vega terry welliver greg syme juana wells naval postgraduate school

VEGA

TERRY WELLIVERGREG SYMEJUANA WELLS

NAVAL POSTGRADUATE SCHOOL

VULNERABILITY MANAGEMENT

FACTSTHERE ARE AND WILL CONTINUE TO BE BUGS AND HOLESIN SOFTWARE THAT CAN BE EXPLOITED

FACTSVENDORS WILL (OR AT LEAST SHOULD) DO THEIR BEST TO FIX THEM AS FAST AS THEY CAN

FACTSBUT THE FIXES WON’T HELP IF YOU DON’T KNOW YOU NEED THEM AND THEN DON’T DEPLOY THEM

FACTS

APPLYING FIXES IS GOING TO BE DISRUPTIVE TO NORMAL OPERATIONS, SO YOU NEED AN ACTIVE PLAN AND PROVEN PROCESS FOR ENSURING THAT THE WORK GETS DONE IN A TIMELY FASHION

NAVY MANDATES

A FORMAL VULNERABILITY SCANNING PROCESS IN PLACE AND AN ACTIVE PLAN TO ADDRESS VULNERABILITIES THAT ARE DISCOVERED

TIME AND MONEYBUDGETS ARE TIGHT AND TIME IS FINITE

SOLUTION

FIND THE BUGS YOU NEED TO FIX

TAKE ACTION ON THE FINDINGS (PDF, CSV)

EMAIL THE SYSTEM ADMINISTRATORS

CREATE YET ANOTHER EXCEL FILE TO TRACK THEM

VULNERABILITY SCANNER

EXPORT THE REPORTS

DISTRIBUTE THE REPORTS

TRACK THE FIXES

VALIDATE THE FIXESSCAN AGAIN AND START OVER

INTERNET

NETWORK PERIMETER DMZ

INTERNAL NETWORK

SOLUTION






EXPORT THE REPORTS


TRACK THE FIXES


PROBLEM






EXPORT THE REPORTS


TRACK THE FIXES


PROBLEM

THINK DIFFERENT

SCANNER DATABASE WEBSITE

SCANNER DATABASE ISSUE TRACKING

RETINA POSTGRES JIRA

RUBYSCRIPTS

JIRAAPI

DATA TYPES

NORMALIZATION

USER INTERFACE

WORKFLOW

ACCOUNTABILITY

DOCUMENTATION

TRACKING

FEEDBACK

FUTURE

NESSUS IS REPLACING RETINA

IDENTIFY FALSE POSITIVE AND WON’T FIX

MORE, MORE, MORE

MMMMMM, MMMMMM, GOOD

NEW VULNERABILITY SCANNER

GLOBAL RISK ACCEPTANCE

AUTOMATION

DELICIOUS CAKE

BE THE CHANGE YOU SEEK

vega terry welliver greg syme juana wells naval postgraduate school

Documents