NTXISSACSC4 - Introducing the Vulnerability Management Maturity Model - VM3
Introducing the Vulnerability Management Maturity Model - VM3 The information security landscape has evolved significantly during the last 5 years with the emergence and wider use of new technologies such as Cloud, BYOD, Mobile and the Internet of Things. Alongside this landscape, corporate organizations‰Ûª key defense leaders, CIOs, CSOs and CISOs, have evolved in their information security defense strategies, as well as in how they think and approach information security. This different and evolved landscape, combined with defense leaders‰Ûª new mindset, has influenced key information security processes and in particular, has resulted in a greater understanding of the process of Vulnerability Management. This session presents a Vulnerability Management Maturity Model, referred to as VM3, and which identifies six different levels of vulnerability management maturity within which different organizations operate. Detailed findings and lessons learned from of a recent study on vulnerability management maturity are shared. The session covers the six high level activities, as well as a surrounding business environment which characterize an organization's execution of the vulnerability management process. Key challenges present within each of the six high level activities of vulnerability management, as well as challenges imposed by the organization's surrounding business environment are identified and described. Attendees will learn and appreciate how these key challenges impede one's ability to achieve higher levels of maturity, as well as strategies on overcoming these identified challenges. Attendees will learn how they may help their organization evolve to higher levels of vulnerability management maturity, with the goal of achieving lower levels of information security risk. Gordon MacKay, CISSP, Software/Systems Guru with a dash of security hacking, serves as CTO for Digital Defense, Inc. He applies mathematical modeling and engineering principles in investigating solutions to many of the challenges within the information security space. His solution to matching network discovered hosts within independent vulnerability assessments across time resulted in achieving patent-pending status for the company’s scanning technology. He has presented at many conferences including ISC2 Security Summit, Cyber Texas, BSides Detroit, BSides San Antonio, BSides Austin, BSides DFW, RSA and more, and has been featured by top media outlets such as Fox News, CIO Review, Softpedia and others. He holds a Bachelor's in Computer Engineering from McGill University and is a Distinguished Ponemon Institute Fellow.
Recomendados
Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (20)
Semelhante a NTXISSACSC4 - Introducing the Vulnerability Management Maturity Model - VM3
Semelhante a NTXISSACSC4 - Introducing the Vulnerability Management Maturity Model - VM3 (20)
Mais de North Texas Chapter of the ISSA
Mais de North Texas Chapter of the ISSA (20)
Último
Último (20)
NTXISSACSC4 - Introducing the Vulnerability Management Maturity Model - VM3
- 2. @NTXISSA #NTXISSACSC3 Overview • What is Vulnerability Management and how has it Evolved • Inside the CISO’s Mind • Vulnerability Management Challenges • Vulnerability Management Maturity Model – VM3 • Accelerating your Evolution • Bringing it all Together 2
- 3. @NTXISSA #NTXISSACSC3 Vulnerability Management - Then • Scanning the Network Once a Year • Reporting on Vulnerabilities Mountains of Data • Fixing the Issues Overwhelming Resources 3
- 4. @NTXISSA #NTXISSACSC3 Vulnerability Management - Now • Management Process Overview & Policy • Discover Assets/Applications Data Center, Cloud, Mobile • Discover Consider Business Value • Assess What? Vulnerabilities, Configuration, People • Assess How? Unauthenticated, Authenticated, DAST, SAST • Prioritize Findings Business Value, Threat Intelligence, Network Architecture • Assign Findings IT Operations • Measure Report 4
- 7. @NTXISSA #NTXISSACSC3 How Modern CISO Thinks – Real World Like a General and a Detective Hypothetical Use Case: New Zero Day Impacts Apache version 2.4.0 – 2.4.22 but fixed in 2.4.23 7 Vulnerable Then Vulnerable Now Time
- 8. @NTXISSA #NTXISSACSC3 Vulnerability Management Challenges • Too Many Vulnerabilities How to Prioritize • Where is Business Value Situational Awareness • Who Owns the Assets Many Different Teams • IT Security and IT Operations Have Different Agendas • Accuracy of Past Findings VM Intelligence 8
- 9. @NTXISSA #NTXISSACSC3 VM Challenge Scan-to-Scan Endpoint Correlation 9 time Scan Week 1 Scan Week 2 IP=192.168.40.6 DNS HN= None NETBIOS HN= Blue MAC= Alpha IP=192.168.40.7 DNS HN= Papaya@myorg.com NETBIOS HN= White MAC= Undetected IP=92.168.40.6 DNS HN=crm.myorg.com NETBIOS HN= None MAC= Undetected IP=192.168.40.5 DNS HN= None NETBIOS HN= Blue MAC= Alpha Asset A Asset B Asset C Real World Network Assets IP=192.168.40.5 DNS HN=crm@myorg.com NETBIOS HN=None MAC= Undetected
- 12. @NTXISSA #NTXISSACSC3 Vulnerability Management Maturity Major Influencing Factors • Business Environment Executive Management Participation Security Awareness Business IT Structure • Policy Risk Threshold Set Goals (SLA) • Discover & Prioritize Assets Know Your Business Critical Assets • Assess Type, Depth, Breadth, Frequency 12
- 13. @NTXISSA #NTXISSACSC3 Vulnerability Management Maturity Major Influencing Factors • Prioritize Findings • Vulnerability Severity, Asset Criticality, Threat Intelligence, Attack Path • Remediate • Who are Asset Owners? • Security Operations vs IT Operations • Remediation/Mitigation Speed? • Measure – Report • Measure/Report vs Set Goals • Measure Risk • Learn and Evolve Based on Measurements 13
- 14. @NTXISSA #NTXISSACSC3 Managed Service Vulnerability Management Can Help • Design and Build • Discover New Assets Ongoing Basis • Examine, Re-examine Business Criticality • Design, Build Assessments Varying Types, Depth, Breadth, Frequency • Operate • Prioritize Findings Understand which vulnerabilities you should take on • Managed Service Helps Bridge Gap Between Security Operations and IT Operations Teams • Report Report on what matters to you 14
- 15. @NTXISSA #NTXISSACSC3 Wrap Up • Vulnerability Management – An Evolving Process • VM Challenges • Time – Scan-To-Scan Endpoint Correlation • Prioritizing Findings • Asset Owners? • Business Communication – IT Ops vs Security Ops • Vulnerability Management Maturation Model • Higher Maturity Levels -> Lower Risk • Accelerating Your VM Evolution 15
- 17. @NTXISSA #NTXISSACSC3@NTXISSA #NTXISSACSC3 The Collin College Engineering Department Collin College Student Chapter of the North Texas ISSA North Texas ISSA (Information Systems Security Association) NTX ISSA Cyber Security Conference – October 7-8, 2016 17 Thank you