How To Prioritize Vulnerabilities in a Modern IT Environment

Here’s a stat that shows the importance of prioritizing vulnerability remediation: Almost 30% of the CVEs disclosed in 2017 had a CVSS score of “High” or “Critical.” That works out to about 3,000 such vulnerabilities, or about 58 every week. Given this large number of severe vulnerabilities, it’s...

My short review of “The Forrester Wave: Vulnerability Risk Management, Q1 2018”

Last week, March 14, Forrester presented new report about Vulnerability Risk Management VRM market. You can purchase it on official site for $2495 USD or get a free reprint on Rapid7 site. Thanks, Rapid7! I've read it and what to share my impressions. I was most surprised by the leaders of the...

Securing IT Assets By Prioritizing Protection And Remediation

As hackers get faster at weaponizing exploits for disclosed bugs, InfoSec teams need — more than ever — automated, continuous and precise IT asset inventorying, vulnerability management, threat prioritization and patch deployment. Critical vulnerabilities that linger unpatched for weeks or months...

Continuous Security and Compliance Monitoring for Global IT Assets

In today’s information security world, all assets everywhere must be detected, visible, protected and compliant -- all the time. It’s no longer enough to rely on “point in time” security and compliance assessments, such as scheduled weekly or monthly scans on handpicked critical servers. “You mus...

Continuous Security & Compliance Demo Series

This series shows you how to effectively navigate security risks, new regulations and new technologies in support of a secure and compliant digital transformation. Qualys product managers walk you through the new features of Qualys Cloud Platform and Apps and show you how to get maximum leverage...

Firefox 57 "Quantum" Released – 2x Faster Web Browser

It is time to give Firefox another chance. The Mozilla Foundation today announced the release of its much awaited Firefox 57, aka Quantum web browser for Windows, Mac, and Linux, which claims to defeat Google's Chrome. It is fast. Really fast. Firefox 57 is based on an entirely revamped design an...

Exploitability attributes of Nessus plugins: good, bad and Vulners

Exploitability is one of the most important criteria for prioritizing vulnerabilities. Let's see how good is the exploit-related data of Tenable Nessus NASL plugins and whether we can do it better. What are the attributes related to exploits? To understand this, I parsed all nasl plugins and got...

App Layering 2.x/3.x: Best Practices

A consolidation of the various layering best practices to apply in the OS and App layers. For App Layering 4.x Best Practices, please refer here:https://support.citrix.com/article/CTX225952 Operating System Layer Have one Operating System layer per Operating System Windows 7 32-bit, Windows 7...

Three Ways to Use Data Classification Scan Results

In July we launched Classifier, a free data classification tool that allows you to quickly and easily uncover sensitive data in your databases. Since its launch, the tool has been widely used around the globe, which comes as no surprise given the heightened focus on data protection. Furthermore,...

Problems of Vulnerability Prioritization and Detection

It’s the third part of our talk with Daniil Svetlov at his radio show “Safe Environment” recorded 29.03.2017. In this part we talk about Vulnerability Prioritization and Detection: Common Vulnerability Scoring System CVSS Environmental factor Manual and automated vulnerability detection...

Survival of the fastest: evolving defenders with broad security automation

If youve read the news at all lately, you know that we're having some struggles with information security. Everything from elections to hospitals to Westeros is considered a target, and adversaries continue to learn and innovate--often faster than the defense can respond. Its not that they have...

More on the Vulnerabilities Equities Process

Richard Ledgett -- a former Deputy Director of the NSA -- argues against the US government disclosing all vulnerabilities: Proponents argue that this would allow patches to be developed, which in turn would help ensure that networks are secure. On its face, this argument might seem to make sense ...

Rapid7 Threat Report: Q2 2017

We cannot believe that we're already into August! Time really flies when the internet is constantly on fire. When it came time to analyze data for our Q2 Threat Report and pull out threat trends and landscape changes, there was plenty to work with. Q2 kept defenders on their toes--from the Shadow...

Live Threat-Driven Vulnerability Prioritization

We often hear that security teams are overwhelmed by the number of vulnerabilities in their environments: every day they are finding more than they can fix. It doesnt help when rating schemes used for prioritization, like the Common Vulnerability Scoring System CVSS, dont really work at scale or...

How to Rapidly Identify Assets at Risk to WannaCry Ransomware and ETERNALBLUE Exploit

In what may be the first public weaponizing of April's Shadow Brokers dump of NSA exploits, a ransomware attack has crippled IT systems globally and disrupted operations at major organizations, including patient services at UK hospitals. About 80,000 infections have been detected in about 100...

FedRAMP Prioritization

Coalfire has been participating in the American Council for Technology and the Industry Advisory Council ACT-IAC Cloud Computing community of interest in order to contribute in developing the new FedRAMP JAB Prioritization process...

August 9, 2016 — KB3176492 (OS Build 10240.17071)

None None...

Obama's Executive Order urges Companies to Share CyberSecurity Threat Data

President Barack Obama signed an executive order on Friday that encourages and promotes sharing of information on cybersecurity threats within the private sector and between the private sector companies and the government agencies as well. AREAS TO IMPROVE During his speech at the White House...

Microsoft Shuts Down Patch Tuesday Advanced Notifications

Microsoft today pulled the plug on its Advanced Notification Service ANS, offering it going forward only to paying Premier customers. ANS preceded the release of Microsoft’s monthly Patch Tuesday security bulletins; on the Thursday prior, Microsoft would provide users via its security website a...

Assessing Risk for the October 2014 Security Updates

Today we released eight security bulletins addressing 24 unique CVE’s. Three bulletins have a maximum severity rating of Critical, and five have a maximum severity rating of Important. This table is designed to help you prioritize the deployment of updates appropriately for your environment...