Cybersecurity Insights with Contrast CISO David Lindner | 5/10/24

Insight #1

The Cybersecurity and Infrastructure Security Agency’s (CISA’s) Known Exploited Vulnerabilities (KEV) list is shown to increase speed of fixing vulnerabilities, but Verizon’s  Data Breach Investigations Report (DBIR) also shows that remediation is still taking much longer than it should. Does “improvement” mean we will continue to improve, or just that these vulnerabilities change priority and still get fixed as slowly as before? Only time will tell.  

Insight #2

Microsoft's executive vice president of security, Charlie Bell, recently said that the company will hold executives accountable for cybersecurity, including by basing part of its senior leadership team’s compensation on “our progress in meeting our security plans and milestones.” Microsoft holding execs accountable for security hopefully means that the company plans to provide more budget to do the things it wants. Just saying “It’s on you to get it done” doesn't magically make it happen.

Insight #3

I think it’s strange that CISA is creating messaging like "fix your path traversal bugs." The agency, along with the FBI, issued a joint advisory to developers, urging them to check for these vulnerabilities before shipping software. Here’s the thing: The OWASP Top 10 has been saying this for over 20 years now.  It feels kind of like the messaging "use a strong password" that we send each and every cybersecurity awareness month. Obviously, continuing to mention them doesn't seem to fix the root cause. It's time that software changes to prevent these vulnerabilities.