What your scanner isn't telling you
•
0 likes•319 views
The more your organization knows about potential threats, the safer your critical assets will be, but are traditional solutions, such as monthly scans and haphazard patching enough? What your scanner isn’t telling you are the critical vulnerabilities that should be fixed first.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to What your scanner isn't telling you
Similar to What your scanner isn't telling you (20)
More from Core Security
More from Core Security (20)
Recently uploaded
Recently uploaded (20)
What your scanner isn't telling you
- 1. What Your Scanner Isn’t Telling You… A Holistic View of Threat and Vulnerability Management
- 2. “In today’s virtualized, complex data centers and networks–vulnerability management programs are more difficult to master…” ERIC COWPERTHWAITE VP Advanced Security and Strategy Core Security TIM CALLAHAN Chief Information Security Officer Aflac
- 3. Today’s Agenda Discuss traditional approach to vulnerability management Take a look at a few ways to help mitigate critical “unspoken” threats? Q&A session
- 4. Traditional Vulnerability Management Approach • Asset-by-asset approach • Scan and patch all vulnerabilities (difficult with today’s limited resources) • Limited prioritization methods • No accommodation for complex networks, no clear picture of how attackers will infiltrate
- 5. Data Overload…oh my! There is so much to do and the increased pressure doesn’t help: o Data – Vulnerabilities, networks, viruses, SIEM, IoT, etc. o Regulations – Required security, reports, mandatory activity • Thousands of servers, tens of thousands of endpoints • Hundreds of pages of vulnerability reports, no easy way to prioritize • Most organizations are being breached by a combined approach– social engineering attack quickly followed up by exploiting an old vulnerability
- 6. 99% of all successful attacks/breaches involve a vulnerability that is at least 1 year old 90% of all breaches involve a vulnerability from 7 years or older 2015 Verizon Data Breach Investigations Report
- 7. So, what can we do to mitigate critical “unspoken” threats?
- 8. Cut through the noise and innovate • Engage new and different security skills, outsource critical skills • Success is going to require innovation • Must understand what the bad guy will do • Must know where to expend resources • Implement new technologies o Analytics o Automation o Integration Change the game to intelligent defense
- 9. Penetration Testing Vulnerability Management Point Solution Enterprise Platform 1996 Core Security Founded 2001 Core Impact Pro Released 2011 Core Insight Released Core Security…evolution
- 10. RemediateCollect Remediation IT/Network Ops GRC SIEM Forensics Anti-Virus Logging Scanning Tools Application Security Scanning Web App Security DATA The Problem: • Mountains of Data • 1000’s of Vulnerabilities • No Relevance to Business The traditional solution: • Try to patch everything • Priority based on arbitrary scores • No business context
- 11. Collect Remediate Nessus MVM IP360 Qualys Nexpose Etc. Trustwave AppSpider App Scan Qualys Web Inspect Etc. DATA Attack Intelligence Platform Consolidate security data Simulate attack paths Prioritize business risk Validate vulnerabilities Remediation IT/Network Ops Actionable Information Analyze
- 12. 12 NON-EXISTENT SCANNING ANALYSIS & PRIORITIZATION ASSESSMENT & COMPLIANCE ATTACK MANAGEMENT BUSINESS-RISK MANAGEMENT Level 0 Level 1 Level 2 Level 3 Level 4 Level 5 12 PEAK DATA OVERLOAD EFFECTIVE PRIORITIZATION Normalized Repository Single Dashboard and Reporting Exploit Prioritization Attack Simulation Validation Critical Asset Risk Vulnerability & Exploit Prioritization Attack Path Planning Web/Network Scanning CVSS Scoring Exploit Matching Vulnerability Assessment
- 13. Thank you! Now, it’s time for Q&A.
- 14. @coresecurity I blog.coresecurity.com I www.coresecurity.com ERIC COWPERTHWAITE. @e_cowperthwaite