IT Security Department

Question 1

What is the cycle that a security department runs?

Answer 1

Validation and Remediation. (after establishment)

Question 2

What is included in Security Validation?

Answer 2

1. Technology Aspect, most urgent technologies you need to implement IE training program if you have a lot of phishing attacks.
2. Network configuration. Find all misconfigurations that make you vulnerable.
3. Patching, validate that all security updates and updating with all software inside organization.

Question 3

What is the human factor in security validation?

Answer 3

Make sure employees have correct education. Make sure people are using passwords, managing domain admins correctly. IF you arne’t doing it right you are opening up yourself to vulnerabilities.

Question 4

What percentage is spent on validation vs remediation?

Answer 4

10% Validation, 90% Remediation

Question 5

What are the three pieces needed for REAL security validation?

Answer 5

1. Comprehensiveness, needs to be conducted across the entire network.
2. Continuous, IT infrastructure is chaning all the time, it is not enough to have a yearly cycle. Dynamic changes need to be followed up on, also there is a growing list of attacks.
3. Zero false positives or negatives. In other words, dont be spending limited resources on remediations that aren’t necessary.