compliance
6 posts · all writing
The analysis your supplier already did
Your vendor knows which CVEs in their component are actually reachable. They wrote it down. Then you retyped their conclusion into your own config, where it became a decision you are answerable for. Why consuming a VEX document beats copying it, and what the record looks like when the claim keeps its author.
CIS benchmarks are somebody else's checklist, and that is the point
A benchmark will flag things you have deliberately chosen, and treating every failed check as a defect is how teams end up ignoring the whole report. The value is not the score. It is the short list of checks you decided not to meet, and the record of who decided.
The ignore file is where security programs go to die
Every scanner ships a way to make findings disappear, and every team uses it. The problem is not that risk gets accepted. It always does, but that the record of who accepted it, and why, and until when, does not survive the commit that added the line.
The license nobody gated on: copyleft in your dependency tree
A CVE is embarrassing and fixable. A copyleft obligation you have been shipping for two years is neither, and you find out during due diligence. How to gate a build on license policy with Trivy or Mend, why permissive licenses should not be findings, and why this belongs on a different threshold from your CVEs.
Your CI logs are not evidence
The first time somebody asks you to prove a release was checked, the instinct is a screenshot of a green build. It will not survive the follow-up questions, which version, which checks, against what data, and would it produce the same answer twice.
The SBOM you ship is half an answer: pairing CycloneDX with VEX
An SBOM tells your customers what you are made of. Left on its own, it also hands them a list of every CVE they can match against you, and no way to tell which ones matter. The other half is VEX, and most of it is already in your descriptor.