TLDR; * Context is key when it comes to Vulnerability Management. Instead of focusing on Vulnerabilities by severity, organizations should evaluate the exploitability and actively exploited vulnerabilities for Prioritization. * When looking at Vulnerabilities do not take CVSS Base score at face value, organizations should understand & utilize Temporal and Environmental elements
September 29, 2023
TLDR; * Detailed Understanding on particular capability with overview of entire architecture is very important from a Threat Modeling perspective. * Create Checklists to scale security in an organization. Involve all teams, and when possible invest and nurture a security champions program. * Security is a journey not a destination. Celebrate small wins.
September 08, 2023
TLDR; * When it comes to asset management, always start from outside in, like DNS, to understand your dangling subdomains or public IPs, which are sort of overexposed and work your work towards inside of your infrastructure. * For asset inventory, get data from multiple sources so that you can use that
August 25, 2023