NIST SP 800-128 – Because Patching May Never Fix Your Hidden Flaws

guest · Jan 6, 2021

NIST SP 800-128 – Because Patching May Never Fix Your Hidden Flaws
January 5, 2021
https://www.tripwire.com/state-of-s...-800-128-patching-may-never-fix-hidden-flaws/

Over the last few years, the idea of patching systems to correct flaws has graduated from an annoying business disruption to a top priority. With all of the notorious vulnerabilities that can wreak total havoc, the time it takes to patch becomes a minor inconvenience when weighed against both the technical challenges and possible regulatory penalties of not patching.

While patching is a critical component of a comprehensive security program, one area that is more challenging is configuration management. No matter how frequently a system is patched, it can all be undone by a misconfiguration or an overlooked configuration. This is especially true when working with security configurations. These hidden flaws in a system remain even with the most current and rigorous patching process.
Click to expand...

Getting to Know NIST SP 800-128
Fortunately, there’s some guidance for configuration management specifically targeted towards security. NIST Special Publication 800-128, titled “Guide for Security-Focused Configuration Management of Information Systems,” presents advice that works in tandem with its parent guidance, the well-known SP 800-53 (now at Revision 5) “Security and Privacy Controls for Information Systems and Organizations.”

SP 800-128 was originally published in 2011, and it now contains updates from 2019.
Click to expand...

The authors are well-aware that there are too many possible combinations to make any specific recommendations. In fact, they clearly and eloquently restate the mantra that there is no “One Size Fits All” approach to security configuration management:
Click to expand...

NIST Special Publication (SP) 800-128, Guide for Security-Focused Configuration Management of Information Systems

The purpose of Special Publication 800-128, Guide for Security-Focused Configuration Management of Information Systems, is to provide guidelines for organizations responsible for managing and administering the security of federal information systems and associated environments of operation.
Click to expand...

Log in or Sign up

NIST SP 800-128 – Because Patching May Never Fix Your Hidden Flaws

guest Guest

Log in or Sign up

NIST SP 800-128 – Because Patching May Never Fix Your Hidden Flaws

guest Guest

Useful Searches