From my Gartner Blog - The New Vulnerability Management Guidance Framework

After a huge delay I can finally announce that the new version of our Vulnerability Management Guidance Framework is out! Although it is a refresh of a document that has gone through many updates (even before my Gartner time), this one has some very nice new stuff to mention. First, we refreshed our VM cycle and it’s closer to the reality of most organizations now:

This versions includes a revamped prioritization section, as well as some additional content on vulnerability assessment options. In the past we left most of the VA content for another document, but now it’s back to the VM guidance.

Some interesting pieces of this version:

• One of the most common ways to fail at VM is by simply sending a report with thousands of vulnerabilities to the operations team to fix. Successful VM programs leverage advanced prioritization techniques and automated workflow tools to streamline the handover to the team responsible for remediation.
• Organizations adopting DevOps practices must adopt an approach integrated to continuous integration/continuous delivery (CI/CD) cycles and addressing issues at preproduction stages.
• Include the identification of underlying issues as one of the main objectives of the VM process. Although it is still important to find and address individual vulnerabilities, VM should also provide insight into areas that need to be improved in the organization’s security posture.
• [On VA scanning frequency] The ultimate frequency goal should reflect the value of providing refreshed vulnerability data to consumer processes, such as patching and security monitoring. If those processes will not benefit from more frequent scans, there is really no point in trying to achieve a higher frequency.
• Mitigation can often be the first line of defense, especially if it can be implemented quickly. However, mitigated vulnerabilities are not gone. They still need to be fixed eventually.
• All exceptions must have an expiration date. Do not allow indefinite exceptions.

In general, it’s a far clearer document and easy to read now. Thanks Anna Belak for your magical wordsmithing powers!

We are always looking for detailed feedback on our papers. Feel free to drop some comments here if you read the doc.

The post The New Vulnerability Management Guidance Framework appeared first on Augusto Barros.

from Augusto Barros https://ift.tt/2JlGOKL
via IFTTT

From my Gartner Blog - Our New Research on Incident Response Has Been Published

We finally managed to publish our great new (in fact, refreshed) document on preparing for incident response, “How to Implement a Computer Security Incident Response Program”.

This is the first document of my colleague Michael Clark, who did a terrific job of modernizing some stuff from a long time ago.

Some interesting pieces from this guidance document:

 

Organizations that practice their incident response program find gaps and areas for improvement. Certain exercises also make the computer security incident response team (CSIRT) more comfortable and better equipped when an incident occurs.

Include all the locations and services where your assets and data reside in the plan. This includes SaaS and company-controlled cloud assets. Many high-profile breaches involve elements outside the organization’s perimeter

Detections that must be addressed are inevitable. Organizations are often forced into a response mode by attackers and third-party breach notifications.

As usual, we are always looking for detailed feedback on our papers. Feel free to drop some comments here if you read the doc.

The post Our New Research on Incident Response Has Been Published appeared first on Augusto Barros.

from Augusto Barros https://ift.tt/2IRhDza
via IFTTT