In Safeguard 7.1, we discussed the difference between running a vulnerability scanner and operating a vulnerability management program. A scan may identify weaknesses, but the organization still needs a documented process that explains what happens next. That brings us to CIS Safeguard 7.2: Establish and Maintain a Remediation Process. The safeguard calls for a documented, risk-based remediation strategy that is reviewed at least monthly. The phrase “risk-based” matters. Most organizations...
by Tim Marley We have spent the last two weeks in the CIS Controls series talking about data management and data inventory. Knowing what you are...
by Heath Gieson It usually starts the same way. An alert comes in overnight. Maybe it is an email from a security vendor. Maybe it lands in a shared...
by Tim Marley Last week we talked about data management at a high level. The operating model, the responsibility, the reality that organizations are...
by Heath Gieson For healthcare organizations, cybersecurity and compliance are no longer just IT concerns—they are material financial risks...
by Tim Marley Over the course of my career, and particularly in the last five to ten years, the topic of data management comes up frequently....
Most organizations assume that corporate devices only run approved software. In reality, that assumption is often wrong. Users are inherently...
Most security conversations focus on what software exists in an environment. CIS Control 2.2 pushes the conversation one step further by asking a...
One of the themes we keep hitting in the CIS IG1 series is simple: you can’t protect what you don’t know you have. That’s true for hardware—and it’s...
When we kicked off this series with Control 1.1: Establish and Maintain a Detailed Enterprise Asset Inventory, we focused on the Identify security...
