CVSS Is Dead to Us
daniel.haxx.se
CVSS Is Dead to Us
1–10 of 14 posts
Re: CVSS Is Dead to Us
#2We must do something! This is something! Therefore we must do it!
That fucking mindset is what's going to kill the internet. I'm glad Daniel is resisting but like he says, he's but a small cog in a machine that's run by bean-counting idiots.
Re: CVSS Is Dead to Us
#3These bullshit “security scans” are disruptive and barely more than box checking exercises by alleged “cyber security” people.
I’ve seen entire companies cripple themselves with this security theatre for days on end requiring usually some executive interjection to break the deadlock.
Instead of applying nuance, it’s all black and white. I once experienced at a job not being able to deploy urgent hot fixes even for live production issues impacting customers.
Reason? The useless DevOps team introduced some automated security scanner which found a single reported vulnerability in a development tool. A tool that in no way reaches the users browser or the servers.
Bear in mind this was a brand new found vulnerability and there was no fix yet.
But because of that, and because of their lack of understanding, and their insistence we were just being stubborn and not believing us when we told them there is literally no fix available yet, they disabled our ability to deploy anything.
While the urgent fix for production was already committed and merged ready to be deployed.
It took great managerial pomp and fanfare to get that abolished.
I’d imagine there’s a great deal of pressure on OSS maintainers when these borderline CVEs get published.
Re: CVSS Is Dead to Us
#4> setting “fixed” (fake) scores on our CVE entries just in order to prevent CISA or anyone else to ruin them, but we have decided not to since that would be close to lying
No, I really think this is the way. Pick fixed CVSS scores for each of your own LOW/MED/HIGH levels. Anyone who pays attention will know what's up, anyone who doesn't pay attention wasn't seeing enough detail to be meaningfully misled either way.
Think about it like significant figures, where too much precision is actually more of a lie than including all possible detail.
Re: CVSS Is Dead to Us
#5I wish they would enrich their commit messages when they're "enriching" CVSS data.
Re: CVSS Is Dead to Us
#6> setting “fixed” (fake) scores on our CVE entries just in order to prevent CISA or anyone else to ruin them, but we have decided not to since that would be close to lying No, I really think this is the way. Pick fixed CVSS scores for each of your own LOW/MED/HIGH levels. Anyone who pays attention will know what's up, anyone who doesn't pay attention wasn't seeing enough detail to be meaningfully misled either way. T…
Agreed. That being said, the CVSS calculator is useful for reminding you of factors that you may not have included in your analysis.
Re: CVSS Is Dead to Us
#7You could add another vector to the score for 'out of the box deployment deviation'.
* If you need a rare CLI flag set, lower the score
* If you need a rare configuration property set, lower the score
* If you need undocumented behaviour set, lower the score
There should be a way to note that a configuration set is unlikely but possible.
Re: CVSS Is Dead to Us
#8These bullshit “security scans” are disruptive and barely more than box checking exercises by alleged “cyber security” people. I’ve seen entire companies cripple themselves with this security theatre for days on end requiring usually some executive interjection to break the deadlock. Instead of applying nuance, it’s all black and white. I once experienced at a job not being able to deploy urgent hot fixes even for li…
I feel you. These "cyber security" people's main qualification appears to be scoring 70% on a multiple choice test. I've seen people with no practical experience building things be paid more than 25+ year veterans (who, by the way, might know a thing or two about security).
The CIO and CISO don't understand that certifications only tell you someone is minimally qualified (at best). They are afraid of what they don't know (which is everything) and looking for something to conform to, some external authority on which to base their cargo cult. But they don't want to learn anything more complicated than a buzzword, so their first and last interview question for a security candidate is "what is the CIA triad?"
The old timers don't seem particularly anxious about security (because they understand where and how the rubber meets the road), which is misinterpreted as complacency.
So the security team will insist on not learning anything about the environment at their new job (separation of duties!) but will want to install footguns on every server, and generate reams of automated scanner output that is 98% useless. Budgets get eaten up because we have to buy products from the magic quadrant, because they need to be easy enough for an under qualified person to use (I've heard this). Sometimes it feels like never-ending stream of XY problems and Chesterton's fences, but I guess that's just another day in IT.
Re: CVSS Is Dead to Us
#9I hate security theater too, but seriously?
Reminds me of people who want to get away from sizing tickets in story points and instead use t-shirt sizes or some other more-abstract measure to avoid confusing the size with the hours/days to implement.
But we all do the translation implicitly anyway.
You use a scale of 1-4 (okay sure you use ordinal words, but it might as well be numeric for all the difference it makes), and get upset that others use a scale from 0-10 when you boycott their scoring system. And when you rightly complain that they scored incorrectly and they fix it you’re still upset because they put a number to it instead of a word?
Simply map your score from your domain over to theirs and move on with your life: Low => 2.5 Medium => 5 High => 7.5 Critical => 10
Re: CVSS Is Dead to Us
#10I hate security theater too, but seriously? Reminds me of people who want to get away from sizing tickets in story points and instead use t-shirt sizes or some other more-abstract measure to avoid confusing the size with the hours/days to implement. But we all do the translation implicitly anyway. You use a scale of 1-4 (okay sure you use ordinal words, but it might as well be numeric for all the difference it makes)…
Same can be said to Linux Foundation. Instead of trying to improve the system some turn to boycotting, nothing improves.