Gathering of the Vulnerability Wranglers 2.0 Debuts Today at InfoSecWorld USA 2020 Digital

Gathering of the Vulnerability Wranglers 2.0 Debuts Today at InfoSecWorld USA 2020 Digital

Gathering of the Vulnerability Wranglers 2.0 Debuts Today at InfoSecWorld USA 2020 Digital 150 150 Mark Arnold

The Gathering of the Vulnerability Wranglers 2.0 (VW 2.0) panel debuts today on InfoSecWorld’s 2020 Digital event. As a content leadership advisor for InfoSecWorld USA, I have had the pleasure of hosting and moderating the panel for the two years and becoming a staple of the event. Our cast of wranglers (i.e., researchers and thought leaders), Alex Moss, CEO, ConventusAdrian Sanabria, Advocate at Thinkst Applied ResearchJake Kouns, CEO Risk Based Security, and Jonathan Cran, Director of Research at Kenna Security have come together for more friendly wrangling and banter. The panel reflects on #AllThingsVulnerabilities and what’s transpired over the past year. Unsurprisingly, each panelist echos the sentiment that much in the world has changed since we last met. What is unchanged is the unrelenting growth rate of which vulnerabilities.

2020 Vulnerability Management Issues

As the art of vulnerability wrangling continues to evolve to meet the challenge of wrangling at scale, top of mind for the panel discussion are the following talking points:

  • What are the significant vulnerability events in the past year?
  • With vulnerabilities increasingly rising, practitioners, vendors, and researchers are examining more closely the efficacy of the various methods (e.g., updating of the CVSS, the release of the EPSS, etc.) to wrangle them. Are we any better off a year later?
  • How are we doing with patching? Is patching too hard given the complexity of infrastructures and the ever-expanding attack surface? Can we rely on:
  • Risk-based approaches to vulnerability management consume the current vulnerability management marketplace. Haven’t we been discussing ‘risk’ approaches for a decade or more within our industry? Should we be taking more cues from risk management models outside of our space?
  • Predictions for the coming year? What’s next?

What’s Ahead: Focus on The Attack Surface

And we do have predictions. Kouns says vulnerability practitioners potentially face a “rough year” ahead as an impending vulnerability Fujiwharas loom in 2020. Although that may be, Cran suggests that year over year (YoY), for three consecutive years, vulnerability totals have remained consistent.

 Sanabria and Moss say that all organizations need to enhance their capabilities to understand the scope of their attack surfaces ahead of colliding vulnerability events. Dan Geer has argued that the attack surface continues to grow at a rate that far outpaces our ability to perform proper due diligence, which is not the failure of care by organizations. Private and public sectors cannot act fast enough. Our panel dives into this very issue of wrangling quicker. Wrangling faster.

Defining Vulnerability Wrangling, Building Collaboration

Vulnerability wrangling is best defined as “intelligence, prioritization, and remediation,” according to Kouns. His co-panelists generally agreed. While prioritization and remediation consume teams, the intelligence of the attack surface requires more considerable attention. Further, gathering data is not the sole responsibility of one group. The knowledge of one’s attack surface involves collaboration. It’s not just IT’s job or security’s responsibility to gather intelligence. A truly collaborative effort helps organizations manage vulnerability issues ahead of threats is the core takeaway of VW 2.0. On the Lares blog, we often talk about pentest, red, and purple teaming our core strengths. Our engagements are not what they are without a deep understanding of the attack surfaces of our clients. 

Conclusion of VW 2.0

To wrangle vulnerabilities requires intelligence collection and breadth of collaboration. Most importantly, there is hope. Things are getting better as collaboration within and outside of our industries strengthen our methodologies to secure our industries and assets and keep our consumers safe.

Where There is Unity, There is Victory

[Ubi concordia, ibi victoria]

– Publius Syrus

Contact Lares Consulting logo (image)

Continuous defensive improvement through adversarial simulation and collaboration.

©2019 Lares, LLC | All rights reserved.
    Privacy Preferences

    When you visit our website, it may store information through your browser from specific services, usually in the form of cookies. Some types of cookies may impact your experience on our website and the services we are able to offer. It may disable certain pages or features entirely. If you do not agree to the storage or tracking of your data and activities, you should leave the site now.

    Our website uses cookies, many to support third-party services, such as Google Analytics. Click now to agree to our use of cookies or you may leave the site now.