PRO+ Premium Content/Information Security magazine

Thank you for joining!
Access your Pro+ Content below.
November 2017, Vol. 19, No. 9

The vulnerability management process after Equifax

Managing software vulnerabilities is a universal problem. While unknown flaws in code or system design are part of the vulnerability management process, responsible disclosure policies and bug bounties have greatly reduced the prevalence of zero-day attacks. Unknown security holes that attackers exploit are usually at high-value targets, such as Fortune 500 companies, government agencies and critical infrastructures. NotPetya, WannaCry, Conficker and other well-publicized attacks took advantage of vulnerabilities that were publicly known and had available software patches. The use of known vulnerabilities is especially troubling for security professionals because these attacks can be prevented. Companies haven't embraced the ever-changing software environments that have become reality. While technology providers have begun configuring their software to perform automatic checks to identify and install patches, IT departments have gone to great lengths to control software patching and releases and disable these automatic updates. ...

Features in this issue

Columns in this issue