answering button (after activation) and then reviews it.

Special fields for the Audit management add-on module::

• Audit: Links the review with an audit. If the review arises from an audit, lead auditor, interview partner as well as start and end date are pre-filled. Via the button next to it, the master data can be loaded from the audit. (See Audit planning.)
• Function: Optionally defines the context more precisely. Only appears if the option is activated under Audit management → Settings. You manage functions under Audit management → Functions.

Special fields for the Supply Chain Risk Management module:

• Supplier review:By default, only HITGuard users can be selected as interview partners. In a Supply Chain Risk Management (SRM) management system, a checkbox is available for this that marks the review as a supplier assessment. If it is active, only suppliers can be selected instead. This checkbox is only available if the option under Risk management → Settings is active and the SRM license is present.

Step 2: Add review objects

Review objects are question sets on a special topic. You add these review objects in the second step, because you want to assess them. Review objects that you have added will appear in the upper bar and may be removed there.

It is a crucial difference whether a review object is assessed for the first time (initial assessment/new creation) or whether an already existing review object is assessed again (reassessment), or whether an entirely new review object is created. Several tabs are available for this:

Initial assessment using a knowledge base (for the gap analysis)

Initial assessment using a knowledge base

In the tab Initial assessment using a knowledge base, select the desired knowledge base in the dropdown and then look for the topics that you want to assess. To add a topic, click the Plus next to it.

Note

• The plus only appears for topics that also contain review questions. If topics have no plus, they only serve to structure other topics. Expand them via the triangle arrow to see the topics contained in them.
• If the knowledge base is available in several languages, the translation matching the user language is displayed, provided there is an translation available.
• "Initial assessment" does not mean that the topic from the knowledge base is used for the first time, but only that this review is the first in the series. Let's say you have already used a knowledge base topic "Awareness" to review five other organizational units (OU). If you want to review OU Number six, you have to create the review object via this tab.

Initial assessment based on a template (only for the Audit management add-on)

In the tab Initial assessment based on a template, select the desired topic collection. With the green Plus you add all contained topics, with a white Plus individual topics. More on this under topic collections.

Note: This option is only available if the Audit management add-on is activated in the management system and the user has the required role.

Create new review object (for review results)

New creation of a test object

In the tab create new review object' you create a review object without a knowledge base. Assign a name and a responsible user and click Add new review object. With this function you can then create your own review questions in the review object. You can then enter external review results (e.g. pentest) in the questions.

Revaluation of existing review objects

Via the tab Reassessment of existing review objects you look for review objects that have already been fully assessed. instead of creating them anew, you take new versions into the review instead. The options and the exact procedure are described in the section Reassessments. Alternatively, you can also always use the Reassess button in the grid overview to reassess an entire review.

Step 3: Edit and answer review objects

Overview of review objects

After adding, you see all review objects in the overview under step 3. Here you can only adjust the order. Mark a review object with a click and move it in the order with the arrows at the top right. Save also transfers the sorting order into the left content overview.

Step 3.1: Details of a review object

Detail view of a review object

In the detail page of the individual review objects you see its header data as well as a list of the review questions assigned to it.

Core data:

• With the trash can button you remove the review object from the review again.
• The responsible person and the interview partner are taken over from the master data page (see above at step 1). However, you can also still make changes here. The interview partner is intended here purely for documentation. HITGuard will automatically take the responsible person and enter them as the measure responsible when you create measures from the review questions of this review object.
• You can link the review object with master data, i.e. the entities in the views of the structure analysis. As a result, all review questions including measures and controls are connected directly with the entity and are visible in the entity and in the structural analysis.
• With the Clarification needed switch you mark the entire review object; in doing so, all associated review questions and review results are marked as requiring clarification.

List of review questions:

• Here you see the review questions that were created from knowledge base templates.
• Via the plus button you can enter additional review results. Even if you originally created the review object from the knowledge base, you can add new questions or results here.

Detail pages of the review questions

If the review object comes from a knowledge base, you will answer the individual review questons. You will find more details in the dedicated article Answering review questions. If you instead enter review results, you will find more information here.

If you have selected the type Interview, you will answer the review questions as an Expert or Professional. If you have selected the type Self-Assessment, the Practitioner will receive the review and answer the questions independently.

• Answer: Here you can select in the drop-down to what degree you fulfill the review question. Usually this is assessed as Yes/No/Partially or as a maturity level from 1 to 5.
• Unnecessary: With this button you remove the question from the assessment. It does not apply to this review.
• Justification:Here you can, with written information, record and justify why you decided on the answer above.
• Clarification needed: Mark an review question or a review result with Clarification needed if you cannot yet determine the answer. This can happen, for example, because you have to ask another person or research information.
• Upload document:Here you can upload evidence for the answer.
• Threats, measures & controls: Via these buttons you can directly create elements that are then linked directly with the review question. You can find out more about these elements on the special pages for measures, controls & threats. If you create a measure, you can afterwards select an after value that indicates how the answer turns out after the measure has been implemented. You will find more details in the article Answering review questions. (Practitioners can only submit suggestions for measures).
• You do not have to answer all review questions or review results to complete a review. However, when completing with open questions, a warning appears.
• In the Audit management add-on you can have a second drop-down "determination type" displayed next to the answer. With it you can, for example, indicate whether it is a major or minor deviation.

Step 4: Treat deviations

Assigning deviations to a risk

A deviation is a review question with a negative answer. Specifically, HITGuard detects these negative answers as follows:
The target score is the defined target value that specifies the desired target state for review questions. It serves as a reference point to detect deviations from the ideal state. Every answer to an review question is compared with the target score. If the answer value is below the target score, the review question is considered a deviation. TO achieve this, the answers "Yes", "No" and "Partially" are translated into the numerical values "5", "1" and "3". You can define the target score in the management system.

Deviations are treated differently by HITGuard. For example, you can assign them to risks in step 4. HITGuard also detects over-fulfillments; these can be useful in opportunity management. To assign these, however, you have to navigate to Risk management > Vulnerabilities > Deviations You can link deviations and risks here in two ways:

• Select an existing risk in the dropdown below, mark the deviations and click Assign selected deviations to selected risk.
• Mark the deviations and click Create risk for review object. In the popup box you create a new risk and assign it to the deviations.
• Best practice: Since you keep the detailed overview via the deviations anyway, it is advisable to create only a few risks that cover large subject areas. Even for large organizations, a few dozen risks are usually sufficient.

Complete review

A review can be carried out by an Expert or Professional. Optionally they request the answering from the interview partner: The latter receives a request via workflow, answers the review questions and sends the review back. The Expert reviews the results and completes the review.

Treating deviations as well as linking of measures and controls is possible at any time – even after completion.

Status of a review

Change status

You change the status via the blue button at the top right. If the e-mail notifications are active in the management system, the persons relevant in the workflow are informed at every status change.

• Draft: The review has this status when first created (or when deactivated from In progress). The review is not yet active; no one has been informed. With the blue Activate review button you activate it.
• In progress: Now the review is active. Interview partners and auditors see the review under My Tasks, but cannot yet edit it. The type of review can no longer be changed now. If the type is a Self assessment, the lead auditor can, via Request answering, call on the interview partner to answer the questions. If the type is an Interview, it goes via Complete review into the status Closed. Via Deactivate review it goes back to Draft.
• Requested (only for self assessment): After Request answering. In this status the interview partners are requested by e-mail to answer the review questions. Requested self assessments are marked with a badge. Once the interview partners are finished, they set the status to Answered with Submit review.
• Answered (only for self assessment): After submission by the interview partner, the lead auditor is automatically informed by e-mail. The interview partner and the responsible person can now no longer edit the review. Via Complete review, Expert and Professional users can set the review to the status Closed.
• Closed: The review is now write-protected. No user can edit the review and the review questions in it. However, links of review questions with risks, measures, controls and threats can still be added and edited.

Changing the review type (Interview and Self-assessment): The type can only be changed in the Draft status. If the type was wrong and the review already activated, you first have to set it back to Draft via Deactivate review and then .

Tips & info

Copy review (duplicate)

Klick the button above the grid overview to create a duplicate of a review. Only the structure of the review objects is taken over – not the answers and not the linked elements such as measures or controls. The duplicate carries the addition - Copy and is created in the Draft status. The original may be in any status.

If you want to take over the answers, use a reassessment instead.

Delete review

Via Delete review you remove reviews that are not yet completed.

Note: When deleting, the review objects created via this review as well as deviations already assigned to risks are also deleted.

Navigation in the wizard

Review wizard

• Next / Back: To the next or previous step or to the next/previous review question.
• Navigation tree (left): Direct jump to the desired place. The right area always shows the review questions or review results of the selected node.
• "Review questions" checkbox (bottom left): Shows or hides the review questions in the navigation tree. The wizard remembers this setting. With review questions shown, the wizard automatically jumps back to the correct question if you have left it, for example, to create a measure or control.
• Save and Close behave self-explanatorily.

Important terms

• Review object: The object that is reviewed (e.g. a topic from a knowledge base or a freely created object). A review object contains review questions and/or review results.
• Review question: A single question from a knowledge base.
• Deviation: An review question or a review result that was assessed worse than the target state.
• Knowledge base: A structured collection of topics and review questions (e.g. on a norm).
• Organizational unit: The company area responsible for the review.
• Target Score (target state): The desired target state is called Target Score in HITGuard. It determines from when an answer is considered a deviation. An answer with No corresponds to score 1, Partially corresponds to score 3, Yes corresponds to 1. It can be set separately per management system. Only Experts or Administrators can define and change the target score under Administration → Management systems.

Reassessments

There are different options for the reassessment, which offer their respective advantages. In any case, however, the original review must be completed.

Manual reassessment with the Reassess button

Plus and Reassess button

If you select a completed review in the grid and click the Reassess button, a new protection needs analysis or vulnerability analysis is created that is based on the template of the old one. The original analysis remains untouched and write-protected in the system. This reassessment carries the addition "- Reassessment" and is created in the Draft status.

This variant is quick and simple to carry out. However, it only allows the reassessment of the entire review with all its review objects.

Reassessment with workflow plans

Button for workflow plans

A workflow plan triggers the reassessment of vulnerability analyses automatically and sends them as a self-assessment to the interview partners. In this way, reassessments can be sent out, for example, annually, in order to check whether the contents are still valid. We discuss details and general information on workflow plans on the page Workflow plans.

Workflow plans for analyses work with reassessments. When the workflow plan is triggered, it works similarly to the manual reassessment with the button. HITGuard creates a new protection needs analysis or vulnerability analysis that is based on the template of the old one. The original analysis remains untouched and write-protected in the system.

This variant lets you plan and automate reassessments in advance.

Manual reassessment of existing review objects (in the wizard)

Reassessment of existing review objects

When adding review objects you can switch to the tab Reassessment of existing review objects. Here you see all review objects that are in completed reviews. You can select the review objects that you want to reassess and then click Subject selected review objects to a reassessment.

This variant gives you more flexibility when creating the reassessment. If, for example, you want to reassess only one out of several review objects ina review, you can pick out the review object with this variant without having to revise the others.

Take over results

With the manual reassessment you have some settings that control how you use the old results.

• Current knowledge base: Knowledge bases serve as a template for the question sets in vulnerability analyses. Sometimes the template was updated after the original review was created. With this checkbox you determine whether HITGuard should use the old version of the template, or whether it should use the latest version of the knowledge base.
• Answer carry-over: Here you can decide whether HITGuard should take over all answers, no answers or only positive answers from the last review in the reassessment. This controls how thoroughly the reassessment has to be worked through.
• Justification carry-over:Regardless of whether you take over answers or not, you can take over the respective justification texts from the original review. Alternatively, you can enter a default text that HITGuard will place in every justification field.

Semi-automatic reassessment

Specifying the after value

Review questions can be linked with measures. If you create a measure, you can afterwards select an after value that indicates how the answer turns out after the measure has been implemented. (See also Answering review questions) With the semi-automatic reassessment (SAR) you can access these after values.

For the SAR, you first navigate to Risk management > Vulnerabilities > Review objects. If a linked measure was implemented (for which an after value of the vulnerability reduction was also set), HITGuard marks the affected review objects here with Reassessment recommended.

1. Start the reassessment by selecting the marked review objects and clicking the yellow reassessment button. (HITGuard will only make the button available if the review object contains measures that are already completed.)
2. HITGuard now lists the after values that you specified for the linked measures. (HITGuard only lists the review questions whose measures are already completed.)
3. With a second click on the reassessment button you complete the process. HITGuard will now create a new, already closed review with the title "Semi-Automatic Reassessment", in which the "after"-values are entered.

Semi-automatic reassessment

Overviews and evaluations

In addition to the individual reviews, HITGuard offers overarching lists in order to evaluate results across all reviews. You will find them under Risk management → Vulnerabilities via the tabs Reviews | Review objects | Deviations | Clarification needed.

Review objects

Overview of the review objects

The review object overview lists all review objects of the current management system. A click opens the detail view.

Review object detail view

There you see how the review object was answered, and – with several versions – how the assessment has developed from version to version. In this screen only the header data are editable; it is not intended for answering a review object.

Deviations

Overview of the deviations

The deviation overview shows all deviations detected during reviews. Via the columns Measure missing, Target value missing and Target value too low you recognize where too little has still been done – affected deviations receive a corresponding tag. A deviation without a tag means that everything has already been created and work is being done on remedying it.

In this overview you can also - as otherwise in step 4 - assign not-yet-assigned deviations to a risk. A double-click opens the review at the place of the deviation, where you can define measures and controls (see Answering review questions).

Optionally you show a column that indicates whether it is an review question (from a knowledge base) or a freely created review result. In this way Experts can extend their own knowledge bases by frequently added review results.

Filter deviations

Deviation filter

The filter controls which deviations are displayed – in each case in comparison to the target score:

• negative: < target score
• none: = target score
• positive: > target score

Target Score weighting

Apply target score weighting

Everywhere deviations occur, HITGuard additionally offers sorting by target score weighting. You define the target score in the management system. The greater the deviation from the target score and the higher the weighting of the protection objective, the higher the weighting:
Target score weighting = degree of deviation × weighting of the protection objective

Example (weighting of the protection objective: Medium = 3):

• Score of the deviation = 2, target score = 4 → degree of deviation = 2 → weighting = 2 × 3 = 6
• Score of the deviation = 4, target score = 4 → degree of deviation = 0 → weighting = 0 × 3 = 0

Clarification needed

Overview of the review questions / review results requiring clarification

The overview Clarification needed lists all review questions and review results that were marked as requiring clarification in the course of a review. (see Detail pages of the review questions) A click leads directly to the respective review question or review result. In this way, after a series of reviews, you see at a glance which questions still have to be researched. Via the export button (next to the search bar) you get an easily usable listing.

Important notes and best practices

Best practice

• Treat deviations directly in the analysis. The review is the central point of risk identification and treatment. Provide detected deviations already here with measures (for elimination) and controls (for monitoring). In this way, deviation, measure and control can be cleanly assigned to the identified risk. If you additionally link the review object with a structure element (e.g. an application), this information also appears in its detail view.
• Reassessment instead of new assessment. Survey the actual state regularly via a reassessment instead of creating a new analysis each time. In this way old answers and justifications remain visible and the development of a review object becomes traceable.
• Assess review objects multiple times and name them meaningfully. A review object can occur several times in an analysis. Example: The IT-Grundschutz compendium contains the module "Web applications". If you operate several web applications, answer this module per application and link it with the respective application. Tip: Assign meaningful names such as "Web application 123_Cloud" – in this way you find the review objects easily via the search during reassessments.
• Prepare self assessment correctly. A self assessment can only be completed if at least one interview partner is stored. The interview partner is also a mandatory field as soon as the review leaves the Draft status.
• Check before deleting. When deleting a review, the review objects created via it and deviations already assigned to risks are also lost. Completed reviews cannot be deleted.