Vulnerability Management Lifecycle in DevSecOps
summary
Describes how pipeline scan results are consolidated into a central vulnerability management system and how asset inventories (including Arduino Cloud devices) are created and maintained. Recommends concrete decision rules: prioritize using CVSS 4.0 with business context and compensating controls, add EPSS exploit-prediction to focus fixes, and track exploitable vs non-exploitable finding counts. Explains pipeline integrations, prioritization thresholds, and verification steps that demonstrate remediation succeeded.
AI-written summary · about
chapters (13)
- 0:00Vuln management intro
- 1:52Findings to central management
- 4:02Vulnerability definitions
- 7:15Attacker vs owner lifecycle
- 10:42CVE and CVSS metrics
- 12:49Vuln discovery and assets
- 15:21OWASP and MITRE ATT&CK
- 17:54Prioritizing with CVSS 4.0
- 21:09Risk matrix and business context
- 23:37Business context in risk
- 26:05Exploit probability (EPSs)
- 28:15Mitigation strategies
- 31:55Conclusion
related talks
27mEffective Vulnerability Management for a DevSecOps Pipeline
40mManaging Risk Across the Vulnerability Ecosystem
44mVulnerability Management that developers won't hate
59mMadness of Vulnerability Management in Modern Cloud, Container, How to Win the Battle...
30mManaging Vulnerabilities through SSDLC
33mFrom Chaos to Calm: Vulnerability Management for a Dynamic, Sprawling Technology Estate
31mEfficient Vulnerability Management in Hierarchical Supply Chains
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage