An Approach to Vulnerability Management
No need to do anything to make your auditor happy than to purchase the most popular scanning tool
No need to worry, when the scan is over and the report has been produced - you are all done
No need to ever leave your cube and speak directly with your system administrators
No need to ever test the scanner on a non-production network in advance
No need to worry, a clean scan means you are both compliant and secure
No need to ever leave your cube and speak directly with your application developers
No need to ever let anyone know when your scan starts, after all an attacker is not going to do that so why should you
No need to worry, if something becomes unavailable during a scan it is totally not your problem
No need to bother reviewing Critical Security Control 9 - Limitation and Control of Network Ports, Protocols, and Services
No need to show good stewardship after the purchase by producing metrics such as the percentage of findings that have been fixed as a percentage of all the findings
No need to seek data that demonstrates your scanner could serve as a platform to improve your security posture
No need to keep your boss informed of your progress, s/he would not understand
No need to divert any of your time from finding things to fixing things
No need to ever think that your scanning tool is every anything but spot on accurate
No need to hold back, it would be great if you shared your Vulnerability Management “best practices" in our comments section below
Keywords: vulnerability mangement
13 comment(s)ISC Stormcast For Thursday, June 23rd 2016 http://isc.sans.edu/podcastdetail.html?id=5053
×
![modal content]()
Diary Archives
Comments
www
Nov 17th 2022
6 months ago
EEW
Nov 17th 2022
6 months ago
qwq
Nov 17th 2022
6 months ago
mashood
Nov 17th 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Dec 3rd 2022
5 months ago
isc.sans.edu
Dec 3rd 2022
5 months ago
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.
<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
isc.sans.edu
Dec 26th 2022
5 months ago
isc.sans.edu
Dec 26th 2022
5 months ago