,
9 tweets,
2 min read
Read on Twitter
There's some good stuff here. Coordinated disclosure and an SBoM at least at the level of licenses (though not backports) are the basics that are both easy to do and should be considered the bare minimum. On the other hand, NIST 800-160 v1 is complete garbage.
For the past 30 years, the basis for all "secure engineering" starts with being able to receive reports from people who discover a security problem. These days, we call this "coordinated vulnerability disclosure", to avoid nonsense terms like "responsible disclosure".
People imagine the arrow of security goes the other way, that you should start with a Secure Development LIfecycle, and proactively build security in to begin with. Nope, this is wrong thinking. I mean you can try, but you won't succeed, you won't get close.
Instead, the way it really works is that you receive vulnerability reports, then go back and fix the bug, and THEN go back and adjust your development processes that the bug revealed, so that class of bugs doesn't happen again.
No matter how proactively you try to build engineering processes trying to anticipate everything, you'll eventually get a vuln report showing some new wrinkle that you didn't -- couldn't -- anticipate. Especially as times changes and new classes of vulns are developed.
That's why NIST 800-160 v1 is garbage. It's the government approach to make-work where people can point to all the work they are doing, without actually haven't any results to show for it. It measures success only by how many processes you follow.
I see this all the time, large government processes on securing websites where nobody has heard of what "SQL injection" is. It's the most common and notorious vuln on the web and you've built a huge organization that knows nothing about it.
As for SBoMs, as long as you restrict them to the easy bits, like tracking software licenses which all products have to do anyway, then there's some utility but no harm to them.
But some want to make SBoMs into a bureaucratic nightmare, which I vehemently oppose. My earlier tweets on backports is a good example why.
