Kämpfen Sie vergeblich für mehr IT-Security-Budget? Fragen Ihre Vorgesetzten immer wieder, was Sie als Sicherheitsverantwortlicher genau machen? Dann sollten Sie dieses eBook lesen. Es liefert Ihnen die vier besten Argumente für ein besser finanziertes Vulnerability-Management.
Inhalt:
Zu wenig Geld, zu wenig Personal zu wenig Anerkennung – 60 Prozent aller IT-Security-Verantwortlichen kämpfen laut dem „State of Cybersecurity 2020“-Report der Information Systems Audit and Control Association (ISACA) mit diesen Problemen. Was aber soll man einem Vorgesetzten sagen, wenn dieser nach dem Return-on-Invest (ROI) der angeforderten Sicherheitsinvestitionen fragt? Die Antwort finden Sie in diesem E-Book. Erfahren Sie unter anderem
- Wie Sie typische Fehler bei der Effektivitätsmessung von Sicherheitsproblemen vermeiden.
- Wie Sie Führungskräften den Wert Ihrer Maßnahmen veranschaulichen.
- Wie Sie den ROI Ihres Vulnerability-Management-Programms berechnen.
- Wie Sie endlich für sich und Ihr Team die verdiente Anerkennung erhalten.
Originalauszug aus dem Dokument:
For many years, the metrics we used to gauge the success of our vulnerability management operations were selected not-so-strategically, leveraging the information that was most readily available rather than what made sense for bigger-picture context.
Let’s take a few examples: Number of unpatched vulnerabilities or number of assets assessed
These numbers may sound important at first glance, but are of very little use to non-technical stakeholders like executives and board members; this is because they provide no link back to the priorities of the business, and are also not actionable.
CVSS score
While CVSS score can be a useful baseline metric to understand the nature of a vuln in isolation, it needs to be considered alongside metrics like malware exposure, exploit exposure, vulnerability age, and the importance of the asset to the organization. This added context helps you prioritize the risk most needing your attention. And, once again, CVSS score is unlikely to resonate with a non-technical audience.
Metrics outside of your team’s control, like aggregate risk score or number of cyber attacks
Wait... what? That’s how I’ve been doing this for years. We know—but stick with us on this—what if right before you walk into a board meeting, there is a huge Patch Tuesday? Your aggregate risk score is going to spike, suggesting that your team has fallen down on the job, despite likely making progress since the last board meeting. Be cautious of these metrics, as you may be shooting yourself in the foot further down the line.