Cybersecurity Insights with Contrast CISO David Lindner | 10/28
Insight #1
”
CVSS score does not directly relate to the risk to your organization. Please for everyone’s sake, including your developers, produce a better algorithm for managing risk in your organization. Look at things like exploitability (EPSS), exploit path, vulnerable class usage, etc.”
Insight #2
”
The security industry is known to overreact to new CVEs, especially when they are rate critical. It’s a lot easier to tweet or blog about something than it is to drop everything you are working on to try to figure out how to update the library that is vulnerable to said CVE. How do we do that you ask? See my first insight from this week, find a better algorithm that fits your organization that mirrors your risk profile and tolerance.”
Insight #3
”
If you are reporting vulnerabilities as “actively exploited” or “in the wild” please define what that means to the broader community. Those terms are created to scare people into compliance but have no real backing or understanding of anything about what it means. Transparency is key, this is not transparency.”
*** This is a Security Bloggers Network syndicated blog from AppSec Observer authored by David Lindner, Director, Application Security. Read the original post at: https://www.contrastsecurity.com/security-influencers/cybersecurity-insights-with-contrast-ciso-david-lindner-10/28
