Dark Reading is part of the Informa Tech Division of Informa PLC
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
The 10 Most Impactful Types of Vulnerabilities for Enterprises TodayManaging system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Incident Readiness and Building Response Playbook
In this special report, learn the Xs and Os of any good security incident readiness and response playbook.
Tweet This
1 Comments
User Rank: Author
9/29/2014 | 4:58:39 PM
creating the core, shared data model as ive described above (and storing data in it, analyzing it) is just the beginning. it isnt even necesary to look outside for a formal framework. in fact, just adding key fields and relationships to related data sets can be even more effective in an in-house solution that, for example, groups types of malware with simple, high-level incident reponse and triage procedures to serve as first-pass recipe system for moving out quickly when new malware beomes active malware.
we have seen big successes where organizations begin to track types of as-yet-unseen malware in and aorund them be able to react more quicky with mitigation by also tracking (simply, of course) what has been done in the past for similar problems. we use a simple "Polarity" metric attached to all our Actor-Target-Effect-Practice tuples, if you will, that map positive, negative or neutral to things like "security research" or "security solution" (as seen here).
this allows for quick sorting and filtering data to isolate things that may be not be active yet or may be the solution side of a problem you didnt yet know you have. what's more, it makes it easy to matrix these items into exploit knowledge bases or in-house incident respone recipes too. it's also great for surfacing to management in a way that tells them what may be out there too and show quantitatively what portion of your strategy these kinds of things occupy. simple data models can be very powerful when extended the right way and when data is collected diligently. not always a need to look outside for a solution either.