Tenable Blog

In a new article on BetaNews, Tenable’s Jeffrey Man discusses the viability of cybersecurity insurance for companies that experience payment card breaches. “Is cyber insurance your last line of defense?” examines the impact of litigation on retailer liability and PCI compliance.

Continuing his blog series on SecurityWeek, Tenable’s Marcus Ranum discusses the challenges in presenting and comparing system metrics. Metrics should be normalized and placed in context for effective communication. He uses several stock market charts to reinforce his message.

The latest Patch Tuesday from Microsoft (November 11, 2014) includes fixes for some major vulnerabilities, including remote code execution bugs affecting core Windows components and Internet Explorer. The three major bulletins of note are MS14-064, MS14-065 and MS14-066, all of which have a CVSS score of above 9.0.

At a recent conference, I heard a security practitioner blame a couple of users for being dummies who click on everything. He then said, “At a certain point, it's reasonable to blame the user. It's just like when someone parks a car with the keys in it, in a known bad neighborhood. You have to take ownership of your actions.” Well, yes and no.

The “cyber kill chain®”¹ is a model for framing an incident response/analysis capability that was developed by Lockheed Martin’s Computer Incident Response Team. It is a useful framework for talking about and reasoning about why and how we do things in security. The term “kill chain” is admittedly violent when you consider that we're talking about an environment in which, ideally, nothing of the sort is happening.