Priority-based approach to Risk Management Careful Balance Asset Value, Vulnerability Severity, Threat criticality Enterprise Resources Are Limited – Think ROSI

1. Vulnerability Manager (a.k.a. Foundstone Enterprise) Dragos Lungu Provision Professional Services IASI, Nov.6 2008

2. Software Today CVE-2008-6432 CVE-2008-6426 CVE-2008-6339 CVE-2008-4990 CVE-2008-4989 CVE-2008-4988 CVE-2008-4987 CVE-2008-4986 CVE-2008-4985 CVE-2008-4984 CVE-2008-4983 CVE-2008-4982

3. Microsoft Security Advisory (958963): 10/27/2008 Microsoft Security Advisory (956391): 10/14/2008 Microsoft Security Advisory (951306): 10/9/2008 Microsoft Security Advisory (953635): 8/12/2008 Microsoft Security Advisory (954960): 8/12/2008 Microsoft Security Advisory (955179): 8/12/2008 6th Nov, 2008 Debian update for mysql-dfsg-5.0 Ubuntu update for system-tools-backends Fedora update for net-snmp Fedora update for enscript Fedora update for ktorrent Fedora update for uw-imap 5th Nov, 2008 Ubuntu update for kernel Red Hat update for openoffice.org 4th Nov, 2008 Red Hat update for net-snmp Gentoo update for opera Ubuntu update for enscript Red hat update for kernel Reaction Today

4. Inefficient Tools Manual Prioritization Of Remediation Online Search For Breaking Threats Poor Ticketing System (Email) Subjective Estimation of Risk Profile And Tolerance Remediation Today

6. Management Speaks Money

7. McAfee Vulnerability Manager? Vulnerability Manager Appliances Complete, plug and play hardware platforms Manage and mitigate security risks with zero-maintenance appliances Vulnerability Manager Vulnerability management and policy compliance solution Reduce risk and protect your most critical assets Vulnerability Management Service Hosted vulnerability management Simple, convenient, and cost-effective YES WE CAN !

8. Thank You ! Dragos Lungu [email_address] Photos provided by Flickr.com