What a time to have this conversation! Mere days from the certain destruction of CVE, averted only in the 11th hour, we have a chat about vulnerability management lifecycles. CVEs are definitely part of them.
Vulnerability management is very much a hot mess at the moment for many reasons. Even with perfectly stable support from the institutions that catalog and label vulnerabilities from vendors, we'd still have some serious issues to address, like:
- disconnects between vulnerability analysts and asset owners
- gaps and issues in vulnerability discovery and asset management
- different options for workflows between security and IT: which is best?
- patching it like you stole it
Oh, did we mention Matt built an open source vuln scanner?
Show Notes: https://securityweekly.com/esw-403
Security Weekly Podcast Network (Video)