Your critical system IS (NOT?) vulnerable: CSAF, VEX, SBOM and the future of advisories

No ratings

Presented at BSidesLV 2021 by

Allan Friedman

Jens Wiesner

As more attention is paid to security and the underlying components used in developing software, more organizations will be sending out security advisories. As SBOMs become more widespread, many of these advisories will actually be “false positives,” when the underlying component vulnerability isn’t actually exploitable. Organizations developing and using software will thus face an increasing amount of information to process and prioritize if they want to address the constantly evolving risk.