A Quest for Indicators of Security Debt
By Simo Huopio
| March 23, 2020
Security Debt (SD) manifests itself every day: In the media, we can witness stories about debt defaults: significant data leaks, disruptions of service, and businesses of global companies affected by security incidents. Critical infrastructure customers need more practical tools to ensure that the SD is properly identified in order to make informed risk decisions. Existing tools like security audits and cross-referencing system configuration with available vulnerability information do reveal a lot of data regarding the present state of the system. Many tools that can bring up the hidden security issues like ones included in Secure Development Lifecycles (SDLC) are tuned for the product creation. Some of them can be taken into good use by the customer, but for that, the system should be already procured and in place. In practice, the customer would benefit from a comprehensive and realistic view of the security stance of the system when it is being procured to minimize the nasty surprises the underlying security issues are prone to bring.
FULL ARTICLE HERE