Tenable Blog

Continuing his blog series on SecurityWeek, Tenable’s Marcus Ranum discusses the challenges in presenting and comparing system metrics. Metrics should be normalized and placed in context for effective communication. He uses several stock market charts to reinforce his message.

The latest Patch Tuesday from Microsoft (November 11, 2014) includes fixes for some major vulnerabilities, including remote code execution bugs affecting core Windows components and Internet Explorer. The three major bulletins of note are MS14-064, MS14-065 and MS14-066, all of which have a CVSS score of above 9.0.

At a recent conference, I heard a security practitioner blame a couple of users for being dummies who click on everything. He then said, “At a certain point, it's reasonable to blame the user. It's just like when someone parks a car with the keys in it, in a known bad neighborhood. You have to take ownership of your actions.” Well, yes and no.

The “cyber kill chain®”¹ is a model for framing an incident response/analysis capability that was developed by Lockheed Martin’s Computer Incident Response Team. It is a useful framework for talking about and reasoning about why and how we do things in security. The term “kill chain” is admittedly violent when you consider that we're talking about an environment in which, ideally, nothing of the sort is happening.

Since the creation of tools like Nessus, the pioneering technology written by Renaud Deraison back in 1996, vulnerability management tools have helped users gain an incredible amount of insight into the inner workings of their environments. By scanning for assets that are running, discovering any associated weaknesses in the operating system or installed applications, and identifying vulnerable configurations, organisations have gained situational awareness and control of their infrastructures.