G.4.3 Gather attack trends
Control Details
Objective
Stay current on attack trends.
Definition
Have a process for continuously learning about emerging attack trends and vulnerabilities. Gather information from software acquirers, users, and public sources on potential vulnerabilities in the software and third-party components that the software uses, including AI models, and investigate all credible reports. Use a subscription to a cyber threat intelligence feed, attend technical conferences, monitor attacker forums, and study trends within the enterprise. Make this information on attack trends actionable and useful for developers, testers, security operations, and others to identify vulnerabilities in existing products, perform improved threat modeling and security architecture, and evolve the SDLC.
Assessment Questions
- How do you monitor new attack trends and vulnerabilities applicable to your software and AI models, such as by monitoring a cyberthreat intelligence feed and attacker forums, or attending conferences?