Tenable Blog

In Mr. Robot Season 2 Episode 4, as Darlene and Elliot watch a horror movie, Darlene suggests calling a dinner delivery service called Postmates - a service she hacked using code injection. As they chat, Elliot recalls his previous job. He remembers the details of his pen testing projects, and says it was his job to keep hacking until the company’s systems were “hacker proof.” I asked myself, what is “hacker proof” and is such a thing even possible?

Traditionally, vulnerability scanning—credentialed and/or non-credentialed—has been predominantly a security compliance exercise driven by regulations (e.g. HIPAA, FFIEC) or industry standards (e.g. PCI). The underlying rationale is that periodic scanning is a basic security hygiene process to identify and prioritize vulnerabilities and to demonstrate that security vulnerabilities are regularly patched or fixed. Most organizations perform quarterly scans, some monthly, some less than that.

Inevitably when you threat hunt - you will find something. What happens next? A barrage of questions ensues:

Information security professionals are all on the same journey, to protect customer and employee data, safeguard our company’s intellectual property and trade secrets, and strengthen our company’s brand and reputation. It’s a long, difficult journey, filled with many twists and turns. But it’s our passion for security that keeps us going.

Tenable recently sponsored the publication of an ebook, Using Security Metrics to Drive Action. This ebook is a compilation of thoughtful essays from 33 CISOs and other experts, who all share their strategies for communicating security program effectiveness to business executives and the board. In this article, excerpted from the ebook, Genady Vishnevetsky, CISO for Stewart Title Guaranty Company, talks about how the criticality of assets impacts risk factors.