Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Can We Talk? Finding A Common Security Language
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
JasonPolancich
JasonPolancich,
User Rank: Author
9/29/2014 | 4:58:39 PM
Re: Other Side Of The Coin
Drew,the short answer is yes.there are plenty of approches that can achieve what you describe via the buildout of the model.

creating the core, shared data model as ive described above (and storing data in it, analyzing it) is just the beginning. it isnt even necesary to look outside for a formal framework. in fact, just adding key fields and relationships to related data sets can be even more effective in an in-house solution that, for example, groups types of malware with simple, high-level incident reponse and triage procedures to serve as first-pass recipe system for moving out quickly when new malware beomes active malware.

we have seen big successes where organizations begin to track types of as-yet-unseen malware in and aorund them be able to react more quicky with mitigation by also tracking (simply, of course) what has been done in the past for similar problems. we use a simple "Polarity" metric attached to all our Actor-Target-Effect-Practice tuples, if you will, that map positive, negative or neutral to things like "security research" or "security solution" (as seen here).

this allows for quick sorting and filtering data to isolate things that may be not be active yet or may be the solution side of a problem you didnt yet know you have. what's more, it makes it easy to matrix these items into exploit knowledge bases or in-house incident respone recipes too. it's also great for surfacing to management in a way that tells them what may be out there too and show quantitatively what portion of your strategy these kinds of things occupy. simple data models can be very powerful when extended the right way and when data is collected diligently. not always a need to look outside for a solution either.

 

 
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
9/29/2014 | 3:16:59 PM
Re: Other Side Of The Coin
I agree that this is a really interesting approach to a very entrenched tech problem that goes beyond infosec. My question, however, is whether Jason has used this in practice and how long did it take for people to really start understanding each other?
Drew Conry-Murray
Drew Conry-Murray,
User Rank: Ninja
9/29/2014 | 2:57:54 PM
Other Side Of The Coin
This is an interesting idea with concrete examples. You've focused on the impact of breaches, which is a good place to start. Is there a similar concept for measuring things that didn't happen (i.e. intrusions or attacks repelled) or to measure potential risk and steps to take to mitigate it?

For instance, if you know there's malware floating around that's attacking PoS systems, but you don't yet have data to measure its impact, is there a framework to talk about mitigation (i.e. Hey, maybe we should check our PoS software and see if we're vulnerable)?
<<   <   Page 2 / 2


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-23077
PUBLISHED: 2023-02-01
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.
CVE-2023-23078
PUBLISHED: 2023-02-01
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets.
CVE-2023-22287
PUBLISHED: 2023-02-01
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE-2023-23073
PUBLISHED: 2023-02-01
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.
CVE-2023-23074
PUBLISHED: 2023-02-01
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component.