How to have perfect vulnerability reports and still get hacked

No ratings

Presented at BSidesLV 2023 by

Zachary Newman

Luca Guerra

What vulnerabilities are really lurking in a given application? The assumption that we can answer that question undergirds US government mandates both recent and decades-old. Hackers, of course, know that this is absurd: attackers have 0days and aren’t afraid to use them. But even a much-humbler goal, “free of known vulnerabilities,” isn’t as feasible as we’ve been led to believe. In this talk, we’ll see the pitfalls of common tools—software composition analysis (SCA) and software bills of material (SBOMs)—commonly brought up as silver bullets for this issue. We’ll see the vulnerability reporting ecosystem, including databases and manual triage of vulnerabilities in your application. Nonetheless, we’re hopeful: these tools are stronger together and can do a good job in many scenarios. Further, we’ll see what the future holds for bringing us closer to “free of known vulnerabilities” status, from open-source tooling to better government policy. Attendees to this session will learn about: automated security tools that miss what’s right in front of them, empirical research exposing vulnerability management challenges, the fight against security by obscurity, and the daily commitment to keep applications free of known vulnerabilities.