Maturity Level 3 (Advanced) - Proactive...we’re ready for anything (mostly)

by Christopher Robinson, Red Hat and Jerry Bryant, Microsoft
Thursday, January 24th, 2019

It’s been a long journey, progressing your PSIRT from the beginning to now. Ideally with each vulnerability you’ve learned a little bit more and were able to act more quickly and effectively each time you executed your process. Have you reached the final destination (whatever that might mean)? No, but you’re better… less reactive, and more able to anticipate what might come next.

Mastering early capabilities as well as developing more advanced techniques can help a security team better serve their stakeholders more proactively than before. Effective management of basic processes and procedures can free up the PSIRT’s time to more effectively communicate with their key stakeholders, external partners, and customers and also begin to anticipate needs before they manifest. It can take time to reach the level of maturity where foundational practices become muscle memory and all teams are fully integrated into the process.

You are now mature enough to know that you don’t know everything. What got you to this point won’t necessarily continue to make you successful, so you reflect back frequently on your processes, tools, team allocations, and your research. You’re always on the hunt to increase the efficiency of your analysis and workflow management while you build new capabilities to face the challenges of an ever-shifting threat landscape.

Conclusion

Hopefully what we’ve outlined as suggested services and functions a PSIRT could offer at the various stages of their development will be helpful and inspires your team to raise their game. Is this the best you can achieve? Certainly not! There are techniques and practices both detailed within the pages of the PSIRT Services Framework and living within your imagination and practices that has not been written down yet! The FIRST PSIRT community would love to hear your insights into how you effectively run your product security team. We encourage you to use the maturity levels, PSIRT Training, and the Services Framework to better serve your customers and stakeholders!

Written by Christopher Robinson, Red Hat and Jerry Bryant, Microsoft