登录查看更多内容

How can you ensure your security plan adapts to new threats?

由人工智能和领英社区提供技术支持

Security is not a one-time project, but a continuous process that requires constant vigilance and adaptation. As a computer engineer, you need to be aware of the latest threats and vulnerabilities that could compromise your systems and data, and how to respond and recover from them effectively. In this article, we will discuss some strategies and best practices that can help you ensure your security plan adapts to new threats.

此文章中的业界达人

由社区从 5 条内容中精选。了解更多

Santosh Kumar Jha
Mehul Doshi
Gauri Yadav

Docker Captain @Docker.Inc ? Google Program Mentor ? Cloud Intern @Gavedu ? DevSecOps Culture ? Kubernetes ? 3x Azure…

1 Assess your risks

The first step to creating a security plan is to assess your risks and identify your assets, threats, and vulnerabilities. You need to know what you are protecting, who might want to attack you, and how they might do it. You can use tools and frameworks such as NIST SP 800-30, OCTAVE, or FAIR to conduct a risk assessment and prioritize your actions based on the likelihood and impact of different scenarios. You should also review your existing security policies, procedures, and controls, and check if they are aligned with your business objectives and compliance requirements.

添加您的观点

Gauri Yadav

Docker Captain @Docker.Inc ? Google Program Mentor ? Cloud Intern @Gavedu ? DevSecOps Culture ? Kubernetes ? 3x Azure Certified ? Technical Speaker ??
举报内容
Begin by identifying hazards before developing a security plan. Identify assets, threats, and vulnerabilities to gain a better understanding of what needs to be protected and prospective attackers. Use risk assessment methods such as NIST SP 800-30, OCTAVE, or FAIR to help prioritize critical actions.

已翻译

赞
Jeff Dunn

Security Engineer
举报内容
In my experience it is not enough to just know your vulnerabilities. You also have to know what is likely to occur based no active exploitation or what is exposed to the internet. If a low score vulnerability exists on hardware or software that is exposed to te internet, it is much more likely to be exploited and should be a priority when patching/upgrade windows occur.

已翻译

赞

2 Implement preventive measures

The next step is to implement preventive measures that can reduce your exposure and prevent or deter attacks. These include technical, administrative, and physical controls that can enhance your security posture and resilience. Some examples of preventive measures are encryption, firewalls, antivirus, authentication, authorization, backup, patching, auditing, training, and awareness. You should also follow the principle of least privilege, which means granting the minimum access and permissions needed for each user and task. You should also adopt a secure development lifecycle (SDLC) that incorporates security into every stage of your software engineering process.

添加您的观点

3 Monitor and detect anomalies

The third step is to monitor and detect anomalies that could indicate a breach or an attack. You need to have visibility and awareness of your network and system activities, and use tools and techniques that can alert you of any suspicious or abnormal events. These include log analysis, network traffic analysis, intrusion detection systems (IDS), intrusion prevention systems (IPS), security information and event management (SIEM), and threat intelligence. You should also define your baseline and thresholds for normal behavior, and tune your detection mechanisms accordingly.

添加您的观点

4 Respond and contain incidents

The fourth step is to respond and contain incidents that could cause damage or disruption. You need to have a security incident response plan (SIRP) that defines your roles, responsibilities, procedures, and communication channels for handling incidents. You should also have a security incident response team (SIRT) that can coordinate and execute the response activities, such as identification, analysis, containment, eradication, recovery, and reporting. You should also follow the incident response lifecycle, which consists of preparation, detection and analysis, containment, eradication and recovery, and post-incident activity.

添加您的观点

Harshavardhan Bajoria

Associate Product Manager @Unstop | GitHub Campus Expert | Knight @LeetCode | Microsoft Certified *7 | Google Certified CDL | GitHub Certified x1 | Azure Developer Lead | Top Mentor @Unstop
举报内容
Embrace adaptation; acknowledge that the usual business practices won't be normal for a while. Confront the reality of a changing landscape with cyber threats, including a new breed exploiting human suffering. Stay vigilant against evolving threat actors adapting to exploit emerging opportunities.

已翻译

赞

5 Recover and restore operations

The fifth step is to recover and restore operations that were affected by the incident. You need to have a backup and recovery plan that outlines how you will restore your data and systems to their normal state. You should also have a business continuity plan (BCP) and a disaster recovery plan (DRP) that describe how you will resume your critical business functions and processes in case of a major disruption. You should also test and validate your backup and recovery procedures regularly, and update them as needed.

添加您的观点

6 Learn and improve

The sixth and final step is to learn and improve from the incident and your response. You need to conduct a post-incident review (PIR) that evaluates the effectiveness and efficiency of your security plan and your response actions. You should also identify the root causes and the lessons learned from the incident, and document them in an after-action report (AAR). You should also implement the recommendations and corrective actions that arise from the PIR and the AAR, and update your security plan accordingly. You should also share your findings and best practices with your stakeholders and peers, and seek feedback and improvement opportunities.

添加您的观点

Santosh Kumar Jha
举报内容
This is one of the most important step in order to prevent future cyber incidents. Each and every learning, the root cause analysis, the IoC, IoA, the AAR should be taken into account and should be shared among other respective stakeholders. As per the findings and all if required security plan/ incident response plan should be updated accordingly.

已翻译

赞

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Mehul Doshi
举报内容
How do you plan your security to adapt to new threats? The secret lies in readiness for come what may come as predicting or limiting to risk management findings are prioritization task and crucial for operations however security plan should have an uncertainty readiness and team colleagues which are cyberwar hardened with adequate tools and skill to address what was not an perceived threat.

已翻译

赞

Computer Engineering

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How can you ensure your security plan adapts to new threats?

1

2

3

4

5

6

7

1 Assess your risks

2 Implement preventive measures

3 Monitor and detect anomalies

4 Respond and contain incidents

5 Recover and restore operations

6 Learn and improve

7 Here’s what else to consider

Computer Engineering

给文章评分

感谢您的反馈

更多Computer Engineering相关文章

更多相关阅读内容

How can you ensure your security plan adapts to new threats?

1

2

3

4

5

6

7

1 Assess your risks

2 Implement preventive measures

3 Monitor and detect anomalies

4 Respond and contain incidents

5 Recover and restore operations

6 Learn and improve

7 Here’s what else to consider

Computer Engineering

给文章评分

感谢您的反馈

查看其他技能