vulnerability management
3 articles with this tag
VPN Appliances Are the Main Way In for Ransomware: Remote Access Defense After Japan's Digital Agency Breach
A VPN appliance connects the internet to an organisation's internal network, and in Japan it is how attackers got in in roughly two thirds of ransomware cases where the route is known. The Digital Agency's GSS incident followed the same shape: in through a VPN vulnerability, then a maintenance operator's account used to reach a large volume of files. This site's view: only keep a VPN appliance if you can keep patching it, and defend it with three things: patch speed, narrow privileges after an intrusion, and detecting bulk access.
Deciding What to Patch First — CVSS, EPSS and KEV, and What Each Is For
CVSS is severity, EPSS is probability of exploitation, KEV is confirmed exploitation. They are not substitutes. Our own data across all 1,695 KEV entries: 64% score below CVSS 9 and 24% sit below EPSS 0.1 — so both 'patch the high scores' and 'ignore the low EPSS' fail in practice. Order by KEV, then EPSS, then CVSS, and set the deadline from your own exposure.
osv-scanner in Practice — pnpm, Ignoring CVEs, Offline Mode, and the Errors You Hit
Only the second-day questions, answered against the official docs. pnpm-lock.yaml is supported; ignores live in osv-scanner.toml under IgnoredVulns and can carry an expiry; offline mode is three flags with three different jobs. This site's view: a scanner reports known vulnerabilities, and says nothing about a version you pinned yourself going stale — that needs a separate mechanism.