Hacker News new | ask | show | jobs
by tptacek 2 days ago
Compliance != security. It's almost the natural enemy of security.
1 comments

This is true, but security teams often work on tooling dedicated to reduce the n. of CVEs so that a company can keep compliance. That is in fact part of compliance itself to have an automated/reliable processo to tackle CVEs...
Which compliance regime are you referring to that cares about CVE counts as a metric?
Not as a metric, but it basically becomes one, like with Fedramp.

You need to fix also moderate/low CVEs within a certain time frame.

So CVE count becomes relevant, because the target is zero, although it doesn't mandate "zero CVEs" but that's finally what the desired outcome is.

It's basically unrealistic to ignore that number, because it's unlikely that you have a steady 1000 CVEs (that are being continuously fixed and new ones discovered), but more like "a few exceptions".

I don't do FedRAMP and will have to take your word for that, but none of SOC2, 27001, or HIPAA/HITRUST care about CVE counts.
PCI doesn’t mention cve by name but does require vulnerability accounting and requires action if they are found, the action required driven by severity. I could see a (poor) control being written around keeping counts down.
Right, you can write a bad SOC2 control that cares about CVE counts too!
But that's not a wrong approach. First you want to as many vulnerabilities as you can, than you want to fix as many as you can. If you rate the developing department for that, that's another story.