A6:2021 | Vulnerable and Outdated Components (8) | Cycubix Docs

Security Information Overload

What’s important?

• Is my component exploitable?.

• Is my component an authentic copy?.

  • Do I understand why my component is modified?.

Security information is scattered everywhere

• Multiple sources of security advisories.

  • 80,000+ CVEs in the National Vulnerbility Database.

  • Node Security Project, Metasploit, VulnDB, Snyk, …​

  • Thousands of website security advisories, blogs, tweets, …​

• 600,000 GitHub events generated daily.

  • 700 GitHub security related events.

  • Release notes, change logs, code comments, …​

Summary

• It is not reasonable to expect a developer to continually research each component.

• Developers are not security experts; they already have a day job.