5 ms·
I am so torn about the whole vulnerability branding thing. On the one hand, it gives a great amount of visibility and motivation for brass to actually provide f
by akersten 7y ago
I am so torn about the whole vulnerability branding thing. On the one hand, it gives a great amount of visibility and motivation for brass to actually provide for getting prod patched when IT might not have had the political capital to do so otherwise. But on the other hand, I think about things like:
-- What happens when the cure is worse than the disease (some variants of Spectre), and we "have to" patch because otherwise we're "not secure against this scary sounding thing." It takes a lot of agency away from the IT department to make an informed decision about the appropriate mitigation and threat model, and turns it into a business requirement regardless of the trade-off - because brass "understands" Spectre, they don't understand CVE-1234
-- Or, theoretical exploits that aren't practical in the real world, but we spend a lot of effort or make tradeoffs to fix just because someone needs some material for their PhD.
-- What do you call it when we find another way to read RAM next year - RAMBleed2? I guess.
- segfaultbuserr 7y ago> -- What do you call it when we find another way to read RAM next year - RAMBleed2? I guess. or RAMBleed-NG, probably.
- hansendc 7y agoIt would have made more sense to call this on "RAMbo First Bleed". Next year it can be "RAMbo First Bleed Part II".
- mfatica 7y agoRAMBleed++
- radicaldreamer 7y agoRamBleed MAX9
- x0ner 7y agoP1) I don't see the current naming model as any worse than the disjointed CVEs of today. P2) What if all wide-impacting vulnerabilities were treated like this, regardless of theory or not; the vulnerability still exists. P3) Names are fairly easy to come up with. Some of my views on why this approach is beneficial, https://medium.com/@9bplus/why-i-love-marketing-vulnerabilities-91b6beaf5368 https://medium.com/@9bplus/why-i-love-marketing-vulnerabilit...
- viraptor 7y ago> we "have to" patch because otherwise we're "not secure against this scary sounding thing." Either you have people with security experience who can tell you if it matters in your situation, or... Well, you won't know what the right answer is and may as well default to patching since your os distribution will do it. But I don't think it's that different for named and not named vulnerabilities. The response to management can be either "we dealt / are dealing with it according to our vulnerability management policies", or whatever you'd answer when asked about any other issue. The only difference is you may be asked in the first place.
- ken 7y agoSpectre ended up being a handful of (non-contiguous) CVEs. It's much easier to talk about "Spectre" as a class of vulnerability than "these 6 CVEs and also that other variant that doesn't have a CVE yet". What happens next year when there's a new way to bleed RAM? If it's anything like Spectre, we'll call it "RAMBleed Variant 2", and assign it a new CVE.