Tenable Blog

I recently summarized Tenable’s inaugural Global Cybersecurity Assurance Report Card in the blog, Grading Cybersecurity Around the Globe, pointing out some of the more interesting aspects. Now let’s take a closer look at some of the industry verticals and take a deeper dive into how they ranked against each other.

Over the past several months, I have been writing about how our security model is broken. This blog is the final in this series, and it focuses on four crucial root causes that must be addressed if we are going to fix our broken security model.

Specifically, we need to invest more money, adhere to basic security hygiene, be cyber threat driven not compliance driven, and last but not least, stop retrofitting cybersecurity and build it into systems and applications.

In this final installment of Marcus’ video blog series on security metrics, he discusses several ideas for presenting relevant metrics to your management. He explains what a good metrics chart should look like and why depicting change over time is the best strategy. But metrics are not just for illustrating history; metrics should be used to indicate and implement security improvements.

Marcus wraps up his video blog series with thoughts on how metrics contribute to leadership.

A well-presented metric should show change over time

The Center for Internet Security (CIS) has come forward with their most recent set of information security controls. The previous edition of the Critical Security Controls listed 20 controls for an organization to implement to protect their networks. The most recent edition (CIS Critical Security Controls v6.0) keeps the same number of controls, but replaces one control and adjusts the priority of others.

This is the third installment in my Drifting Out of Compliance series, taking a closer look at organizational approaches indicative of a point-in-time compliance mentality and the challenges of shifting to a continuous compliance mentality. Although a security first, compliance second approach is best, many organizations still struggle to attain the baseline level of security outlined in compliance requirements.