Nor does he envision VulnOps operating without human oversight. “Remember, humans are the ones that are accountable,” Mogull says. He points out that under the CSA operating model he helped develop, AI can make decisions within predefined policies, but potentially disruptive changes still require human intervention.
SANS Technology Institute’s Skoudis argues for what he calls a governance-in-the-loop process where “you have governance that decides that, ‘Hey, if a given action that I take could fall below this governance-in-the-loop level, just do it. Automate it. Don’t even think about it.’”
“Each organization is going to have its own separate line for where governance in the loop will apply, but you could say, for example, regarding important patches for Windows workstations, deploy them if they’re critical, on a rolling basis. So, in other words, do 25% per hour or two, over the space of half a day.”
