Nucleus Security’s Post

Transcript

We have all these rabbit holes, right? We have these rabbit holes that you have to dive into every single time you wanna start just normalizing one new set of data, and in this case with CIS benchmarks. You basically can only receive them via PDF and you have to enter your information in there, and so you generally have to outsource that to a vendor that pays CIS for the privilege of being able to map via code. You can also pay for it yourself, but it doesn't solve the fundamental problem so. What do we actually do about it? The first question is that I always start with is triage, right? So a lot of folks when they look at a vulnerability management process, they'll start with prioritization. Now prioritization is definitely important and we will get to prioritization here in a moment. But I actually believe that you need to start with triage. And the reason you need to start with triage is because it's a broader stage of your VM process and what it means. It means a few things. The first is it means. Looking at your information and all of the data that's coming in, it means. Normalizing the data, it means cleaning the information and it means making decisions and putting it in a format that you can then prioritize and respond to. So I love starting with triage first, especially when you're first getting started in a VM program. And how do you start normalizing different types of findings together and. You may ask, Scott, how do I actually go about doing this? Well, I normally start with a threat model.