4 ms·
There is no objective way to measure the security of an inherently insecure system. Assume breach.
by mouse_ 1y ago
There is no objective way to measure the security of an inherently insecure system.
Assume breach.
- dentemple 1y agoOkay, but my boss still demands I give him a metric. I'm not allowed to tell him, "Just trust me bro" when I'm asked how much our security has improved over the past sprint. I'm supposed to give hard numbers, and the OP at least offers an alternative for that.
- DANmode 1y agoPick something that resembles a vuln→patch interval, not just a context-less number that means they're popular, audited, or reviewing their OWN code all the time. Instances where 0-days can't be used in isolation are a perfect example of where nontechnical people absolutely need to "just trust" someone to triage, and perform threat modeling for them.