4 ms·
How does a “small manufacturing business” get notified of this CVE popping up? I don’t think they would even know what a CVE is…
by aaaaaaaaaaab 4y ago
How does a “small manufacturing business” get notified of this CVE popping up? I don’t think they would even know what a CVE is…
- vladvasiliu 4y agoThey could sign up for a CTI (Cyber Threat Intelligence) service with a security company. Basically, they send you notifications about CVEs and related stuff. My client isn't exactly a "small manufacturing business", but they do subscribe to such a service, and they did have the Java issue in a parent process. They have a security guy who's the main one expected to look at these, but he's not the one operating anything directly, so he can't be expected to know every last random lib that's used. So when the Log4j2 issue came up, for example, he was aware there was "a Java issue" but had no automated way of knowing which systems, if any, were affected.