https://speakerdeck.com/gregit 2018-06-22 09:13:28 -0400 Presented at https://www.securitybsides.org.uk/ 2018 Human nature looks for shortcuts and can lead to “lets focus on the critical and high vulnerabilities then we may be able to fix the others later” which is a classic cause of technical debt. From a simple logic perspective this makes sense but fails to address chained vulnerabilities that represent a high or critical vulnerability, but individually are less impactful. CVSS scoring has its place, but its not a pure numbers game when it comes to securing your systems, you need to think more like a hacker in defending your information. Presented at https://www.securitybsides.org.uk/ 2018 Human nature looks for shortcuts and can lead to “lets focus on the critical and high vulnerabilities then we may be able to fix the others later” which is a classic cause of technical debt. From a simple logic perspective this makes sense but fails to address chained vulnerabilities that represent a high or critical vulnerability, but individually are less impactful. CVSS scoring has its place, but its not a pure numbers game when it comes to securing your systems, you need to think more like a hacker in defending your information. Fri, 22 Jun 2018 00:00:00 -0400 https://speakerdeck.com/gregit/cvss-the-good-the-bad-the-ugly https://speakerdeck.com/gregit/cvss-the-good-the-bad-the-ugly