S5E3: Patrick Garrity - Vulnerability Research, Management and Visualizations
Sep 24, 2023
auto_awesome
The podcast discusses the importance of visualizations in vulnerability management and how they help non-technical individuals understand the need for vulnerability management. It also explores the process of selecting vulnerabilities for the CAV list and the challenges faced by CISA. The significance of leveraging commercial threat intelligence, prioritizing vulnerabilities, and managing vulnerability backlogs is highlighted. The speaker shares their journey in the cybersecurity field and emphasizes the importance of addressing cyber resilience.
35:19
AI Summary
AI Chapters
Episode notes
auto_awesome
Podcast summary created with Snipd AI
Quick takeaways
Aligning stakeholders and creating a plan are crucial in developing cyber resilience.
Starting small, networking with practitioners, and gaining hands-on experience with data visualization can lead to meaningful insights in vulnerability research.
Deep dives
The Importance of Alignment and Planning in Cyber Resilience
Aligning stakeholders and creating a plan are crucial in developing cyber resilience. It is important for organizations to prioritize security and take it more seriously due to the national security implications. Organizations should focus on hardening and sustaining security measures to protect against cyber threats.
Getting Started in Vulnerability Research and Data Visualization
When getting started in vulnerability research and data visualization, it is important to start small and focus on a specific area of interest. Networking with practitioners and gaining a deep understanding of the problem is essential. Getting hands-on with data and playing around with it can lead to meaningful insights. Sharing visualizations and iterating based on feedback is crucial for growth in this field.
The Need for Secure by Design and Secure by Default Products
There is a growing need for secure by design and secure by default products in the cybersecurity industry. Vendors should listen to the push for secure products and systems to drive more secure software development. Incentives, such as repercussions for repeated vulnerabilities and competitive differentiation, can play a role in motivating vendors to prioritize security.
Addressing the Vulnerability Management Challenge
Effective vulnerability management requires alignment with stakeholders and a focus on precision and prioritization. Starting small and setting achievable thresholds for vulnerability remediation can build momentum and success. Automation and root cause analysis are important components to consider in vulnerability management strategies. It is also crucial to look beyond the known vulnerabilities and leverage additional threat intelligence sources.
Nikki - I wanted to ask you first what got you so passionate about vulnerability management - what was it that first sparked your curiousity and interest into security research?
Nikki - You do a lot of awesome graphics and visualizations of vulnerability data from both CISA KEV and around types of CVE's - what kind of statistics do you think are most important for security practitioners to know - and on the other side, what is most important for executives to understand?
Chris - You've now begun to even start to submit known exploited vulnerabilities to CISA to be added to the KEV, can you tell us about that experience, how you're identifying them and how the process has been?
Chris - We talk a lot about the need for vulnerability context, going beyond CVSS and using things such as KEV and EPSS. In your work, how do you see organizations leveraging context to help vulnerability prioritization?
Nikki - We know that organizations could have a backlog of up to 10k vulnerabilities - based on some recent statistics. Where do organizations start? How do they get a handle on vulnerability management?
Chris - What are some other trends you see in Vulnerability Management that organizations can use to start to get a handle on things?
Chris - You've made the transition from marketing to vulnerability research, visualization and some would say industry leader. Can you speak about the journey and advice for others looking to follow a similar path?
Nikki - What's next for you - besides being the pre-eminent vulnerability researcher in this space?
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode