How do you stay informed about the latest patches and vulnerabilities?

I stay informed about the latest patches and vulnerabilities by regularly checking reliable sources like security blogs, CERTs websites, news websites, and official announcements from software developers and cybersecurity organizations. These sources provide updates on newly discovered vulnerabilities, patches released by software vendors, and recommendations for mitigating security risks. Additionally, I listen to experts in cybersecurity communities to stay updated on emerging threats and the best ways to manage patches.

Vulnerability Scanners: Use vulnerability scanning tools that can actively scan your network and systems for known vulnerabilities. These tools can provide reports on potential weaknesses that need patching. Security Mailing Lists: Join security mailing lists and forums related to your specific technology stack or industry. Lists like the National Vulnerability Database (NVD) or the Common Vulnerabilities and Exposures (CVE) system can provide timely updates on vulnerabilities. Bug Bounty Programs: If your organization participates in or hosts bug bounty programs, you'll receive reports of vulnerabilities identified by ethical hackers and security researchers.

One thing I have found helpful is to review the known exploited vulnerabilities (KEV) catalog provided by CISA to help understand and prioritize the umpteen number of vulnerabilities through the various sources.

In my experience it is great to have at least two vulnerability tools. Depending on your budget or SOC type (if you have some tooling in place and decide to go hybrid SOC), have one full VS suite deployed across your network and potentially the other one on a smaller scale. The results in general are similar but scanning techniques differ and due to this, in certain cases, the scan results differ as well.

In my opinion, assessing risks based on patches and vulnerabilities will start with the scope. That is the inventory of assets that continues to evolve and the technology within those various assets that are patchable. Thereafter the risk/reward factors, effort, and industry relevance help determine the priority.

#??2??2?? ?? Host a Question and Answer session, plus tell a story, and add in some humor: Q: How did the hacker get in? A: Someone left their Windows open. Q: How did hacker get away? A: Used the backdoor and ransomware. Q: Why couldn't the witness identify the hacker? A: Used Spyware and Subnet Mask to hide identity. Q: How did the hacker get caught? A: CSIRT used a Bug, to lure in Scattered Spider, and they got stuck in the Web. A2: The CSIRT used Python to Byte...well, let's just say that a little bird (a.k.a. Parrot) did some squawking, but now they are done talking. Q: What happened to the hacker after getting caught? A: Police made them WannaCry by clearing their cookies. A2: FBI made their Heartbleed by deleting their cache.

Patch management has been an integral part of IT. Though protection of endpoints remains the intent, the benefits of patching extend to regulatory standards and laws that protect data as well (GDPR, HIPAA, SOX, OCPA, CCPA). With Crime as a service on the rise and the threat actor creativity growing, it will help share daily information with the patching task force with an indication of risk, impact, and relevance.

If you're heavily reliant on external resources e.g. open source tooling, having a patching calendar for your services will help you strike a balance between keeping your services up to date and not having your team overwhelmed with multiple impromptu upgrades. Things to consider would be - The release cycle of the services you rely on - Your team's capacity to carry out the upgrades alongside other planned tasks - Being cautious of not being too early in your adoption to allow for new version to be tested and running in production smoothly before your team adopts Note that security vulnerabilities should take precedence over your patching cycle.

Companies with large networks and a high number of product offerings can be overwhelmed with vulnerabilities. - Start a security champions program for ownership. - Find ways to automate asset inventory with new systems or products. - Incorporate vulnerabilities into your stand up calls.