Vulnerabilities are everywhere and on every IT asset within an organization. This makes vulnerability management one of the most important – if not the most important – risk mitigation activities an organization undertakes. But, the complexities inherent in many organizations combined with the sheer number of vulnerabilities leaves many not knowing where to even begin when it comes to vulnerability management. On today’s episode, we’ll demystify vulnerability management by defining some context, outlining an effective vulnerabilities management program, discussing potential challenges, tying it all to compliance, and decoupling vulnerability management from the inherent complexities.

Today’s guest is Andrew Overmyer, Security Assessor, subject matter expert, and general cybersecurity jack-of-all-trades at Kratos. During our conversation, we distill this often-nebulous concept into the concrete tenets necessary to build an effective program to drive vulnerability remediation efforts.

Resources:

·       The Core Tenets of Vulnerability Management

o   Asset Management: a tool or set of tools accompanied by a process that build and maintain an accurate asset inventory; an asset inventory must include but not be limited to network segments and IT assets across all types

o   Patch Management: a tool or set of tools accompanied by a process that supports identifying and applying patches

o   Vulnerability Scanning: a tool or set of tools accompanied by a process that support identifying vulnerabilities on IT assets; vulnerability scans must be run with credentials, to the greatest extent possible, to fully identify vulnerabilities present

o   Compliance Scanning: a tool or set of tools accompanied by a process that support identifying misconfigurations on IT assets; misconfigurations are deviations from a defined baseline (e.g., Center for Internet Security benchmarks)

·       Vulnerability Scanning Schedule

o   Daily: Asset scans to identify assets on the network; these are not vulnerability scans, but rather simple scans to identify assets on the network

o   Weekly: Vulnerability scans of all assets on the network

o   Monthly: Compliance scans of all applicable assets on the network

·       CVSS: Common Vulnerability Scoring System Version 4.0

·       EPSS: Exploit Prediction Scoring System

·       SSVC: Stakeholder-Specific Vulnerability Categorization

The number of compliance frameworks is seemingly endless. The lack of standards is problematic enough. Even more problematic, however, is how the compliance frameworks overlaps with one another. When it comes to International Trade and Export Compliance, the problem is overlap is accentuated by the fact that there is not a definitive ‘framework’ for export compliance. Nearly everything is determined on a case-by-case basis.

Today’s guest is Sara Hougland, Director of Trade Compliance here at Kratos. During our conversation, we cover export compliance at a high level, discuss the concept of “due diligence”, distinguish ITAR from EAR (and vice versa), and talk about the specifics of export compliance. As mentioned above, ITAR compliance is not a one-size fits all approach. Sara brings her extensive knowledge and experience in the field to provide great information on what, exactly, “ITAR compliant” means and how it benefits an organization.

Some recent estimates have postulated that data is now the world’s most valuable asset. Unlike other assets, like oil, for example, data proliferates on a staggering scale. In other words, it doesn’t seem to be finite, subject the law of scarcity. This hammers home the importance of answering the question that each of you are wrestling with: how do I protect all this data? A simple answer to this question is encryption. But any simple answer has you immediately asking more questions: what encryption should I use? How should I configure it? How can I be sure it is adequate? And, perhaps most interestingly, is it possible to future proof my data protection techniques?

Today’s guest is Evgeny Gervis, CEO of SafeLogic. SafeLogic, founded in 2012, is a leading cryptographic solutions provider. Their validated, holistic, and interoperable cryptographic solutions enable enduring privacy and trust in the ever-changing digital world. Used by many of the world’s top technology firms, SafeLogic expedites and streamlines the adoption of FIPS 140-validated classical and post-quantum cryptography.

Beyond simply using encryption to protect data, we dive into the intersection of compliance and encryption, specifically the role of the FIPS standard for encryption. While Evgeny provides technical expertise, I share some important compliance guidance and nuance we’ve learned from years of supporting our clients in evaluating FIPS 140 implementations. To close, Evgeny and I discuss the future of encryption, standards, and the likely effect of quantum computing.

One of the greatest challenges to security compliance are exception cases. What are exception cases? They are the cases in which a particular compliance objective cannot be achieved, as required. The reasons are myriad: cost, environmental constraints, vendor dependency, and technical limitations. Building an exception case is key to achieving compliance objectives, such as an authorization to operate. The pre-requisite to exception cases is transparency. An organization must transparently articulate the need for an exception. Understanding exceptions is important for fully understanding the risk present within an environment or system.

Today’s guest is John Santore, Director of the FedRAMP Capability at Kratos. John and I dive deep into the specifics of the exception cases, including justification, compensating controls, and fallback plans, and the important role each plays in determining the viability and permissibility of exceptions. Using exception cases as a launching point, we also discuss the need to move beyond compliance as an exercise and toward maturity built into cybersecurity practices. Finally, we veer left a bit for a discussion on the recently-released DoD FedRAMP Equivalency Memo.