In Safeguard 7.1, we discussed the difference between running a vulnerability scanner and operating a vulnerability management program. A scan may identify weaknesses, but the organization still needs a documented process that explains what happens next. That brings us to CIS Safeguard 7.2: Establish and Maintain a Remediation Process. The safeguard calls for a documented, risk-based remediation strategy that is reviewed at least monthly. The phrase “risk-based” matters. Most organizations...
Why More Updates Are Coming — and Why That’s a Good Thing Over the next several weeks, organizations are likely to notice something familiar but...
When the Management Plane Becomes the Attack Plane by Heath Gieson A few years ago, I was sitting in a conference room with an executive team after...
by Heath Gieson Some attacks are sophisticated. Weeks of reconnaissance, carefully crafted messages, and quiet exploitation in the...
by Heath Gieson Some attacks are sophisticated. Weeks of reconnaissance, carefully crafted phishing emails, vulnerabilities quietly exploited in the...
by Heath Gieson Every device you deploy and every application you install arrives configured for ease of use, not security. When was the last time...
by Heath Gieson As we continue our weekly journey through the CIS IG1 controls, each safeguard builds on the operational foundations we’ve been...
When geopolitical tensions rise, widespread cyber activity follows. Recent attacks connected to events involving Israel, the Gulf States, and India...
by Tim Marley Over the last few weeks, we have been building the foundation of a responsible data management program. In CIS Control 3.1, we talked...
by Tim Marley Over the last few weeks, we have talked about knowing what data you have and who has access to it. CIS Control 3.1 – We discussed the...
