NopSec.com uses cookies to make interactions with the Company’s Websites easy and meaningful. When you visit one of the Company’s Websites, NopSec.com’s servers send a cookie to your computer. Standing alone, cookies do not personally identify you; they merely recognize your Web browser. Unless you choose to identify yourself to NopSec.com, either by responding to a promotional offer, opening an account, or filling out a Web form (such as a “Contact Us” or a “Free Trial” Web form), you remain anonymous to the Company. Please go to our privacy statement for details.

Acknowledge

DevOpS and Remediation Task Management

Lately a lot of attention has been directed towards the “DevOps” or “SecOps” disciplines and for good reasons. According to Wikipedia here, “DevOps” can be defined as: “a software development method that stresses communication, collaboration, integration, automation, and measurement of cooperation between sofware developers and other information technology professionals. DevOps acknowledges the interdependence of software development, quality assurance, and IT operations, and aims to help an organization rapidly produce software products and services and to improve operations performance.

DevOps also describe the interdependecies between security and other part of the IT organization such as the development team and / or the sysadmin group. This interdepency is called “SecOps”.

One of the most important function of the security group is vulnerability management, the activity aimed at detecting, prioritizing and remediating software vulnerabilities in infrastructure and applications. Most of the security professionals know that is one thing to find vulnerabilities and the other successfully prioritizing and remediating them, since this task involves working with other IT groups such as the app developers and the sysadmin / netadmin groups. So more policy boundaries to cross.

One of the many suggestions our customers gave us about our solution Unified VRM, is that it is hard for developers / sysadmins to work with single tickets representing one vulnerability affecting one single asset. Those groups work with tasks, aggregating for example several tickets related to one asset group or one specific vulnerability under a specific task. The tasks can then be managed moving the cards from different “lanes” based on their statuses as “to do”, “in progress”, “done, to be verified” and “verified”. The “Verified” column is only reserved for tasks where all the tickets have been closed / remediated manually and then verified by a recurring / subsequent vulnerability scan.

We listened and we created the “Task management” tab of remediation, aka the “Kanban board”. We are very proud of this you addition to Unified VRM as it allows the security department to assign tickets to specific tasks and specific people. It also allow the Devops or the SysAdmin group to manage their tasks until completion and verification, accomplished through a subsequent scan. This ultimately fosters collaboration among IT departments in remediating security vulnerabilities, one of the most difficult result to be accomplished in vulnerability management.

As usual, I provide a brief video showing Unified VRM interface using the Kanban board and Task Management functionalities.

Related Posts

Schedule a Product Demo Today!

See how NopSec's end-to-end Cyber Exposure Management platform can organize your security chaos.