I have recently done a security review and uncovered 200 or so areas to improve upon covering a very diverse range of topics; Some points are process, some are config, some are new systems to be implemented. Everything from SAST, architecture to what ciphers to use.

At the moment it is a big mess of issues. I need a way to organise them in to coherent categories in order to make sense, group different issues that fall under a similar topic and prioritise maybe. It would also be useful to see a if there are any areas I have not considered.

I have been looking around for standardised model or informal lists of categories to cover but what I have found has been very limited and specific.

I have considered something like:

  • Prevention (Configuration, SAST, DAST, WAF, DLP etc..)
  • Detection (SIEM, Vulnerability Scanning, Pen Tests)
  • Response (Malware removal etc)

The issue here is:

  1. I feel like I am trying to reinvent a wheel
  2. This is overly simplistic, especially for prevention which can be broken down in to so many categories.

I would be surprised if there isn't a pre-existing system I can use. Just a matter of what to google for.

  • 1
    See "A Structured Approach to Classifying Security Vulnerabilities" here: sei.cmu.edu/reports/05tn003.pdf – John Deters Aug 9 '17 at 2:09
  • @drewbenn that is exactly the word I needed. I would still like to see what people suggest. – ZZ9 Aug 9 '17 at 2:09

NIST has two documents which cover Information Security categorisations and subcategories.

The CyberSecurity Framework (NIST CSF - see https://www.nist.gov/cyberframework) is the more simple of the two but certainly provides what you're looking for at a high level. The main categories are Identify, Protect, Detect, Respond, Recover and each of these has some subcategorisation. The CSF covers just over 100 items which makes it very approachable.

The other document is Security and Privacy Controls for Federal Information Systems and Organizations (see http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf). Security controls are enumerated in Appendix F.

Where you have findings which don't fit with the above categorisations, you can create your own miscellaneous section. However, by adhering to NIST, at least you're presenting findings using a recognised industry framework which can be used for various clients and ensure you're speaking a standardised language.

|improve this answer|||||

The ways of categorizing and organizing the types of security issues may defer from people to people since everyone is doing it for a specific reason. So, determine for what you doing categorization and accordingly you may organize the security issues. It may be categorized in following manners:

  • Severity type of the security issue.
  • Repetitiveness of a security issue.
  • No of system affected by a security issue.

Generally, above mentioned are the ways of categorizing and organizing the security issues.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.