Thinking about #InfoSec organizational behaviors derived from cognitive bias. In particular, availability bias from things that are memorable.
#Log4j#Heartbleed #SolarWinds#ShellShock#Spectre#Meltdown#SQLSlammer
Discussion
Loading...
Discussion
@msw I feel like the reaction and "I-told-you-so"s have had some merit, shining light on dependencies as a source of vulnerabilities in otherwise well-planned codebases. There has definitely been a ton of hay-making from the infosec side because of it, but from my position it's not too gratuitous. SBOM seems like a good thing to have in the tool kit, because the conditions that led to log4shell are still around - extremely deep dependency stacks.
@msw I would have loved to have seen more analyses of teams with large Java codebases which managed to avoid the log4shell vuln. What was it about their culture, their toolchain or their processes that kept them out of trouble? Especially when the answer isn't "dumb luck".
bonfire.cafe
A space for Bonfire maintainers and contributors to communicate
Automatic federation enabled