More Vulns and More Guesswork from Less Data - Jeremiah Grossman - ASW #407
3 November - 1 hour 3 minsFollowing the catalog of CVEs is great for enumeration, but chasing those CVEs for patching is terrible for strategy. Jeremiah Grossman shows what breach data tells us about the differences between having over 400,000 CVEs, a few thousand KEVs, and a few hundred ways that attackers compromise orgs. We go into the importance of distinguishing vulns from exploits and where we see agents making a meaningful impact. Then we touch on some history of appsec and why the trajectory of vulns like SQL injection and XSS, along with well-known security controls, point to a more secure future -- or even possibly a pretty secure present.
Resources
https://www.rootevidence.com/blog-posts/stop-chasing-...
Series Episodes
Shifting Cyber Turtles with Casey Ellis, the Vibe Check, and the News - Casey Ellis - ESW #483
1 hour 41 mins
2 November Finished
Mrfoofoo, Binance, Polymarket, Silent Train, robosurance, privacy, and Josh Marpet - SWN #629
29 mins
30 October Finished
CyberSN Jobs Report as CIOs and CISOs are Unaccountable and Unprepared for AI - BSW #471
54 mins
28 October Finished
Agents, Train Robberies, Jazz, Microsoft, Elvis Gyrates, Aaran Leyland, and More - SWN #628
28 mins
27 October Finished
