prioritization
5 posts · all writing
A misconfiguration has no CVSS, which is why nobody fixes it
A privileged pod and a public S3 bucket have no CVE, no CVSS score and no NVD entry, so every IaC tool invents its own severity, and findings that would be a breach get sorted below dependency CVEs that are unreachable. Why misconfiguration findings get ignored, and what to rank them by instead.
Most of your container CVEs aren't yours: base images and what to do about them
Scan a 35-line Python app and you get 292 findings. 219 of them, three quarters, come from the base image, and not one is fixable by changing your code. Why container scanning produces so much noise, what the actionable move actually is, and how VEX and reachability change the arithmetic.
Shift left became "run everything on every commit", which is why people turned it off
The idea was that feedback is cheaper the earlier it arrives. What got built was a pipeline that runs twelve scanners on every push, takes eleven minutes, and gets bypassed. The useful version is about latency and relevance, not about location.
You don't need twelve scanners, you need to know which four apply
Security tooling is usually adopted in one of two ways: nothing, or everything at once. Both fail for the same reason. Nobody decided which controls the thing you actually build requires. A short way to work that out from what your software is made of.
When everything is “critical,” nothing is: prioritizing vulnerabilities by real risk
Security scanners flag hundreds of “critical” issues, so which do you fix first? Severity is not priority, and what matters depends on where a problem lives and how much the business would feel it, which is context a scanner cannot see but your app description can.