Keeping Up With The Joneses (CVEs)
summary
Security teams face over 1,000+ CVEs per month (14,000+ in 2017) while only ~30% actually apply; manual triage wastes expert time. A shared open tool called ESR tool aggregates NIST/MITRE/ distro sources, cron-driven scrapers, an SQL backend, NDA access controls and exportable reports, and applies heuristics from 10k keywords to pre-filter likely matches so engineers focus on real investigations; the prototype runs in production at Wind River and is published to the Yocto community.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:21Security Response Management
- 1:18General Security Patch Workflow
- 2:54Upstream CVE Sources
- 4:34CVE Workflow: Out-of-order/Delayed
- 5:49A High Profile CVE - Simplified
- 11:56Volume of CVE Data: Issues
- 12:58Volume of CVE Data: Example
- 13:29Tools: CVE System Analysis
- 14:30Tools: CVE Build/Source Analysis
- 15:58Security Management: Issues
- 17:17Security Management Services
- 17:52Defect systems vs. Security Management
- 19:01Cost overview: Necessary costs
- 19:25Cost overview: Unnecessary costs
- 23:30Best Practices (2)
- 25:16Introducing the SRTool
- 25:59Srtool Features for Best Practices
- 27:48SRTool: Vulnerability Page Example
- 28:56SRTool: Object Model
- 30:34SRTool: Functional Layout
- 34:29Conclusion
related talks
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm
35mDetecting and Defusing the Ticking Time Bomb: Understanding CVEs and Upstreaming in Yocto
17mThe Hidden Cost of CVEs: Can CSAF and VEX Change the Equation?
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
51mAutomating CNA CVE Reporting and Monthly Bulletins
35mKeeping Up with the CVEs: How to Find a Needle in a Haystack?
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
21mDevSecOops: 15 years of DevOps and patching is still horrible