4 ms·
> I can look at a CVE and determine for myself and my organization whether it something we need to care about. Except it doesn't work like this. A security sc
by suprjami 2y ago
> I can look at a CVE and determine for myself and my organization whether it something we need to care about.
Except it doesn't work like this.
A security scanner will include a CVE. People want no red flags on the security scanner. They don't care what the CVE is, they just want red mark go away.
The attitude to accepting useless crap as a CVE is diluting what an important CVE actually is.
- ziddoap 2y ago>Except it doesn't work like this. You'll have to email my bosses that :)
- Fnoord 2y agoA decent security scanner allows you to exclude informational vulnerabilities. When I rolled out Wazuh in an org, it allowed for said function. And I still, personally, wanted to know about it at least once.
- Denote6737 2y agoIf that is your attitude to security scanning, you should not be in charge of anything more important than a speak and spell.
- DougN7 2y agoSeriously? Treating joke CVEs the same as true sev 1 issues is beyond silly and counter productive. There are very real limits to time, money and attention and pretending otherwise is foolish.
- Citizen8396 2y agoThe person you’re replying to seems to agree with you.
- Citizen8396 2y agoAre you speaking from your experience in vulnerability management? If anything, I’ve seen the opposite behavior (ignore everything except where the risk is critical). CVSS has been around since the mid-2000s, so it isn’t as if there’s no way to discern critical vulnerabilities from informational ones.