Tenable Blog

A lot of companies are offering global information about threats that is of no relevance to our company, our customers, or our global portfolio, said Stan Black, CSO of Citrix, in our conversation at the 2015 Black Hat Conference in Las Vegas.

Black is frustrated with vendors who show off their entire threat portfolio for which his company only needs a small subset. Problem is he doesn’t know what that is, nor do the vendors. It’s a complete lack of actionable threat intelligence.

According to WhiteHat Security stats, the average time to fix a website vulnerability after it has been reported is 150-180 days.

Remediation is obviously an issue, and the failure to fix (only half ever get fixed) is purely a situation of lack of resources, said Jeremiah Grossman (@jeremiahg), founder of WhiteHat Security, in our conversation at the 2015 Black Hat Conference in Las Vegas.

Working at an unnamed large bank and as faculty at IANS, Alex Hutton (@alexhutton) admits his biggest challenge with vulnerability management is the removal of false positives, and getting the business to act on the vulnerabilities they’re responsible for.

Plus, the way vulnerabilities are presented, Hutton’s given an impossible task. He can’t do 30,000 risk assessments nor issue 30,000 tickets.

When I asked Wendy Nather (@rciscwendy), research director at R-CISC, if there was any way we can measure the value of investing in security, she simply said, “No.”

The problem, said Nather, is we don’t know what to buy. This eye-opening realization came about when Nather did a study where she asked security professionals what CISOs should buy. She got so many suggestions from the professionals recommending anywhere from 4 to 31 different technologies.

Information overload is a symptom of the problem of too many disparate point solutions that are not integrated and correlated, explained Adrian Sanabria (@sawaba), senior security analyst, 451 Research, in our conversation at the 2015 Black Hat Conference in Las Vegas.