Tenable Blog

Infosec professionals know that our security could always be stronger; there’s a lot that we could be doing better to improve our security postures. When David Spark asked Black Hat 2015 attendees “What could we do to work smarter in security?” he got some fascinating comments.

At Tenable, we love bug reports; they give us opportunities to make our software even better. Recently, a customer was having some issues with a credentialed patch audit of his network (https://discussions.tenable.com/message/31190). In the process of solving this issue, our engineers discovered a problem with how SMB v1 server logs error messages.

Jay “Saurik” Freeman (@saurik), developer of Cydia, the alternative to the App Store for jailbroken iPhones, is passionate about vulnerabilities. At the 2015 Black Hat Conference in Las Vegas, we spoke to Saurik about how his passion for vulnerabilities generates the same sense of wonderment as watching a magician.

A lot of companies are offering global information about threats that is of no relevance to our company, our customers, or our global portfolio, said Stan Black, CSO of Citrix, in our conversation at the 2015 Black Hat Conference in Las Vegas.

Black is frustrated with vendors who show off their entire threat portfolio for which his company only needs a small subset. Problem is he doesn’t know what that is, nor do the vendors. It’s a complete lack of actionable threat intelligence.

According to WhiteHat Security stats, the average time to fix a website vulnerability after it has been reported is 150-180 days.

Remediation is obviously an issue, and the failure to fix (only half ever get fixed) is purely a situation of lack of resources, said Jeremiah Grossman (@jeremiahg), founder of WhiteHat Security, in our conversation at the 2015 Black Hat Conference in Las Vegas.