Scw45

From Security Weekly Wiki
Jump to navigationJump to search

Security and Compliance Weekly Episode #45 - September 29, 2020

Subscribe to all of our shows and mailing list by visiting: https://securityweekly.com/subscribe

1. Data Centric Security - 12:00 PM-12:30 PM


Visit https://securityweekly.com/cyrisma for more information!


Announcements

  • Would you like to have all of your favorite Security Weekly content at your fingertips? Do you want to hear from Sam & Andrea when we have upcoming webcasts & technical trainings? Have a question for one of our illustrious hosts, someone from the Security Weekly team, or wish you could “hang” out with the Security Weekly crew & community? Subscribe on your favorite podcast catcher, sign up for our mailing list, and join our Discord Server to stay in the loop on all things Security Weekly! Visit: https://securityweekly.com/subscribe

  • Do you have a specific guest or topic that you want us to cover on one of the shows? Submit your suggestions for guests by visiting https://securityweekly.com/guests and completing the form! We review suggestions monthly and will reach out to you once reviewed!

Description

Do we know where our sensitive data is located? Is the system that hosts this data free from vulnerabilities, and is it securely configured? How do we assign accountability through mitigation plans to meet compliance mandates?

This segment is sponsored by CYRISMA.

Visit https://securityweekly.com/cyrisma to learn more about them!



Guest(s)

Liam Downward

Liam started his career in 1998 in Dublin, Ireland and each year brought new challenges and with this where my passion of Information Security grew. In 2018, he saw that Cyber Security was becoming more complex and organizations would rather ignore risks as their budgets could not afford solutions to protect their data and CYRISMA was born.


Hosts

2. Vulnerability Management & the Art of Prioritization of Risk - 12:30 PM-01:00 PM


Announcements

  • It’s official! Security Weekly, in partnership with CyberRisk Alliance, is excited to present Security Weekly Unlocked on December 10, 2020. The inaugural edition of Security Weekly Unlocked also celebrates Security Weekly’s 15th Anniversary. Registration and call for speakers is now open. Visit securityweekly.com/unlocked to submit your speaking session and register for free!

  • In our October 22nd technical training, we will provide a first look at a new, free resource that delivers thousands of remedies as a service to bridge the gap between vulnerabilities found, and vulnerabilities fixed! Visit https://securityweekly.com/webcasts to see what we have coming up! Or visit securityweekly.com/ondemand to view our previously recorded webcasts!

Description

There was a pretty extensive discussion on the Discord server during last week's show that we thought was appropriate to discuss on air.

Josh kicked off the discussion by asking, "Anybody know any vulnerability remediation timeline guidance? Formalized, scientifically based stuff?"

Josh further clarified, "just trying to find the science behind why and when I should give a crap about vulnerabilities".

He finally stated, "I am troubled by the lack of empirically based standards of remediation timing, remediation prioritization, remediation adjustment/offsets based on compensating controls."

This launched a multi-threaded conversation that touched on vulnerability management, how to pass various compliance audits/assessments, the many vendors that have latched on to "prioritization" of vulnerabilities, or simply "Risk-Based Vulnerability Management".

Of course, PCI became a focal point for much of the discussion because of the mention of vulnerability management, compensating controls, remediation timing, etc. - all of which is addressed within the PCI DSS (despite what Quadling thinks).

We're going to try to find consensus on the problem, possible solutions (based on recognized sources), and provide advice.


https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-39.pdf

https://www.mitre.org/publications/systems-engineering-guide/acquisition-systems-engineering/risk-management/risk-impact-assessment-and-prioritization

https://gcn.com/blogs/cybereye/2017/07/nist-risk-prioritization.aspx

https://www.tenable.com/blog/5-tips-for-prioritizing-vulnerabilities-based-on-risk

https://www.darkreading.com/vulnerabilities---threats/vulnerability-management/vulnerability-prioritization-are-you-getting-it-right/a/d-id/1338519

https://securityintelligence.com/articles/how-to-identify-prioritize-and-remediate-your-biggest-security-vulnerabilities/


Guest(s)

Liam Downward

Liam started his career in 1998 in Dublin, Ireland and each year brought new challenges and with this where my passion of Information Security grew. In 2018, he saw that Cyber Security was becoming more complex and organizations would rather ignore risks as their budgets could not afford solutions to protect their data and CYRISMA was born.


Hosts

Jeff Man's Content:

Template:SCW45TopicJeffMan

John Snyder's Content:

Template:SCW45TopicJohnSnyder

Josh Marpet's Content:

Template:SCW45TopicJoshMarpet

Scott Lyons's Content:

Template:SCW45TopicScottLyons