Cybersecurity Insights with Contrast CISO David Lindner | 5/17/24

Insight #1

Would you rather a. keep finding more vulnerabilities and building that security backlog until it leads your organization to a crisis like that at the National Vulnerability Database (NVD), or b. fix/mitigate the already bulging backlog? We will always be able to find more vulnerabilities, but fixing/mitigating is actually the more important part. How fast is your backlog growing? Have you thought about ways to remediate your mean time to respond/remediate (MTTR)? Remedies exist. Stop suffering and start digging out.

Insight #2

Runtime Security. Say it over and over in your head. It is the future and the only way security and engineering teams will be able to accurately detect, protect and prioritize security vulnerabilities in their systems.

Insight #3

I feel like the Secure by Design pledge from the Cybersecurity and Infrastructure Security Agency (CISA) is a PR stunt. However, It doesn’t hurt to revamp your security posture by implementing this approach, which includes incorporating security basics into the product design phase so as to make products “secure out of the box.” That means enabling secure configurations by default and making security features such as multifactor authentication (MFA), logging and single sign-on (SSO) available at no additional cost. Signers of the pledge — there are 68 to date, including the likes of Cisco, AWS, Google, IBM, Microsoft, Lenovo and other companies behind the building blocks of enterprise IT architectures — to implement regular patching, vulnerability disclosure policies, transparent Common Vulnerabilities and Exposures (CVEs) and forensic data about intrusions. Those are all security no-brainers.