Vulnerability management

Vulnerability Management & the Art of Prioritization of Risk – SCW #45

There was a pretty extensive discussion on the Discord server during last week's show that we thought was appropriate to discuss on air.

Josh kicked off the discussion by asking, "Anybody know any vulnerability remediation timeline guidance? Formalized, scientifically based stuff?"

Josh further clarified, "just trying to find the science behind why and when I should give a crap about vulnerabilities".

He finally stated, "I am troubled by the lack of empirically based standards of remediation timing, remediation prioritization, remediation adjustment/offsets based on compensating controls."

This launched a multi-threaded conversation that touched on vulnerability management, how to pass various compliance audits/assessments, the many vendors that have latched on to "prioritization" of vulnerabilities, or simply "Risk-Based Vulnerability Management".

Of course, PCI became a focal point for much of the discussion because of the mention of vulnerability management, compensating controls, remediation timing, etc. - all of which is addressed within the PCI DSS (despite what Quadling thinks).

We're going to try to find consensus on the problem, possible solutions (based on recognized sources), and provide advice.

Full episode and show notes

Announcements

  • It's official! Security Weekly, in partnership with CyberRisk Alliance, is excited to present Security Weekly Unlocked on December 10, 2020. The inaugural edition of Security Weekly Unlocked also celebrates Security Weekly's 15th Anniversary. Visit securityweekly.com/unlocked to submit your presentation & register for free!

  • Don't forget to check out our library of on-demand webcasts & technical trainings at securityweekly.com/ondemand.

Guest

Liam Downward
Liam Downward
CEO at CYRISMA

Liam started his career in 1998 in Dublin, Ireland and each year brought new challenges and with this where my passion of Information Security grew. In 2018, he saw that Cyber Security was becoming more complex and organizations would rather ignore risks as their budgets could not afford solutions to protect their data and CYRISMA was born.

Hosts

Jeff Man
Jeff Man
Information Security Evangelist at Online Business Systems
John Snyder
John Snyder
CEO at AGNES Intelligence
Josh Marpet
Josh Marpet
Executive Director at RM-ISAO
Scott Lyons
Scott Lyons
CEO at Red Lion
prestitial ad