Reduce Time to Security Compliance from Days to Minutes

Information security continues to be a relentless foot race against cyber criminals.  However, the busy CISO has daily worries too – approving and delivering security solutions but, also responding to a myriad of compliance requirements. Most audit reports in modern enterprises run along similar line items which are must-do’s and items that are nice to-do’s. What the audit reports always seem to not understand is the level of effort and time required from the security team to perform the must-do’s. The nice to-do’s almost never get done.

There is one area where CISO’s and their teams can meet security compliance requirements and increase organizational security: vulnerability management, also known as patch management. When the conversation turns to compliance activities, there are two things that are must haves – deploying the patch to the enterprise end-points and reporting on the status of those deployments for security compliance.

The CISO needs the proof the job has been done to appease the auditors and his board members that security compliance is well in hand. The CISO’s team has to test, deploy and remediate machines that did not get patched. It’s not a pleasant or easy task and it takes away from the security team’s constant vigilance and incident response capabilities. It can eat into security project cycles and support to other departments.

Qualasys sponsored a 2016 SANS research paper that suggests that effective cyber defense requires fixing all “critical vulnerabilities in one day, because risk reaches moderate levels at the one-week mark and becomes high when a vulnerability remains in a critical system for a month or longer. Among respondents, 10% reported being able to remediate critical vulnerabilities in 24 hours or less.”

Also Read: Mobile Device Security in the Workplace

The question is of course “is there a solution”? The answer is yes. Vulnerability management of end-points represents a great partnership opportunity with a trusted vendor. If competing priorities and high-value projects are preventing your security team from supporting the business initiatives, than it’s time to consider a provider who can execute the vulnerability management program to maintain compliance and keep the network safe from cyber criminals.