December 2022 - Seemplicity

It’s that time of the year again. With 2022 behind us, you are probably considering your new year’s resolutions and setting your security team’s goals for 2023.

So how can you ensure remediation effectiveness and add value to the risk reduction process this year?

It’s time to put tracking of Security SLAs at the top of your resolution list – and instead of letting SLAs get lost in the shuffle of daily tasks, turn them into practical and measurable goals.

What is Security SLA Tracking?

Many organizations outline service-level agreements (SLAs) for remediation in their security policies. SLAs define expectations of how quickly security teams should address problems and how to prioritize risk levels.

Often SLAs require security teams to fix certain risks within a specific time frame. For example, many companies aim to fix vulnerabilities with a CVSS Score of 7+ in 30 days or less and a 4+ CVSS score in under 90 days. The SLAs vary from company to company and depend on their security maturity.

The Importance of Security SLA Tracking

Security SLAs, while important, are usually purely theoretical. They often get lost in the shuffle of daily tasks and management requests.

The first issue is the lack of accountability. It’s easy to forget the SLA deadlines when there is no system in place to call out if they are not met.

The second issue is that it’s equally challenging to prioritize SLAs when there’s no way of knowing which risks need to be addressed first. What happens when there is a backlog with multiple SLAs at risk of being late or not met? Or even worse, when a security team works on too many remediation tasks simultaneously with no way of tracking the SLA statuses?

Next, there is a lack of visibility into the remediation efforts. Knowing exactly how many issues have been fixed and which ones are still outstanding requires a system that can track efforts and results. It can be hard to find out if risks are being addressed fast enough, if they’re being prioritized correctly, or who’s responsible for fixing them.

Another victim of the lack of visibility is collaboration between security and dev teams. Without a good tracking system in place, it can be hard to establish effective channels of communication. Nobody likes to have to ask the same questions all over again, and if there is no visibility into the progress of tasks, it can lead to delays and frustration.

Without a system to track the amount of work required for resolution and real-time communication between all the counterparts involved, there is zero accountability or visibility into who is responsible for fixing a risk, when it needs to be fixed, and whether it has been achieved.

Effective Security SLA Tracking

Here are the good news: with the right tools in place, all these issues can be solved.

There is a saying: what is measured can be managed.

That’s why effective security SLA tracking is so important. Companies need tools to measure the extent of work before imposing an SLA on their “fixer” teams – developers, DevOps, or IT.
In short, they need a data-driven approach to prioritize, set, and manage timeframes for different remediation tasks.

Security teams need tools to help them answer high-level questions like:

Are we meeting our SLAs?
How long does it typically take to fix a risk?
Are there any recurring issues that keep coming up, and if so, what is the typical resolution time for those?

They also need tools to keep track of ongoing remediation efforts:

What is the progress on the SLA fix for a specific risk?
What is the current status of the remediation efforts?
Who are the people responsible?
What capacity do they have left for new tasks?

Manual Work is in the Way of Accurate Security SLAs

There are many moving parts to remediation – getting a unified list of all security findings, identifying who is responsible for fixing them, opening remediation tickets, and ensuring they are followed up on. Reports and SLAs are an integral part of it, giving a bird’s-eye view and insights into the entire process.

But since remediation still relies heavily on manual work, getting these insights is not an easy task.

Today’s security teams manually collect data from siloed scanning tools and try to deduplicate and prioritize to-dos. Since the security teams cannot fix the risks they find, they have to act as a “middleman” and run manual processes to delegate remediation tickets to different “fixer” teams.

Getting metrics such as average time to remediation, open vs. closed findings, SLA compliance, and many more can be very challenging when there is no automated tracking of the remediation steps.

With manual and fragmented processes, how can you expect to track remediation, let alone set goals and KPIs or monitor SLAs?

Security SLAs as Part of a Holistic Remediation Process

What’s the key to simplifying the complexity of the remediation process and its tracking?

Automation and data-driven processes.

Having a risk reduction platform in place that automates remediation workflows from start to finish assures having all the remediation-related data built into it.
The data can then be distilled into meaningful insights and actionable items, providing better visibility and end-to-end accountability for the remediation process.

To make sure that SLAs are met every time and at all levels, organizations need a platform that will allow them to:

Define multiple SLAs based on the organization’s needs, including deadlines and priorities
Track the progress of security SLAs across teams and business units
Identify and report bottlenecks and quickly detect any potential delays or failed commitments
Automatically assign tasks to the right person or team when a risk is identified
Monitor performance to ensure that SLAs are being met
Provide visibility into the lifecycle of remediation activities

Security teams can ensure they are meeting their deadlines and maintaining accountability by having a risk reduction platform. And with standard operating procedures in place, your organization will benefit from improved security posture.

Improved SLAs are a new year’s resolution you can actually keep with the right tools in place.

With Seemplicity, you can:

Scale and automate risk reduction workflows into one platform
Get full visibility of the end-to-end remediation lifecycle
Track progress & reduce time-to-remediation
Track remediation progress by teams, tools, severity, and more
Plan ahead with expected workloads according to SLA
Empower developers to own the security backlog

We invite you to schedule a Seemplicity demo today. Happy 2023! 🥳✨🎇

On a quiet Sunday morning in 1904, a fire broke out on the west side of downtown Baltimore. It started to spread quickly, and soon it became apparent that the city’s firefighters could not fight it alone. Immediately, calls for help were telegraphed to other cities.

Fire companies from New York, Philadelphia, Wilmington, Harrisburg, and elsewhere rushed in to help and had more than enough water and people to fight the fire.

There was only one problem – most of their fire hoses wouldn’t fit Baltimore’s hydrants. So with many firefighters having to sit on the sidelines, the fire prolonged to 31 hours and damaged an area the size of 80 blocks.

How could that be, you ask?

Apparently, in 1904, there were roughly 600 varieties of fire hydrant hose couplings and outlets in the US. This incident brought the National Fire Protection Association to push for a change, and in 1905 a standard was proposed and adopted by several large US industry groups.

Similarly, Security Teams are also Left Alone to Fight the Fire.

The Great Baltimore Fire ended up being the most destructive in the United States since the Great Chicago Fire. You can’t help but think how much damage would have been avoided if reinforcements could help.

It’s a tragic example demonstrating the critical importance of standards for products that need to interoperate for the safety and protection of individuals.

Ironically when it comes to the cyber security world, lack of standardization is still a common problem.

Security teams have to manage endless lists of security findings from disparate scanning tools, not to mention the constant hand-raising and spreadsheet management that is still prevalent for tracking the progress of remediation tasks.

These fragmented processes increase friction, slow remediation down significantly, and keep security teams in a constant firefighting mode.

A recent survey conducted among over 400 IT decision-makers at companies with 500+ employees in the US and UK found that:

“When asked about the aspect of their role that they disliked most, 30% cited the lack of a work-life balance, with 27% saying that much time was spent on ‘firefighting’ rather than addressing strategic business issues.”

Managing Findings from Disparate Security Tools

When it comes to security scanning tools, findings come in all shapes and sizes.

A key challenge in the remediation process is making sense of the numerous and diverse streams of scan and monitoring data.

Each of the many types of scanners deployed has a unique set of metrics and log data structure.

For example, the level of severity alone has many different scales across various tools:

Gaining timely and actionable insight into a system’s overall security posture status requires an in-depth understanding of these tools, mainly because there isn’t one system that standardizes all the findings.

As a result, the security team has to manually organize the data from the different scanners – make sure there are no duplications, and try to prioritize it best they can before handing it over to remediation teams – Development, DevOps, and IT.

Assigning Remediation Tasks to “Fixer” Teams

What’s the only thing in common with all security scanning tools?

Security teams cannot fix any of their findings.

One of the critical challenges that security teams face is that although they are responsible for identifying findings, they cannot actually fix the risks they find. Instead, they need to assign them to the right team for remediation.

The “fixer” teams usually have a full-stack responsibility and therefore require one consistent and prioritized security backlog to help them understand what is on their to-do list.

The fact that communication between these two teams relies on multiple different reports, with varying formats and scorings, creates a great deal of noise that necessitates an enormous amount of manual work, leading to an inefficient remediation process that is full of friction and wasted time.

There’s a fundamental necessity for a system that will standardize the communication of remediation workflows between Security and fixer teams.

Follow up on Security Findings Fixes

Even after the remediation task has been assigned, the security team has to follow up to ensure that it was fixed and collect data on different metrics for reporting purposes. Since many teams are responsible for fixing risks, security teams spend a significant amount of time following up with various teams using different tools.

Once again, the lack of standardization slows the tracking and verification process.

The lack of standardization causes the lives of security teams to be more about putting out fires rather than focusing on long-term planning. But do they need to spend so much of their time on “administration”?

How to Standardize Risk Reduction Workflows

It is clear that security teams require one standardized and centralized platform that consolidates end-to-end remediation from the minute a security finding is discovered to its complete remediation.

Seemplicity was created just for this purpose. It brings standardization to risk reduction and uses process orchestration to manage the remediation workflow lifecycle end-to-end across various teams and systems, unifying multiple individual tasks into one smart unit and automating hand-offs between teams and tools.

Using a platform like Seemplicity, security teams can effectively leverage security orchestration and automation and spend less time manually connecting the dots between fragmented security findings, siloed teams, and distributed tracking systems.

We welcome you to sign up for a Seemplicity demo today.

Month: December 2022

All I Want for 2023 are Improved Security SLAs

The Great Risk Reduction Fire