More Vulns and More Guesswork from Less Data - Jeremiah Grossman - ASW #407
Show notes
Following the catalog of CVEs is great for enumeration, but chasing those CVEs for patching is terrible for strategy. Jeremiah Grossman shows what breach data tells us about the differences between having over 400,000 CVEs, a few thousand KEVs, and a few hundred ways that attackers compromise orgs. We go into the importance of distinguishing vulns from exploits and where we see agents making a meaningful impact. Then we touch on some history of appsec and why the trajectory of vulns like SQL injection and XSS, along with well-known security controls, point to a more secure future -- or even possibly a pretty secure present.
Resources
- https://www.rootevidence.com/blog-posts/stop-chasing-cves/
- https://www.rootevidence.com/blog-posts/the-defender-window-is-longer-than-you-think/
Visit https://www.securityweekly.com/asw for all the latest episodes!
Show Notes: https://securityweekly.com/asw-407