4 ms·

How do people currently scan their infrastructure to look for vulnerabilities? Do you have a dedicated team that handles this, or is security "everyone's job"?

• raesene9 10y ago
  I'd say that's very organization specific. Personally I'd see the maturity curve being No-one's doing it --> specialists doing it --> everyone's doing it. With the speed of modern development, ideally everyone should have a good handle on basic security practices, ideally with a specialist team available for more niche requirements
  • jsulinski 10y ago
    I did some market research before I started working on Federacy (which began as frustrations I encountered at mopub/twitter). It seems that very few companies sub-hundreds of employees and thousands of servers have a security specialist, and almost no one is running vulnerability analysis in a real way.
    • raesene9 10y ago
      So really big companies will/do have teams of VA people, also where they're a regulated industry so subject to things like PCI, I'd expect to see that as well. However as you say in the small company space, it's very hit or miss as to what effort can be put into this kind of work. The thing I'd say about services that do package vuln. scanning is that they can be useful but it's easy to get seduced by absolute sounding numbers (e.g. a CVSS 10 oh that must be much worse than a 4). Unfortunately from what I've seen scoring can be pretty arbitrary (e.g. https://raesene.github.io/blog/2014/11/17/want-to-improve-your-security-just-turn-off-ssl/ https://raesene.github.io/blog/2014/11/17/want-to-improve-yo... ) Also the problems there have been in the CVE space (http://www.theregister.co.uk/2016/05/25/mitre_fighter_deploys_name_logo_website_combo_in_cve_plea/ http://www.theregister.co.uk/2016/05/25/mitre_fighter_deploy...) could reduce the efficacy of that kind of scanning if there are gaps where vulnerabilities are not being placed into the system. All that's not to say there's no value in that kind of work, it's definitely a piece of the programme, but it's important to get it in the appropriate context :)
      • jsulinski 10y ago
        You're spot on. These are two of the things I intend on working on next. Thanks for the links.
      • jsulinski 10y ago
        To add a bit of detail here, one of the most surprising things I found that I'm saving for my next post is: 24% of recent vulnerabilities in the NVD have no rating, and that doesn't even include the ones that weren't posted to NVD at all. On top of this, the fact that the rating systems used by the different vendors/sources of vulnerabilities are quite different, and like you mentioned, the implicit subjectivism... it's a mess. But a solvable one! That's what I'm working on.
        • raesene9 10y ago
          good luck :) it's an interesting challenge for sure!
          • jsulinski 10y ago
            Thank you. I'll definitely be reaching out.