3 ms·
Maybe someone will disagree, but I believe there is no shortcuts or one-fits-all solution when it comes to security. Structure of modern information systems is
by jesterson 7y ago
Maybe someone will disagree, but I believe there is no shortcuts or one-fits-all solution when it comes to security. Structure of modern information systems is extremely diverse making single path approach not working in vast majority of cases.
My answer would be quite boring I guess but it does the job to improve resilience:
- Analyse your system and identify potential vulnerabilities;
- Analyse you vulnerabilities against your risk model (identify the most crucial ones);
- Mitigate risks from most important to least one;
- Rinse, repeat regularly;
- badrabbit 7y agoWhat you said improves your known attack surface for sure. But what do you mean vulnerabilities? CVE's? If so that's inadequate. What I mean is, system and network architecture on it's own often creates vulnerabilities for that risk model. Let's say you have product X,it is well patched and well configured. Except!, anyone can access it from the intranet and internet. Is this a vulnerability? Can a random attacker password spray product X ,gain access and leverage that access for $profit? It's not exactly a CVE but it can be a vulnerability. I say invest in good security/IT architects.