I have recently done a security review and uncovered 200 or so areas to improve upon covering a very diverse range of topics; Some points are process, some are config, some are new systems to be implemented. Everything from SAST, architecture to what ciphers to use.
At the moment it is a big mess of issues. I need a way to organise them in to coherent categories in order to make sense, group different issues that fall under a similar topic and prioritise maybe. It would also be useful to see a if there are any areas I have not considered.
I have been looking around for standardised model or informal lists of categories to cover but what I have found has been very limited and specific.
I have considered something like:
- Prevention (Configuration, SAST, DAST, WAF, DLP etc..)
- Detection (SIEM, Vulnerability Scanning, Pen Tests)
- Response (Malware removal etc)
The issue here is:
- I feel like I am trying to reinvent a wheel
- This is overly simplistic, especially for prevention which can be broken down in to so many categories.
I would be surprised if there isn't a pre-existing system I can use. Just a matter of what to google for.