Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Vulnerabilities and exposure

Finding, ranking and fixing weaknesses: scan coverage, priorities and deadlines, and what to do when a fix can't happen in time.

The packs behind these answers

How do we…

Methods: how a thing is done well.

  1. How do we decide what to fix first when the scanner shows thousands of findings?
  2. How do we set remediation deadlines the business will actually agree to?
  3. How do we know our scanning covers everything it should?
  4. How do we run a weekly triage that doesn't turn into a two-hour argument?
  5. How do we defend our prioritisation method to an auditor?
  6. How do we report vulnerability posture to executives without quoting CVE counts?
  7. How do we run a reliable monthly patch cycle with a small IT team?
  8. How do we set up patch deployment rings and maintenance windows?

When do we…

Triggers and timing: when something has to happen.

  1. When is weekly triage necessary, and when is fortnightly enough?
  2. When is a finding closed: when the patch is applied, or when a rescan confirms it?
  3. When do we patch outside the monthly cycle, and how fast?

Who decides…

Authority: who may approve, accept or act.

  1. Who can approve deferring a patch, and for how long?

If…, then how…

Situations: something has happened, what now.

  1. If a vulnerability affects a business-critical service, what happens next?
  2. If an exploited vulnerability can't be patched today, then what?
  3. If the fix depends on a supplier who won't patch, then how do we manage it?
  4. If remediation deadlines are routinely missed, do we change the deadline, the capacity or the scope?
  5. If the scanner reports a critical finding on a system nobody owns, then who fixes it?
  6. If a server can't be rebooted to patch, then what are the options?
  7. If a system is past vendor support and can't be replaced yet, then what?

Other categories