Heartbleed and the Vulnerability Management Lifecycle
Heartbleed scores a 7.5 on CVSS, High and not Critical, yet it set off a global scramble. Here's how it moves through the vulnerability management lifecycle, from triage to verification.
Tag: #vulnerability-management
Equifax: A Breach With Five Separate Points Where It Could Have Stopped
The 2017 Equifax breach exposed 143 million Americans' data — not because of one sophisticated attack, but because five ordinary controls quietly failed at once.
Field Notes: A Quarterly Nmap and Nessus Audit, and the Testing Plan Behind It
Nmap flagged a 10.0 on a Samba host. Here's a quarterly Nmap and Nessus scan routine, plus the validate, fix, and re-scan testing plan that turns raw scan results into vulnerabilities actually closed.
Heartland Data: Compliant, but Breached
Heartland Payment Systems was PCI compliant while attackers were inside its network. When it disclosed the breach in January 2009, the theft was described as possibly the largest credit card crime in history. Based on public reporting and published analysis; sources are linked...