On Automated and Standardized Asset, Vulnerability and Patch Management in the Power Grid

Proper and timely vulnerability and patch management depend on a comprehensive, accurate and easily maintainable asset inventory, which in turn rests on standardized and automated information gathering procedures. In practice, the information gathering process may not provide all information required to determine if a device is vulnerable and the criticality of patching it. This considerably slows down the patch processes. Challenges in information gathering arise due to the heterogeneity of devices and systems deployed in an environment like the power grid and the lack of standardized protocols across the industry. In this article, we examine existing popular protocols, and identify their deficiencies for asset information gathering. We highlight the challenges in automated vulnerability and patch management through our experiments, in which we also evaluate and compare commercial products. Following this, we propose a new schema to streamline the information gathering process and improve the consistency during information gathering across devices of various vendors, which would ultimately contribute to proper and timely vulnerability and patch management.