Community Spotlight #19

Static Application Security Testing (SAST) solutions are crucial for companies as they help to protect against threats and vulnerabilities that can lead to data breaches, financial losses, and reputational damage.  Benefits include: Identifying vulnerabilities: Detects potential security flaws in applications before they can be exploited by attackers. Compliance with regulations: Ensures that applications are in compliance with security standards and regulations, avoiding legal penalties and fines. Enhanced customer trust: Boosts confidence among clients and customers in the company’s commitment to maintaining a secure environment. Cost savings: Addressing issues early in the development process reduces the costs associated with security incidents and data breaches. Competitive advantage: Provides a competitive edge by ensuring applications are secure and resilient, appealing to security-conscious consumers and business partners.

Come on guys, the correct answer to this is the Microsoft Admin Portal and your Azure Admin and the Security and Compliance centers. Everyone wants to buy new SaaS when most of the Controls and Safeguards are built into  MS. Steven Palange, steven_palange@tlic.com reach out for any and all your SaaS renewals. 

For small companies, utilize the tooling you already have in place like the MS Office or the Atlassian Suite, etc. Ultimately, as you grow towards enterprise scale, Archer and ServiceNow (Governance, Risk, Compliance) can help with everything from compliance workflow to tracking incidence response. As a Cyber Architect in a corporate Fortune 500, we use a medley of integration with our SIEM, Vulnerability Tool, and all the collected data can be accessed by Tableau to generate a dynamic web graph. When you start tracking vulnerabilities and incidents, the data you accumulate can be expressed in your appropriate CPI. If you lack data for a particular CPI, then you may a gap in your cyber program.

Thanks for this informative article.

OWASP is nice, but very specific and currently limited. How about trying ISO-24772 for all?