VRDA Vulnerability Response Decision Assistance
|
|
|
- Meagan Gordon
- 8 years ago
- Views:
Transcription
1 VRDA Vulnerability Response Decision Assistance Art Manion CERT/CC Yurie Ito JPCERT/CC EC2ND Carnegie Mellon University
2 VRDA Rationale and Design 2
3 Problems Duplication of effort Over 8,000 vulnerability reports in 2007 Various sources, formats, languages, contents, levels of detail, accuracy, comprehensibility Collection and analysis requires significant effort 3
4 Problems (2) Inconsistent response decisions Analysts may disagree Analysts apply personal prejudices Decisions may not represent organizational values 4
5 Problems (3) Existing metrics insufficient Most metrics output global severity values One size does not fit all. Common Vulnerability Scoring System (CVSS) Contains environmental metrics Focus on base score Values vary by organization May respond differently to the same vulnerability Use different software Use the same software in different ways Value information assets differently 5
6 Solution VRDA proposes to answer the question: How do I best respond to a given vulnerability report? Goals Record vulnerability data in structured format Support individualized response decision Transition organizational knowledge from human analysts to VRDA Improve response accuracy and consistency Reduce duplication of effort 6
7 Audience System administrators Operational responsibility for fixing systems CSIRTs Provided advice to system administrators, users Vendors Product security response teams Anybody regularly responding to vulnerability reports 7
8 Operational Concept 8
9 Components Decisions to make: Tasks Vulnerability representation: Facts Product usage: LAPTs Encoding decision-making: Decision Model 9
10 Tasks Decisions an organization must make Specific to each VRDA user Example tasks Publish an advisory Initiate patch process Implement workaround Ignore (don t expend effort on low priority vulnerabilities) 10
11 Facts Properties of vulnerabilities and their environment Assertions based on available information Vulnerability Facts inherent technical attributes World Facts about environment Constituency Facts specific to VRDA user organization Balance accuracy, completeness, granularity, cost 11
12 LAPTs Lightweight Affected Product Tags Problem: Constituency facts cannot be given to you LAPTs identify products affected by vulnerability Facilitates lookup of constituency facts External feed provides LAPTs for each vulnerability Cross-reference with your database 12
13 Decision Model Represents individualized decision-making behavior Expert system encoding organizational values Decision trees 13
14 Decision Model (2) Why decision trees? Observable, understandable Can be created and refined by hand Model creation Design initial model from experience Create empirical model based on recorded data 14
15 Related Work Structured vulnerability descriptions Common Vulnerability Scoring System (CVSS) Open Source Vulnerability Database (OSVDB) Open Vulnerability and Assessment Language (OVAL) Advisory exchange formats Common Announcement Interchange Format (CAIF) EISPP Common Advisory Format Description Deutsches Advisory Format (DAF) VULnerability Data publication and Exchange Format (VULDEF) System information Common Model of System Information (CMSI) Common Product Enumeration (CPE) 15
16 Related Work (2) Severity metrics Common Vulnerability Scoring System (CVSS) Security Content Automation Protocol (SCAP) National (US) Institute of Standards and Technology (NIST), MITRE Set of vulnerability management and compliance standards (CVE, CCE, CPE, CVSS, XCCDF, OVAL) 16
17 VRDA Usage with KENGINE 17
18 KENGINE VRDA implementation developed by JPCERT/CC Intend to open-source KENGINE provides consistent analysis and reasoning action Other KENGINE functions Task management LAPT management Decision tree management Reporting KENGINE Minimum resources to handle the maximum number of vulnerabilities 18
19 Deployment Interview user organization Determine all possible tasks Identify task dependencies Mandatory/conditional actions do not involve choice, not tasks Determine facts Select only facts necessary to make decisions about tasks Develop decision model Teach/train the system using sample VRDA data and choosing appropriate tasks Create or modify decision trees manually 19
20 Usage CERT/CC, JPCERT/CC publish vulnerability facts (metrics) User determines tasks, creates decision model, provides userspecific facts (metrics) KENGINE gives prioritized response decision Compare VRDA decisions with actual response, adjust decision model as necessary Graphic on all three slides with parts highlighted 20
21 Usage Get or create VRDA data CERT/CC and JPCERT/CC publish fact feeds Score organization-specific facts Process vulnerability reports Use the decision model Record actual decisions 21
22 Feedback Compare recommendations with actual decisions Refine decision making process Update decision model Facts may be missing or inaccurate Tasks may be missing 22
23 JPCERT/CC Operation Feed back Incident Reports Vulnerability Reports Traffic Monitoring Public monitoring Analysis Special Communication Alert JVN International CSIRT FIRST APCERT CERT/CC CPNI Vendors Hardware/software vendors, SIers Japanese partners ISPs, Organization CSIRTs Public info Security site, Community, media Incident Reports System Admin Web admin Weekly Report Workshop, awareness program Monitoring Validation Categorize Data store Triage escalation publish Feedback 23
24 JPCERT/CC Facts 1. Impact Constituency Facts Vulnerability Facts 2. System Importance in Japan 3. System Population in Japan World Facts 4. Usage by critical infrastructure 5. Impact to internet infrastructure 6. Access requirement 7. How complicated is the attack? 8. Incident/attack activity 9. Information accessibility (public or private report) 10. Confidence in the information source 11. Availability of remediation (patch/countermeasures) 12. Usage by JPCERT 24
25 Feed Operation Feed service provider Internet Intranet CSIRT users FS #2 connector Feed reader adapter FS #3 connector FS #1 FS #4 connector Light users Feed reader connector Feed reader View as web page Developers, heavy users OSS base KENGINE Data format might also available in other XML based format connector tool OSS base tool 25
26 KENGINE 26
27 Vulnerability Reports 27
28 Vulnerability Report Detail 28
29 LAPT Management 29
30 Task Workflow 30
31 Decision Tree 31
32 Task Deviation Report 32
33 Progress Report 33
34 Handling Volume Report 34
35 Future KENGINE availability JPCERT/CC intends to provide open-source Documented in Japanese and English JPCERT/CC VRDA data feeds with vulnerability and world facts Pilot program in progress Deployment consulting CERT/CC Developing pilot program Considering integration into workflow and products 35
36 More Information Art Manion Yurie Ito 36
How To Use A Policy Auditor 6.2.2 (Macafee) To Check For Security Issues
Vendor Provided Validation Details - McAfee Policy Auditor 6.2 The following text was provided by the vendor during testing to describe how the product implements the specific capabilities. Statement of
Security Content Automation Protocol for Governance, Risk, Compliance, and Audit
UNCLASSIFIED Security Content Automation Protocol for Governance, Risk, Compliance, and Audit presented by: Tim Grance The National Institute of Standards and Technology UNCLASSIFIED Agenda NIST s IT Security
BMC Client Management - SCAP Implementation Statement. Version 12.0
BMC Client Management - SCAP Implementation Statement Version 12.0 BMC Client Management - SCAP Implementation Statement TOC 3 Contents SCAP Implementation Statement... 4 4 BMC Client Management - SCAP
Secunia Vulnerability Intelligence Manager (VIM) 4.0
Secunia Vulnerability Intelligence Manager (VIM) 4.0 In depth Real-time vulnerability intelligence brought to you on time, every time, by Secunia s renowned research team Introduction Secunia is the world-leading
Secure Content Automation Protocol (SCAP): How it is increasingly used to automate enterprise security management activities
Secure Content Automation Protocol (SCAP): How it is increasingly used to automate enterprise security management activities Sean Barnum sbarnum@mitre.org September 2011 Overview What is SCAP? Why SCAP?
Federal Desktop Core Configuration (FDCC)
Federal Desktop Core Configuration (FDCC) Presented by: Saji Ranasinghe Date: October, 2007 FDCC Federal Desktop Core Configuration (FDCC) Standardized Configuration with Hardened Security Settings to
Organizational internal computer security incident responding structure : CSIRT
Organizational internal computer security incident responding structure : CSIRT JPCERT Coordination Center, Japan Manager of Watch and Warning Group Keisuke Kamata Agenda Concept of Incident response.
6. Exercise: Writing Security Advisories
CERT Exercises Toolset 49 49 6. Exercise: Writing Security Advisories Main Objective Targeted Audience Total Duration Time Schedule Frequency The objective of the exercise is to provide a practical overview
SCAP for VoIP Automating Configuration Compliance. 6 th Annual IT Security Automation Conference
SCAP for VoIP Automating Configuration Compliance 6 th Annual IT Security Automation Conference Presentation Overview 1. The Business Challenge 2. Securing Voice over IP Networks 3. The ISA VoIP Security
Secunia Vulnerability Intelligence Manager
TECHNOLOGY AUDIT Secunia Vulnerability Intelligence Manager Secunia Reference Code: OI00070-076 Publication Date: July 2011 Author: Andy Kellett SUMMARY Catalyst Secunia Vulnerability Intelligence Manager
How To Monitor Your Entire It Environment
Preparing for FISMA 2.0 and Continuous Monitoring Requirements Symantec's Continuous Monitoring Solution White Paper: Preparing for FISMA 2.0 and Continuous Monitoring Requirements Contents Introduction............................................................................................
Enhancing Security for Next Generation Networks and Cloud Computing
V1.0 Enhancing Security for Next Generation Networks and Cloud Computing Tony Rutkowski Yaana Technologies Georgia Tech ITU-T Q.4/17 Rapporteur ETSI Workshop 19-20 January 2011 Sophia Antipolis, France
An Enterprise Continuous Monitoring Technical Reference Architecture
An Enterprise Continuous Monitoring Technical Reference Architecture 12/14/2010 Presenter: Peter Mell Senior Computer Scientist National Institute of Standards and Technology http://twitter.com/petermmell
Security compliance automation with Red Hat Satellite
Security compliance automation with Red Hat Satellite Matt Micene Solution Architect, DLT Solutions @cleverbeard @nzwulfin Created with http://wordle.net Compliance is a major problem About half of the
Penetration Testing Guidelines For the Financial Industry in Singapore. 31 July 2015
For the Financial Industry in Singapore 31 July 2015 TABLE OF CONTENT 1. EXECUTIVE SUMMARY 3 2. INTRODUCTION 4 2.1 Audience 4 2.2 Purpose and Scope 4 2.3 Definitions 4 3. REQUIREMENTS 6 3.1 Overview 6
Massively Scaled Security Solutions for Massively Scaled IT
Massively Scaled Security Solutions for Massively Scaled IT Michael Smith, SecTor 2009 Who is Michael Smith? 8 years active duty army Graduate of Russian basic course, Defense Language Institute, Monterey,
Automating Compliance with Security Content Automation Protocol
Automating Compliance with Security Content Automation Protocol presented by: National Institute of Standards and Technology Agenda Information Security Current State Security Content Automation Protocol
An Approach to Vulnerability Management, Configuration Management, and Technical Policy Compliance
An Approach to Vulnerability Management, Configuration Management, and Technical Policy Compliance Presented by: John Banghart, Booz Allen Hamilton SCAP Validation Project Lead Thoughts on Current State
Continuous Monitoring
Continuous Monitoring The Evolution of FISMA Compliance Tina Kuligowski Tina.Kuligowski@Securible.com Overview Evolution of FISMA Compliance NIST Standards & Guidelines (SP 800-37r1, 800-53) OMB Memorandums
Building CSIRT Capabilities
Building CSIRT Capabilities CERT CSIRT Development Team CERT Training and Education Center CERT Program Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 2005 by Carnegie Mellon
Welcome to Modulo Risk Manager Next Generation. Solutions for GRC
Welcome to Modulo Risk Manager Next Generation Solutions for GRC THE COMPLETE SOLUTION FOR GRC MANAGEMENT GRC MANAGEMENT AUTOMATION EASILY IDENTIFY AND ADDRESS RISK AND COMPLIANCE GAPS INTEGRATED GRC SOLUTIONS
Building a Data Quality Scorecard for Operational Data Governance
Building a Data Quality Scorecard for Operational Data Governance A White Paper by David Loshin WHITE PAPER Table of Contents Introduction.... 1 Establishing Business Objectives.... 1 Business Drivers...
FDCC & SCAP Content Challenges. Kent Landfield Director, Risk and Compliance Security Research McAfee Labs
FDCC & SCAP Content Challenges Kent Landfield Director, Risk and Compliance Security Research McAfee Labs Where we have been 1 st Security Automation Workshop nearly 20 people in a small room for the day
Continuous security audit automation with Spacewalk, Puppet, Mcollective and SCAP
Continuous security audit automation with Spacewalk, Puppet, Mcollective and SCAP Vasileios A. Baousis (Ph.D) Network Applications Team Slide 1 Agenda Introduction Background - SCAP - Puppet &Mcollective
AHS Flaw Remediation Standard
AGENCY OF HUMAN SERVICES AHS Flaw Remediation Standard Jack Green 10/14/2013 The purpose of this procedure is to facilitate the implementation of the Vermont Health Connect s security control requirements
Security Information and Event Management
Security Information and Event Management sponsored by: ISSA Web Conference April 26, 2011 Start Time: 9 am US Pacific, Noon US Eastern, 5 pm London Welcome Conference Moderator Phillip H. Griffin ISSA
STIGs,, SCAP and Data Metrics
Defense Information Systems Agency A Combat Support Agency STIGs,, SCAP and Data Metrics Roger S. Greenwell, CISSP, CISA, CISM Technical Director / Capabilities Implementation Division DISA Field Security
Software Vulnerability Assessment
Software Vulnerability Assessment Setup Guide Contents: About Software Vulnerability Assessment Setting Up and Running a Vulnerability Scan Manage Ongoing Vulnerability Scans Perform Regularly Scheduled
Guide to Enterprise Patch Management Technologies
NIST Special Publication 800-40 Revision 3 Guide to Enterprise Patch Management Technologies Murugiah Souppaya Karen Scarfone C O M P U T E R S E C U R I T Y NIST Special Publication 800-40 Revision 3
ICT Security Cybersecurity CYBEX Overview of activities in ITU-T with focus on Study Group 17
ICT Security Cybersecurity CYBEX Overview of activities in ITU-T with focus on Study Group 17 TSB Briefing to the Regional Offices, 28 Feb 2011 Martin Euchner Advisor of ITU-T Study Group 17 Martin.Euchner@itu.int
Towards Unifying Vulnerability Information for Attack Graph Construction
Towards Unifying Vulnerability Information for Attack Graph Construction Sebastian Roschke Feng Cheng, Robert Schuppenies, Christoph Meinel ISC2009-2009-09-08 Internet-Technologies and -Systems Prof. Dr.
EFFECTIVE VULNERABILITY SCANNING DEMYSTIFYING SCANNER OUTPUT DATA
EFFECTIVE VULNERABILITY SCANNING DEMYSTIFYING SCANNER OUTPUT DATA Paul R. Lazarr, CISSP, CISA, CIPP, CRISK Sr. Managing Consultant, IBM Cybersecurity and Biometrics January 21, 2016 PERSONAL BACKGROUND
Pragmatic Metrics for Building Security Dashboards
SESSION ID: GRC-W03 Pragmatic Metrics for Building Security Dashboards James Tarala Principal Consultant Enclave Security @isaudit Problem Statement What s measured improves. Peter Drucker In an era of
DNS Security Survey for National Computer Security Incident Response Teams December 2010
DNS Security Survey for National Computer Security Incident Response Teams December 2010 Summary As referenced during the ICANN meeting in Brussels, Belgium in June 2010, ICANN developed a survey on DNS
SACM Vulnerability Assessment Scenario IETF 94 11/05/2015
SACM Vulnerability Assessment Scenario IETF 94 11/05/2015 What is it? Walks through an automated enterprise vulnerability assessment scenario Begins with an enterprise ingesting a vulnerability report
State of South Carolina Policy Guidance and Training
DRAFT For Discussion Purposes Only State of South Carolina Policy Guidance and Training Policy Workshop All Agencies Information Systems (IS) Acquisitions, Development, and Maintenance Policy April/May
Regional Seminar on Cyber Preparedness ITU s work in Cybersecurity and Global Cybersecurity Index (GCI)
Regional Seminar on Cyber Preparedness Organised by World Bank Group, Financial Sector Advisory Center (FINSec) ITU s work in Cybersecurity and Global Cybersecurity Index (GCI) Vijay Mauree Programme Coordinator,
Qualys PC/SCAP Auditor
Qualys PC/SCAP Auditor Getting Started Guide August 3, 2015 COPYRIGHT 2011-2015 BY QUALYS, INC. ALL RIGHTS RESERVED. QUALYS AND THE QUALYS LOGO ARE REGISTERED TRADEMARKS OF QUALYS, INC. ALL OTHER TRADEMARKS
Towards security management in the cloud utilizing SECaaS
Towards security management in the cloud utilizing SECaaS JAN MÉSZÁROS University of Economics, Prague Department of Information Technologies W. Churchill Sq. 4, 130 67 Prague 3 CZECH REPUBLIC jan.meszaros@vse.cz
Incident Management ITU Pillars & Qatar Case Study Michael Lewis, Deputy Director
Incident Management ITU Pillars & Qatar Case Study Michael Lewis, Deputy Director 2 Thanks To the ITU for sponsoring the initiative ictqatar has worked closely with the ITU-D since the project s inception,
Common Platform Enumeration (CPE) Technical Use Case Analysis
Common Platform Enumeration (CPE) Technical Use Case Analysis The MITRE Corporation November, 2008 Executive Summary A common theme taken from discussions at the Common Platform Enumeration (CPE) Developer
Toward an Ontology Architecture for Cyber-Security Standards
Toward an Ontology Architecture for Cyber-Security Standards Mary C. Parmelee The MITRE Corporation 7515 Colshire Drive, McLean, VA 22102-7539, USA mparmelee@mitre.org Abstract. The rapid growth in magnitude
CERT/CC Overview & CSIRT Development Team Activities
CERT/CC Overview & CSIRT Development Team Activities Georgia Killcrece CSIRT Development Team CERT Program Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890 October 2006
Standard: Vulnerability Management and Assessment
Standard: Vulnerability Management and Assessment Page 1 Executive Summary San Jose State University (SJSU) is highly diversified in the information that it collects and maintains on its community members.
Web Application Security. Sajjad Pourali sajjad@securation.com CERT of Ferdowsi University of Mashhad
Web Application Security Sajjad Pourali sajjad@securation.com CERT of Ferdowsi University of Mashhad Take away Why web application security is very important Understanding web application security How
Vulnerability Management
Vulnerability Management Buyer s Guide Buyer s Guide 01 Introduction 02 Key Components 03 Other Considerations About Rapid7 01 INTRODUCTION Exploiting weaknesses in browsers, operating systems and other
Creating and Managing Computer Security Incident Response Teams (CSIRTs)
Creating and Managing Computer Security Incident Response Teams (CSIRTs) CERT Training and Education Networked Systems Survivability Program Software Engineering Institute Carnegie Mellon University Pittsburgh,
D. Best Practices D.2. Administration The 6 th A
Best Practices I&C School Prof. P. Janson September 2014 D. Best Practices D.2. Administration The 6 th A 1 of 26 The previous section described how to improve IT security through use of better development
Applying the Continuous Monitoring Technical Reference Model to the Asset, Configuration, and Vulnerability Management Domains (DRAFT)
NIST Interagency Report 7800 (Draft) Applying the Continuous Monitoring Technical Reference Model to the Asset, Configuration, and Vulnerability Management Domains (DRAFT) David Waltermire, Adam Halbardier,
White paper. Creating an Effective Security Operations Function
White paper Creating an Effective Security Operations Function Awareness of security issues is fundamental to an effective policy. When we think of a security operations center (SOC), we often have an
3 Web Services Threats, Vulnerabilities, and Countermeasures
3 Web Services Threats, Vulnerabilities, and Countermeasures Securing a Web service requires us to protect, as far as possible, all of its basic components, shown in Figure 3.1, and their interactions
Managed Incident Lightweight Exchange (MILE)
Managed Incident Lightweight Exchange (MILE) Overview and Particpation Kathleen Moriarty Global Lead Security Architect EMC Corporate CTO Office 1 Agenda IETF s Managed Incident Lightweight Exchange (MILE)
Integration of Standardized Syntax and Semantics (Common Language) into CSIRT Operations
INFORMATION SOCIETIES TECHNOLOGY (IST) PROGRAMME Proposal acronym: Proposal full title: ecsirt.net European CSIRT Network Proposal/Contract number: IST-2001-37558 Integration of Standardized Syntax and
WHITE PAPER ON SECURITY TESTING IN TELECOM NETWORK
WHITE PAPER ON SECURITY TESTING IN TELECOM NETWORK DATE OF RELEASE: 27 th July 2012 Table of Contents 1. Introduction... 2 2. Need for securing Telecom Networks... 3 3. Security Assessment Techniques...
The Emergence of Security Business Intelligence: Risk
The Emergence of Security Business Intelligence: Risk Management through Deep Analytics & Automation Mike Curtis Vice President of Technology Strategy December, 2011 Introduction As an industry we are
RSA envision. Platform. Real-time Actionable Security Information, Streamlined Incident Handling, Effective Security Measures. RSA Solution Brief
RSA Solution Brief RSA envision Platform Real-time Actionable Information, Streamlined Incident Handling, Effective Measures RSA Solution Brief The job of Operations, whether a large organization with
Vulnerability Management Nirvana: A Study in Predicting Exploitability
SESSION ID: TECH-F01 Vulnerability Management Nirvana: A Study in Predicting Exploitability Kymberlee Price Senior Director of Operations Bugcrowd @Kym_Possible Michael Roytman Senior Data Scientist Risk
Cisco Security IntelliShield Alert Manager Service
Data Sheet Cisco Security IntelliShield Alert Manager Service The Cisco Security IntelliShield Alert Manager Service provides a comprehensive, cost-effective solution for delivering the security intelligence
Cyber Security RFP Template
About this document This RFP template was created to help IT security personnel make an informed decision when choosing a cyber security solution. In this template you will find categories for initial
Asset management guidelines
Asset management guidelines 1 IT asset management (ITAM) overview Objective Provide a single, integrated view of agency assets in order to allow agencies to identify the asset location and assess the potential
Department of Information and Technology Management
INFOTEC Overview Department of Information and Technology Management Introduction The Information and Technology Management Department (INFOTEC) is responsible for providing modern, secure, fit for purpose
Manage Vulnerabilities (VULN) Capability Data Sheet
Manage Vulnerabilities (VULN) Capability Data Sheet Desired State: - Software products installed on all devices are free of known vulnerabilities 1 - The list of known vulnerabilities is up-to-date Desired
Seven Simple Steps that Slash the IT Audit Burden
Seven Simple Steps that Slash the IT Audit Burden Maximizing your efficiency gains from McAfee Policy Auditor 5 Table of Contents Audit Fatigue 3 Tackle Tedium and Disruption 4 Step 1: Policy Definition
Total Protection for Compliance: Unified IT Policy Auditing
Total Protection for Compliance: Unified IT Policy Auditing McAfee Total Protection for Compliance Regulations and standards are growing in number, and IT audits are increasing in complexity and cost.
Security Vulnerability Management. Mark J Cox
Security Vulnerability Management Mark J Cox Responsibility & Accountability Unique challenges Many vendors all ship the same thing The vulnerabilities are there. The fact that somebody in the middle of
Vulnerability Scanning Requirements and Process Clarification Comment Disposition and FAQ 11/27/2014
Vulnerability Scanning Requirements and Process Clarification Disposition and FAQ 11/27/2014 Table of Contents 1. Vulnerability Scanning Requirements and Process Clarification Disposition... 3 2. Vulnerability
Introduction to OVAL: A new language to determine the presence of software vulnerabilities
Introduction to OVAL: A new language to determine the presence of software vulnerabilities Matthew Wojcik / Tiffany Bergeron / Robert Roberge November 2003 The MITRE Corporation Table of Contents Introduction
Vulnerability Assessment Report Format Data Model
I3E'2005 Vulnerability Assessment Report Format Data Model Dr.D.Polemi G.Valvis Issues Attack paradigm Vulnerability exploit life cycle Vulnerability assessment process Challenges in vulnerability assessment
DoD Secure Configuration Management (SCM) Operational Use Cases
Defense Information Systems Agency A Combat Support Agency DoD Secure Configuration Management (SCM) Operational Use Cases DISA PEO-MA Computer Network Defense Enclave Security 26 September 2010 This brief
2. Exercise: Incident Handling Procedure Testing
CERT Exercises Handbook 13 13 2. Exercise: Incident Handling Procedure Testing Main Objective Targeted Audience Total Duration Time Schedule Frequency In this exercise participants will have the opportunity
CHAPTER 3 : INCIDENT RESPONSE FIVE KEY RECOMMENDATIONS GLOBAL THREAT INTELLIGENCE REPORT 2015 :: COPYRIGHT 2015 NTT INNOVATION INSTITUTE 1 LLC
: INCIDENT RESPONSE FIVE KEY RECOMMENDATIONS 1 FIVE KEY RECOMMENDATIONS During 2014, NTT Group supported response efforts for a variety of incidents. Review of these engagements revealed some observations
Reference Ontology for Cybersecurity Operational Information
The Computer Journal Advance Access published October c The British 8, 2014 Computer Society 2014. This is an Open Access article distributed under the terms of the Creative Commons Attribution License
CDM Vulnerability Management (VUL) Capability
CDM Vulnerability Management (VUL) Capability Department of Homeland Security Office of Cybersecurity and Communications Federal Network Resilience Vulnerability Management Continuous Diagnostics and Mitigation
Guideline on Auditing and Log Management
CMSGu2012-05 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Auditing and Log Management National Computer Board Mauritius
Find the needle in the security haystack
Find the needle in the security haystack Gunnar Kristian Kopperud Principal Presales Consultant Security & Endpoint Management Technology Day Oslo 1 Find the needle in the security haystack Manually deep
Intelligent Vulnerability Management The Art of Prioritizing Remediation. Phone Conference
Intelligent Vulnerability Management The Art of Prioritizing Remediation An IANS Interactive Phone Conference SUMMARY OF FINDINGS F e b r u a ry 2010 Context Joel Scambray shared IANS point of view on
Vulnerability Management in Software: Before Patch Tuesday KYMBERLEE PRICE BUGCROWD
Vulnerability Management in Software: Before Patch Tuesday KYMBERLEE PRICE BUGCROWD whoami? Senior Director of a Red Team PSIRT Case Manager Data Analyst Internet Crime Investigator Security Evangelist
User s Guide. Skybox Risk Control 7.0.0. Revision: 11
User s Guide Skybox Risk Control 7.0.0 Revision: 11 Copyright 2002-2014 Skybox Security, Inc. All rights reserved. This documentation contains proprietary information belonging to Skybox Security and is
Reporting Status of Vulnerability-related Information about Software Products and Websites - 2 nd Quarter of 2013 (April June) -
Reporting Status of Vulnerability- Information about Software Products and Websites - 2 nd Quarter of 213 (April June) - Information-technology Promotion Agency, Japan (IPA) and Japan Computer Emergency
Question(s): 4/17 Geneva, 16-25 September 2009 TEMPORARY DOCUMENT
INTERNATIONAL TELECOMMUNICATION UNION STUDY GROUP 17 TELECOMMUNICATION STANDARDIZATION SECTOR STUDY PERIOD 2009-2012 English only Original: English Question(s): 4/17 Geneva, 16-25 September 2009 Source:
Secstate: Flexible Lockdown, Auditing, and Remediation
Secstate: Flexible Lockdown, Auditing, and Remediation Certifiable Linux Integration Project Tresys Technology Karl MacMillan Topics Secstate Overview Sample session illustrating
The Value of Vulnerability Management*
The Value of Vulnerability Management* *ISACA/IIA Dallas Presented by: Robert Buchheit, Director Advisory Practice, Dallas Ricky Allen, Manager Advisory Practice, Houston *connectedthinking PwC Agenda
Vulnerability handling DK-CERT
Vulnerability handling DK-CERT TF-CSIRT, Heraklion, 21. May 2010 Shehzad Ahmad, DK-CERT Email: shehzad.ahmad@uni-c.dk Agenda Introduction of DK-CERT Background, today and the future DK-CERT Services Vulnerability
PASTA Abstract. Process for Attack S imulation & Threat Assessment Abstract. VerSprite, LLC Copyright 2013
2013 PASTA Abstract Process for Attack S imulation & Threat Assessment Abstract VerSprite, LLC Copyright 2013 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Information Security and Continuity Management Information Sharing Portal. Category: Risk Management Initiatives
Information Security and Continuity Management Information Sharing Portal Category: Risk Management Initiatives Contact: Chip Moore, CISO State of North Carolina Office of Information Technology Services
Enterprise Software Management Systems by Using Security Metrics
Enterprise Software Management Systems by Using Security Metrics Bhanudas S. Panchabhai 1, A. N. Patil 2 1 Department of Computer Science, R. C. Patel Arts, Commerce and Science College, Shirpur, Maharashtra,
GFI White Paper PCI-DSS compliance and GFI Software products
White Paper PCI-DSS compliance and Software products The Payment Card Industry Data Standard () compliance is a set of specific security standards developed by the payment brands* to help promote the adoption
Q: What is CVSS? Q: Who developed CVSS?
CVSS FAQ Q: What is CVSS? Q: Who developed CVSS? Q: What does CVSS not do? Q: What is involved in CVSS? Q: What are the details of the Base Metrics? Q: What are the details of the Temporal Metrics? Q:
How to Develop an Effective Vulnerability Management Process
Research Publication Date: 1 March 2005 ID Number: G00124126 How to Develop an Effective Vulnerability Management Process Mark Nicolett IT organizations should develop vulnerability management processes
STREAM Cyber Security
STREAM Cyber Security Management Software Governance, Risk Management & Compliance (GRC) Security Operations, Analytics & Reporting (SOAR) Fast, flexible, scalable, easy to use and affordable software
Vulnerability Management with the Splunk App for Enterprise Security
Copyright 2014 Splunk Inc. Vulnerability Management with the Splunk App for Enterprise Security Randal T. Rioux Principal Security Strategist and Minister of Offense Splunk Inc. Disclaimer During the course
DEVELOPING AN IT SERVICE MANAGEMENT TRAINING STRATEGY & PLAN. Version : 1.0 Date : April 2009 : Pink Elephant
DEVELOPING AN IT SERVICE MANAGEMENT TRAINING STRATEGY & PLAN Version : 1.0 Date : April 2009 Author : Pink Elephant Table of Contents 1 Executive Overview... 3 2 Manager Responsibilities... 4 2.1 Before
Advanced Risk Analysis for High-Performing Organizations
Pittsburgh, PA 15213-3890 Advanced Risk Analysis for High-Performing Organizations Christopher Alberts Audrey Dorofee Sponsored by the U.S. Department of Defense 2006 by Carnegie Mellon University page
Federal Mobile App Vetting Center for Assured Software Pilot. Nick Valletta
Federal Mobile App Vetting Center for Assured Software Pilot Nick Valletta MOBILE SECURITY: A REAL ISSUE Slide 2 of 20 NOTEWORTHY ANDROID APP TRENDS 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Trends Among
i-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors
March 25-27, 2014 Steven A. Kunsman i-pcgrid Workshop 2015 Cyber Security for Substation Automation The Jagged Line between Utility and Vendors ABB Inc. March 26, 2015 Slide 1 Cyber Security for Substation
Insider Threat Control: Using a SIEM signature to detect potential precursors to IT Sabotage. CERT Insider Threat Center
Insider Threat Control: Using a SIEM signature to detect potential precursors to IT Sabotage CERT Insider Threat Center April 2011 NOTICE: THIS TECHNICAL DATA IS PROVIDED PURSUANT TO GOVERNMENT CONTRACT
University of Wisconsin Platteville IT Governance Model Final Report Executive Summary
University of Wisconsin Platteville IT Governance Model Final Report Executive Summary February 2013 Project Objectives & Approach Objectives: Build on the efforts of the Technology Oversight Planning
Continuous Monitoring in a Risk Management Framework. US Census Bureau Oct 2012
Monitoring in a Risk Management Framework US Census Bureau Oct 2012 Agenda Drivers for Monitoring What is Monitoring Monitoring in a Risk Management Framework (RMF) RMF Cost Efficiencies RMF Lessons Learned
1 Introduction... 2 2 Product Description... 3 3 Strengths and Challenges... 5 4 Copyright... 5
KuppingerCole Report EXECUTIVE VIEW by Alexei Balaganski May 2015 is a business-critical application security solution for SAP environments. It provides a context-aware, secure and cloud-ready platform
2 Copyright 2015 M. E. Kabay. All rights reserved. 4 Copyright 2015 M. E. Kabay. All rights reserved.
CSH5 Chapter 40 Managing Patches & Vulnerabilities Peter Mell & Karen Kent Scarfone Topics Introduction to Patch & Vulnerability Management Why Use Automated Patching Solutions? Patch & Vulnerability Management