4 ms·
There's this stat that it takes 21 mins to detect, prioritize and remediate a single vuln in production. And that goes up to 51 mins for things found in dev. Ob
by robszumski 4y ago
There's this stat that it takes 21 mins to detect, prioritize and remediate a single vuln in production. And that goes up to 51 mins for things found in dev. Obviously automation drives this down very low and manual investigation drives it way up to get this average.
https://www.spiceworks.com/it-security/vulnerability-management/news/vulnerability-management-devsecops/ https://www.spiceworks.com/it-security/vulnerability-managem...
- UncleMeat 4y agoThis makes no sense. How would it be faster to remediate an issue once it is already in prod? Everything else shows enormous efficiency gains when shifted left. These numbers also are... ambitious. Altogether, this just feels like made up data.
- robszumski 4y agoI assume the dev number is higher because the version bump is mixed in with other changes and discovering the CVE in the new version means investigating compatibility with the feature work you just did. Agree that you have to be skeptical about studies like this.
- nibbleshifter 4y agoThose stats really seem like someone pulled them outta their ass.
- richbell 4y agoHaving been privy to a few "studies" like this, I'm imagining the following conversating in my head: "Hey Brian, how long would you say it takes you deal with a CVE on average?" 'Gee, I don't know, I guess about 20-30 minutes but it can take upwards of an hour depending on the environment' (Or at least the "answer 5 questions to win an Amazon gift card!" survey equivalent.)