[-]

ReputationNo8889@reddit

Tell him to find the person in your org that is responsible for discovering new CVE's and getting them reported. Maybe then he understands, that is not in your control.

[-]

_matterny_@reddit

You can either buy brand new equipment which has a lot of CVEs due to lack of field testing or you can run older equipment which has lots of CVEs due to the outdated technology at play.

To minimize the number of new CVEs it’s simple: get rid of anything able to connect to the internet. Computers are still allowed, if they predate the internet and USB. Printers are a huge risk, gotta get rid of those. Servers are inherently dangerous by that metric, those should all be disposed of.

[-]

dougmc@reddit

To minimize the number of new CVEs

Just run old, unsupported OSs and software.

Few people are running it, even fewer are fixing problems, so few people are reporting CVEs against it, so fewer new CVEs!

[-]

anomalous_cowherd@reddit

You need to try and turn it back on him, get him to specify how many CVEs are going to be published next month as part of his requirements. If unspecified default to zero.

[-]

brrrchill@reddit

Did you ask him why? Why is this number important to him?

[-]

reevesjeremy@reddit

You need to patch all the known and unknown vulnerabilities today. You need to make that system so rock solid that a CVE never impacts your systems. Aka: you need to prevent the scanners from getting in. And once you’ve done that, you’re secure from the scanners saying your systems have new vulnerabilities. :)

[-]

DrunkenGolfer@reddit

He thinks you are creating vulnerabilities and should create fewer of them. You can reduce the number of new CVEs by not updating your software. Eventually, all the vulnerabilities are found and no new ones emerge. There will then be 1000 CVEs that can’t be remediated, but none of them will be new. The alternative is to have updated software that will have few known vulnerabilities, but a higher numbers of newly discovered vulnerabilities.

Ask him which of those two options he prefers.

[-]

jurassic_pork@reddit

The dude keeps insisting on new CVEs that may be discovered the next report. I can't do anything about those new ones... Tried to explain, he doesn't understand.

"So what is our private mercenary hit squad fund sitting at? How many hundreds of millions of dollars do we have for assassins and internal threat research departments?"

"Wha?"

"You are asking us to start killing security researchers on a global scale to reduce the number of reported vulnerabilities or to be the ones to discover the vulnerabilities ourselves and work with the vendors to develop and apply the patches or mitigations before they are public."

[-]

randalzy@reddit

I like this one, it could start with something like:
- "hey Bob, just to make sure we are in the same page, is this a Top Priority Job?"
(...)
- "ok, who else is involved that I can safely know? Do we have CEO approval?"

Better if this can be obtained via Teams or email in written form. After some weeks pass a budget for a mercenary cover ops team that could kill reporters and decline the nmber of new found CVEs. Always add an option to buy MITRE in a hostile way. Maybe include a takeover of the US government, or buying Microsoft.

[-]

PlaneHashes@reddit (OP)

This!! So much this!

[-]

TaterSupreme@reddit

That's not completely true. I've had situations where my webserver build included both Apache and nginx even though we only used one. We kept installing a log analysis tool and the perl environment it needed for years after we started shipping weblogs off to a central reporting system.

Maybe it's time to audit your systems for unnecessary cruft. If you can pull some packages, you'll reduce the number of possible targets for new CVEs.

[-]

littlemissfuzzy@reddit

Hear hear.

One can limit the amount of incoming CVEs by reducing the amount of kruft installed.

[-]

DrummerElectronic247@reddit

There's really only one way I can think of to reduce the number of CVEs coming at you in a given interval: Simplify your tech stack. Fewer different systems reduces the overall volume of CVEs (from a purely numeric standpoint) and simplifies patching (while simultaneously increasing the footprint of a give patch deployment). It's not an idea without merit, but it's not a magic bullet.

If you have a problematic vendor who is consistently generating higher CVSS scores than others in the segment then it might be worth your while to migrate. Maybe. You're just rolling different dice as opposed to better ones, but it is what it is.

[-]

azure-only@reddit

Do we really need to fix ALL the CVEs?? I think your manager is dumb. You need to convince them to ignore some cves. Not all cves can be super fixed, irl. There are other facilities in security to cover them up.

[-]

Tcrownclown@reddit

As a security specialist I would have answered similarly. I would be upset if the cves I've asked to be patched are still there and not if new cves were discovered.

Something like that might actually jar him into a logical understanding.

Have you asked him what *he* thinks you can do to lower the new CVE count?

It's possible (though, unlikely) that there's some weird definition disconnect or some obvious thing which is actually happening but he's unable to convey it.

[-]

depoultry@reddit

The manager sounds like the type of person to say “it’s your job to know how to lower the CVE count, not my job”

[-]

I think this is the approach he wants. I'm clearly the dumb one for not understanding this simple trick! /s

[-]

ScannerBrightly@reddit

Have HIM explain to YOU how CVE's are created.

[-]

ITguydoingITthings@reddit

Is there a chance he somehow believes that your team or some team internally discovers/creates the CVEs?

It may be worth starting the questions at the absolute most basic stage, asking what his understanding of what a CVE is, how they are reviewed and published, and where they are published.

Not as an attack, but almost apologetically because "it seems like we're on different pages" kind of thing (and yeah, it's borderline manipulative, because we already know he doesn't understand, but you're giving him a chance to clarify your possible misunderstanding...)

[-]

Own_Bandicoot4290@reddit

Did you try em him who creates the CVEs? That it is not anyone inside the company?

[-]

Sleepy_L0c0@reddit

My boss kept arguing with me that back ups were the most important thing. I said "I agree they are really important, but Monday I'm gonna shut down production and see what is more important." Argument ended right then.

[-]

Correct doesn’t mean you’re right… let me try that again…

You’re right but that doesn’t mean you’re correct… that doesn’t sound right…

This is why I just shut up on meetings. Lol

[-]

Tell him upper management needs to layoff more state actors.

[-]

Superb_Raccoon@reddit

Here, show him this:

https://www.cvedetails.com/product/16924/IBM-Z-os.html?vendor_id=14

Migrate to a Mainframe. Last CVE was in 2014.

[-]

JMaAtAPMT@reddit

29 year IT guy, over 20 as an SE.

Ask him HOW you are supposed to PROACTIVELY FIX a CVE that HAS NOT BEEN DISCOVERED AND DOCUMENTED yet.

[-]

goishen@reddit

"WE have no control over how many CVE's are reported."

"Impossible."

"You're just wrong."

I would state it in a very matter of fact tone of voice.

[-]

trooper5010@reddit

I'm curious, how do you patch over 8k CVEs per month? What tools do you use to do this on large Linux infra setups?

[-]

davidgrayPhotography@reddit

Just do the Donald Trump COVID thing:

If you don't report CVEs, the count goes down, therefore, you've successfully dropped the number of CVEs per month!

narcissisadmin@reddit

Kind of like counting someone as a COVID hospitalization if they test positive regardless of why they were in the hospital to begin with? LOL

[-]

crossdl@reddit

Then he'll keep assessing the team by a bullshit metric he made up because he's a super cool dude that actively tracks CVEs and wants to flex and he'll get lied to or people will leave.

[-]

Maro1947@reddit

To be honest, I've charged to the top of the hill to enter Valhalla more times than I care to admit.

Life is too short to deal with asshats, especially those who threaten my co-workers'

[-]

Angelworks42@reddit

You're right I would have likely nodded my head and said "ok...?".

I feel like the security guy turned it into a hill to die on when he did the after meeting call.

[-]

PlaneHashes@reddit (OP)

He ain't even security. This is my manager! Ah! Go figure.

Security department is with me on this. This is purely a management issue.

[-]

You are not wrong, but this is why I can't stand when higher ups are dumb. Just because you are a director, manager, etc doesn't mean you should be able to get away with being stupid.

That being said, there are other ways to handle this where both parties can get their point across w/o blowing up, assuming this isn't a weekly thing.

I get that the higher ups aren't experts, that's why they have a team under them, but when they don't stop to think/understand what is being told to them, they should no longer be in that position.

[-]

hkusp45css@reddit

I am as "job protectionist" a guy as you'll find, generally.

But, if I find myself explaining to a guy who sets metrics and uses them to judge productivity and that guy is telling me to make sure I have more control over how the entire global technical landscape behaves, I'm probably going to tell him he's an idiot. I might try to be diplomatic, at first, but that's going to wear really thin, really fast.

Part of the reason we hire professionals is to help each other understand where they're going wrong.

I'd defend the discussion the OP had all the way to the soup line.

[-]

PlaneHashes@reddit (OP)

More and more I agree with this.

[-]

dhardyuk@reddit

Welcome to ‘my experience trumps your enthusiasm’

The understanding gap is always there. If they can’t explain something properly in their own words they reveal that they don’t understand it. If I don’t understand what you are trying to explain you need to be able to explain it with different words. The ones you have aren’t working.

Sometimes that’s my fault, occasionally it isn’t. Repeating the same words over and over suggests that they think I’m not understanding. When I really am.

Just today I have spent more than 90 minutes explaining to someone that when I say ‘show me what you mean’ that repeating everything they just said and insisting that is what they mean - ergo I’m wrong because they think they are right - when actually THEY haven’t understood that I actually understand both what they are saying and what they are trying to explain and that the words they are choosing are not influencing my understanding. Just underling their own lack of understanding.

Finding the words to wrestle this to the ground without anyone getting hospitalised or fired is a balance between allowing them to waste my time and dragging them to a new baseline for their understanding. It’s for their benefit, not mine.

Occasionally it goes sideways and ends up with HR. So far I’ve won every one that did.

Sometimes people mistake it for dick swinging, or knob conkers. Usually they stop when they show me exactly how much more right they are by actually doing the manual steps of the thing they are arguing about.

In the too many CVEs a month example here the idiot needs to be made to role play finding and fixing CVEs. Extra points if he is arrogant enough to do it front of the people who understand why he’s wrong. At which point he can throw his toys around and lose everyone’s respect or demonstrate that he has learnt something new and say something to elevate their respect from him.

If he’s an arrogant twatwaffle he won’t be able to swallow his pride and acknowledge that on this occasion he might be mistaken.

[-]

AlterdCarbon@reddit

Come on man, you're not gonna win these battles by trying to explain "that the words they are choosing are not influencing my understanding." You have to team up with the stupid person, blame the "tech" for all the problems, commiserate with their feelings of frustration, and then let THEM take the lead on "solving" it, and you have to pretend to just "have an idea" (use those words) and then you gently "try" the fix you knew all along. This is how stupid people think the world (and smart people) work, so you can just feed into their worldview and they will love you (or at least respect you) instead of fighting with you all the time. If they understood logic and detailed communication then they wouldn't need your help in the first place.

Even though day to day this sucks to deal with, there is a certain comfort in a phrase I've been saying from Adam Savage recently, "do I need to absolutely argue this daily and constantly be rubbing this dude the wrong way, or will the world work it out in time".

I think once you have your documentation showing each month, and you can back up your arguement should it ever come along from above him, then it's fine.

[-]

Majestic_AssBiscuits@reddit

I’ve had the same problem. When the number didn’t move too much management just thought we weren’t doing anything, and it took a little bit of doing to show them that we were we basically made up our own metric of remediated CVE per month. If one vulnerability multiplied over 400 servers can ding me for 400 points on the report, then patching that vulnerability should give me 400 points on the other side.

I suppose about the only thing you could do to reduce the incoming number of CVE’s is to make sure you are retiring/decommissioning any unnecessary nodes and software.

Like, if there are 5 CVE’s found in RedHat next month, then if you get rid of 4 servers that aren’t necessary anymore, that number goes down by 20 on his report, yes?

Same for like Java or Python. Even if you’re not using those, the tenable scan or whatever they run will still find them and count the CVE’s right? So I guess you could make sure that you don’t have unnecessary packages and that would kind of have a similar benefit. I’m primarily a windows guy through, and Linux tends to run much leaner out of the box.

[-]

jurassic_pork@reddit

If one vulnerability multiplied over 400 servers can ding me for 400 points x severity multiplier on the report, then patching that vulnerability should give me 400 points x severity multiplier, with scaling penalties applied after 1 week of a paych being available and tested on the other

Less-Procedure-4104@reddit

Maybe revisit it as likely you are not speaking the same language you might not understand the want and they may not understand your reply based on not understanding what they really want.

[-]

BokehJunkie@reddit

just block the vulnerability scanner from scanning more and more computers every week and that number will start to go down. It's so simple.

[-]

spazmo_warrior@reddit

^This guy Maliciously complies.

[-]

xabrol@reddit

Just tell them you don't work for MITRE Corporation And have no control over the CVEs they create.

[-]

hoax1337@reddit

Bro, this is easy. Just reduce the number of packages / applications you're using, and the number of new CVEs affecting you will go down. Do this gradually to indicate a downwards trend and until the productivity of the company grinds to a halt.

You’re being fascetious.

It is entirely possible to limit the amount of incoming CVEs by reducing the amount of kruft installed.

Case in point: compare the CVEs for a Temurin 21 JRE container image based on Ubuntu, versus based on Alpine. A world of difference.

[-]

rubmahbelly@reddit

But… there will be new CVEs on the interweb reported.

Sounds like you're a blocker to his bold leadership. This is a person who will not take no for an answer.

Courageous!

[-]

WannabeAsianNinja@reddit

Trust your gut.

You're already rationalized and attempted to fix the situation but there's a reason why there's an expression that "you can't fix stupid."

Solution wise, I don't know all the specifics of your job but maybe making a few CVE sites as his home page and having him go into whatever SIEM you have to fix it himself is what he is going to need to really do it. Play dumb, ask him to show you how to handle a SMB vuln for a Linux box and watch him suffer.

[-]

LonelyWizardDead@reddit

New job time tbh

[-]

coralgrymes@reddit

You're not crazy. He's just stupid. REALLY stupid. He went FULL stupid. You never go full stupid. Sometimes you get management so stupid it starts affecting you. I'm glad you came here so we can prevent his stupidity from infecting you. You can't control something that entities out side your reach create. You can only solve them as they come in. Does he think you can just wiggle fairy dust out of your magic IT fingers to make CVE's stop existing. That's not how that works. You aren't doctor strange. You can't travel through time to stop things from happening.

[-]

dazcon5@reddit

The number of times I have sat in meetings with upper management types and always thinking "how dumb are you?'

I let it slip once on a Teams call and had to blame it on my dogs.

[-]

Secret_Account07@reddit

[-]

Jswazy@reddit

That still doesn't guarantee lower CVE numbers.

[-]

Some_Troll_Shaman@reddit

Management guy is a MBAtard no doubt.

The necessary measurement is age of CVE's, how fast they are patched, not how many there are. So you are correct.

So you want to chart number of CVE's by age over time, not number of CVE's over time.

Just give him the scenario of a good and bad patch tuesday.
If M$ drops 90 CVE's one month and then 240 the next, how is that in the teams control at all. What matters is if they are patched appropriately and according to policy.

You are smarter than the MBA taint licker.

[-]

SpongederpSquarefap@reddit

Yep, you don't need to care about the CVE count, just how high the severity is and when it was last patched

If there's a bunch of 4s and 5s outstanding but you just installed the monthly patch, it's likely that the other fixes are from config changes that could break something

Or the attack vector for something rated as a 4 is highly impractical - like physical unauthorised access to a server

In general - who cares so long as your riskiest assets are patched quickly

[-]

PlaneHashes@reddit (OP)

Told him about that kind of drop where in one month, 100% more CVEs are generated.

Said: You have no proof that will happen. I know how many vulnerabilities you fix. You don't know how many will appear next report.

Told him it was exactly my point. He didn't understand and kept ranting about how I was showing the team this problem wasn't solvable...

"Say what?"

[-]

fogleaf@reddit

Reducing new CVEs is an unsolvable problem.

Although as I typed that I think I might have figured out what he was smoking: He wants you to reduce the number of the new CVEs that are still active.

If you generate the report of new CVEs on a Monday and the meeting is on Tuesday, he expects you to have fixed more of them before the meeting.

Report says 1000 new CVEs, you then report that you fixed 800 of them. Thus the number of new active CVEs is 200. Then the next week you pull the report of 7000 new CVEs, and your team fixed 6999 of them. That way there's only 1 new active CVE!

[-]

PlaneHashes@reddit (OP)

I get all that and know what he wants.

The whole problem is promising.

A team is a finite resource. There is only so much it can do.

At our rate, I can promise that we can fix around 8k vulnerabilities a month. It's our average. If complexity stays the same, the average shall be respected.

But that's it.

If from this report we fix all the vulnerabilities, I can't promise anyone that for the next report, we will have more or less new CVEs.

[-]

fogleaf@reddit

Probably have to find a way to show the diminishing returns it would take to reach that goal. Adding 1 million per year in salaries might reduce the new active CVEs by 1%. But adding 10 million per year will not mean 10%.

As I type that I just got weary thinking about it being my problem. Sorry your management sucks! It's a dumb problem and shouldn't be entertained.

[-]

Some_Troll_Shaman@reddit

You can lead a horse to water,
But sometimes you still have to make Glue!

aka,
You can't heal stupid.

Sorry,
He can't be helped.

BTW, you do have proof from historical context, so, evidence denial, MBA lobotomy completed.

Get a Cyber Security consultant and make them fight the stupid.

[-]

Tanker0921@reddit

MBAtard

Hippty hoppity, this word is now my property.

But seriously, there are too many mba managers in roles that doesn't make sense for them to be in, not to mention most of them dont actually care about what the team actually does and just looks at the fancy graphs because the c suite like numbers.

[-]

stonecoldcoldstone@reddit

take half the servers out of circulation that will half the amount of active cves

[-]

Pravobzen@reddit

Is playing the n+1 game a sustainable strategy with such a limited team at scale?

[-]

Roanoketrees@reddit

Unless he is referring to active CVEs in your environment, thats all you can control.

[-]

msalerno1965@reddit

There's way too many raindrops falling from the sky - DO SOMETHING.

What a twat.

Unless, of course, he means you should be running stuff that doesn't get so many CVEs to begin with. But I'm just playing Devil's advocate.

[-]

saysjuan@reddit

There’s an easy fix to this. If you’re measuring daily, weekly or monthly you can slow down the frequency of scheduled scans. It’s an upstream issue scanning too frequently. If you measure less often you’ll give yourself time to fix CVE’s not find new ones.

Modern problems require modern solutions.

[-]

ravigehlot@reddit

You’re not losing it. Your manager just isn’t recognizing the talent on your team. Instead of trusting a lead or experienced person in an area they’re clearly more knowledgeable about, he’s trying to generalize things, which isn’t fair. This is one of those situations where real leaders (not just managers) get why delegation is so important.

[-]

Ayesuku@reddit

This is one of those situations where real leaders (not just managers) get why delegation is so important.

Idk, I worked with managers like this. They don't always want a yes man, they are passing through the dunning Kruger effect. They know enough to have an idea, but not enough to know they are wrong.

mvbighead@reddit

Heh, we have had similar debates with our security team. If there is a >8 that is more than 30 days old, we have a problem. If there is >8 that is 3 days old that is dealt with by an upcoming monthly patch, we don't need to discuss it until after the patching window.

[-]

hkusp45css@reddit

I am blessed to have the kind of team that has gotten us to a place where if we see a >8 and we have a window approaching, we just move the window up.

Of course, we're a smaller org so, it's not as disruptive. It gives us the ability to be incredibly responsive and nimble.

Our CAB/CCB is only 5 people, and we meet once a day for 15 minutes and once a week for 1 hour. Our maintenance windows are reasonably elastic.

We do "urgent changes" for anything over 8, workload allowing.

It sounds more chaotic than it actually is.

[-]

mvbighead@reddit

100% a great situation. I have seen similar CABs, and while it can be a time waster in some sense, it is much easier to keep up.

My issue lately is having a weekly CAB, and then hearing the scanning guys talk about new vulns as if they aren't already planned to be remediated by patching. Like guys, wake up. We patch at X part of the month, we're 7 days before X. Why are we talking about a thing that is nearly certain to be dealt with during the patch cycle?

And, for >8 things, especially public facing, we can expedite as needed with an ECR.

[-]

hkusp45css@reddit

We have to do some mildly long-winded reports (because of compliance in our sector) for anything titled "emergency" which is why we treat them as "urgent" ... rather than use the term ECR.

It took some getting used to, for me.

[-]

We have update rings and a test/dev environment to do that. We try to patch as soon as it's practical. Of course, I don't know of too many orgs that maintain a test environment on prem that mirrors their prod cloud.

[-]

mvbighead@reddit

Same. For standard updates, we have phases.

Generally speaking for ECR'd updates, it's a single platform or system, and usually an infrastructure one and not a production application. IE - Backup software or load balancer, etc.

[-]

entropic@reddit

It sounds more chaotic than it actually is.

Doesn't sound chaotic as well, it sounds like an org with the flexibility to treat security as a priority, and has a great framework for doing so. Rare.

[-]

Technical-Message615@reddit

Mitigations maybe?

[-]

mvbighead@reddit

The point is, if the CVE is brand new and addressed by a patch, we need to execute the planned patch first and re-evaluate. 90% of the focus in CVE management is staying caught up. A 3 day old patch is likely addressed by the monthly patch cycle. A 45 day old discovery is the thing you need to talk about.

elpollodiablox@reddit

You: fix 5000 CVEs this month

Next month 13000 new CVEs are published.

That guy: "Why do we have more active CVEs this month than last month? Why haven't you been doing your job?"

I’d pitch the latter, if you can. You’re still addressing everything, but the formerly critical issues are “high priority,” and people don’t care so much about that taking 30 days. Which is how long it’s taking you now, but everyone’s reports look cleaner. Win/win.

[-]

captain118@reddit

I like using the ccri score. It only looks at vulns older than 30 days. So things that are not getting taken care of by the patching process. Then you take the critical and high vulns multiply them by 15, take your medium and multiply it by 7, then add those two results to the number of low vulns. Take that sum and divide it by 15 then divide that by the number of systems you have. If you are below 5 you are good in the DoD's eyes the lower the better.

[-]

captain118@reddit

What this tells you is if your patching process is successful. If you see the number trending up then you know that you need to work on better automation or more personnel to resolve the vulns within the patch cadence. If it's flat or trending down then that's great at some point you will level out. Looking at the trend tells you how effective the process is looking at the value tells you about your average risk level that you are carrying from month to month. If you are below 5 the DoD says you're good I want to see it below 3. You can use this number to determine resource allocation. If it gets above X then you know you need more automation or more bodies to do the work even if it's temporary.

[-]

captain118@reddit

My record is 0.85

[-]

Any-Fly5966@reddit

The CVE board has advised a 25% increase quarterly. Tell him that you'll lose investors.

[-]

Timothy303@reddit

This manager thinks you can control the discovery of new CVEs. That is insane. It’s time to get that resume ready, as this manager will be gunning for you, cannot be persuaded by reality, and their hiring manager is not doing a good job.

All pretty bad signs.

[-]

f0gax@reddit

Let me understand this:

Your leadership is asking that there be fewer CVEs to remediate. Is that accurate?

That's just insanity. It's like asking your team to make sure that less rain falls on your building during storms.

If they're looking for a KPI, it would be more informative to look at the percentage of CVEs of certain scores are remediated in a particular time window. And then set an SLA to meet.

For example:

95% of 8.0+ should be remediated within 14 days.
95% of 5.0-7.9 in 30 days.
Etc.

[-]

Scalybeast@reddit

I'm not even sure that example would work because based on what the OP described, leadership doesn't even understand what is in that report. It doesn't look like they are even looking at the specific CVEs being fixed or their age, just maybe the severity and number of systems affected.

[-]

Scalybeast@reddit

You may just have to do an ELI5-type presentation at your next meeting because this guy clearly doesn't understand what CVEs are, work, and apply to your environment.

[-]

heapsp@reddit

First time dealing with incompetent managers? Dumb manager want number to go down, make number go down.

Is it a line of sight scanner? Just add some ACL so the scanner discovers less . This will make 'new CVEs' go down and you can do it under the guise of 'zero trust' which is another buzzword managers love.

easy there Mr Bradbury!

[-]

unixuser011@reddit

He looks at new CVEs on the report and wants it lower

Sure, we'll get right on to Mitre and ask them to lower the CVE's in their next report /s

genghisjohnm@reddit

The only thing I can imagine, if I’m being generous and trying to get him the number he is after… maybe the total number of CVEs being fixed includes duplicates across several similar or same devices? And if that IS the case, then consolidating them to say one CVE fixed on X amount of devices (or simply all affected devices). If he just doesn’t understand, that wouldn’t change the work you do, but would change the number he sees. Again, this is going out on a limb but I have had to deal with similar requests and pushing back got me in trouble until I learned to just give them what they want in the way they want it.

[-]

BasicallyFake@reddit

You just need another data point on the chart.

Existing CVE as of Date #1, Number of CVE corrected since Date #1, New CVE's released since Date #1, Total Open CVE

Provide him the correct answer in order for him to be able to show progress.

[-]

SexyEmu@reddit

What kind of ballbag manager uses CVE's as a KPI?

[-]

mineral_minion@reddit

Makes perfect sense, count of active CVEs is a number, KPIs are numbers.

[-]

mzuke@reddit

Maybe try explaining it via a different example:

If you own an independent auto repair shop but get contracted to repair recalled vehicles (I know this isn't how it works but stay with me)

It is the manufactures and Gov driving the recall notices

If you got 3 recall notices last month and 4 this month the number of recall notices went up

but if you repaired all the assigned vehicles for first 3 recalls you did your part of the job

Patching and remediation isn't a race, there is no finish line, so really it is more of a death march

[-]

MoPanic@reddit

Just correct their grammar. excuse me, that should be fewer new active CVEs, not less. Jeez.

[-]

marshmallowcthulhu@reddit

Explain the concept to the manager in Windows terms. There are new Windows updates every month. Does your manager prevent the vulnerabilities from ever appearing on his computer, or does he remediate them by applying updates? Put it into a context he interacts with.

[-]

Johnny_BigHacker@reddit

You could suggest updating to a new version or new software entirely. Try to get a price for them. Show it to him in business sense.

[-]

silentseba@reddit

Lower the number of CVEs by lowering the amount of services you manage.

[-]

Grimsterr@reddit

But how mad he got, got me thinking if I'm being the dumbass in this situation.

Depends on who this mangler is and who he's connected to further up the food chain. you may have just made a powerful enemy, and many would consider that a dumbass move.

[-]

PinotGroucho@reddit

You're approaching it the wrong way. There's nothing wrong with being strong headed or even passive aggressive in reprimanding management stupidity, but they're still management with the accompanying responsibilities.
Once you take those seriously (in the sense that you openly acknowledge them) they will no longer feel threatened by your forceful feedback.

for example, you could:

Tell them what you told them all things being and staying equal.
Tell them you can radically reduce the number of critical CVE's raised each month by reducing the possible attack surfaces following several strategies:
1- radically cutting into the technology stack.
Using far less services from a decreasing number of suppliers would be the most successful approach. Less vendors means less CVE's. Let's start with one of our biggest, let's say the supplier of most of our desktop applications. It's where the rubber meets the road.
maybe our users can get used to their new linux workspace & libreoffice & Jitsi collaboration suite.
2- drastically reducing the attack vectors that would exploit the CVE's thereby reducing their criticality by way of cutting service exposure.
No more working from home. No more remote sites, no more apps on phones, only zero trust networking etc.

a few of these are best practices anyway. They might make it on the long backlog or you might squeeze a neat project with an earmarked budget out of it.

Good luck OP ! exploit their ignorance, don't get run over by it.

[-]

ukulele87@reddit

You need to treat him as the idiot he is. Always use metaphors like he was a child: "You cant ask a doctor for less people to get sick, but you can measure how many people they heal."

[-]

traydee09@reddit

Last patch Tuesday Microsoft patched.. 85 vulnerabilities, the month prior, they patched 79... the month before that it was 92... (I dont know the exact numbers...) but what that tells me is next patch tuesday, they are going to patch another ~80 vulnerabilities. This means there are ~80 vulnerabilities that exist right now that cannot be remediated until Microsoft does something. So you can get the vulns down for two weeks, until the next patch comes out, then the pop right back up.

An org cannot get to zero. What you need to do is find an acceptable number, and try to maintain at that number. This is where layered security comes in. Servers behind a load balancer or firewall, servers running AV, servers with minimal software on them to reduce complexity and attack surface, monitoring, controlled credentials, etc.

[-]

Damdo54@reddit

You're not stupid or loosing your mind, you know your job, you don't have to pay mentally for thoses stupid managers looking KPIs without understanding what stand behind.

[-]

Ad-1316@reddit

I got it! Just turn it all OFF, internet and all servers and PCs. Nothing can be done now, but we got it to zero.

[-]

ka-splam@reddit

theoretically you can't ask us to lower the number of newly discovered and active CVEs in the next report.

Reduce the number of products, services, tools, libraries, versions you use, the number of CVEs which affect you will trend down.

If he wants a smaller attack surface, why are you saying that can't be done?

[-]

Dumfk@reddit

Place a request for tarot cards, crystal balls and tea leaves.

[-]

LForbesIam@reddit

Again this is the biggest issue in the tech industry is that management is not qualified to do their job.

If you have a law firm, the directors are lawyers. In a hospital the Chiefs are doctors.

IT should be the same way. ALL IT management with decision making should have been techs previously and be able to understand the technical environment to get the job.

[-]

Manglement is so inept in this situation, you've gaslit yourself into thinking it's you from sheer bafflement.

[-]

bigdeezy456@reddit

“I can explain it to you, but I can't comprehend it for you.”

― Edward I. Koch

[-]

Bleglord@reddit

It’s almost like most managers are useless in a company and have to make up bullshit metrics to seem relevant

[-]

CombJelliesAreCool@reddit

What search term does one use to find one of these jobs primarily patching servers? I'm a windows sysadmin right now but I would drop down to t1 support if it meant I had a chance at working primarily with Linux.

[-]

mjulnozhk@reddit

Managers are a dime a dozen retarded. Work comes in, static effort goes out.. If they want the number reduced and the input is always high, they need to hire for more output. Simple.

I'm in a similar position and I'm probably just going to quit haha

[-]

Lando_uk@reddit

We have a power bi report of CVEs, and one section charts recently mitigated CVEs, so this is a good chart to show managers and secops that you're actually combating them as they come in.

[-]

asic5@reddit

Guy sounds like a dumbass.

[-]

MrPooter1337@reddit

Wait, fix 8k CVEs a month? How is that possible? Sorry, I don’t come from a software development background, so that sounds crazy 😅

[-]

dracotrapnet@reddit

I've got bad news for the pointy haired guy. It's November. There are going to be a pile of college and high school students off on holiday soon with nothing to do but find new things to break. Same goes for the pro programmers are going on holiday as well. Guess who is left committing code? B-team. The quality of feature updates and security fixes will be dropping until mid January. Just look at Microsoft, Vmware, and Palo Alto, they can't even put out fixes without doing them twice lately.

The number of CVEs magically rise every time there's a pwn2own competition either vendors release fixes suddenly or Hacker(ahem)... Security researchers sit on discoveries and abuse them during the competitions. https://www.bleepingcomputer.com/news/security/over-70-zero-day-flaws-get-hackers-1-million-at-pwn2own-ireland/ It looks like the next round is Jan 2025 Tokyo.

[-]

UltraEngine60@reddit

Tell him to read this:

https://www.helpnetsecurity.com/2024/02/26/cve-count-rise-2024/

Maybe something in his head will "click". Or he doubles down and fires you for insubordination.

[-]

TrueStoriesIpromise@reddit

https://csf.tools/reference/nist-sp-800-53/r5/cm/cm-7/

The only way to comply is to remove unnecessary software/packages from the environment, which you should be doing anyway.

[-]

Pork-S0da@reddit

Try an analogy: You guys are doctors. You can treat many diseases every month, but you have no control over the medical community discovering new ones in the wild every month.

[-]

123ihavetogoweeeeee@reddit

It reminds me of the saying “you’re 100% right and 100% fired.”

Critical Thinking - 5 Why method

So if your boss has a target objective given to him by his boss you can either ask your manager about it or go to the source.

Same with customers. If you don‘t understand requirements you need to ask about why they are importantly and what results are expected to correctly address them in your products and services.

[-]

BlackSquirrel05@reddit

Better yet ask.

"Oh how are those actually exploited? Or how are those actually discovered if there was a person able to compromise the network?"

I know people don't actually care about that... But it's frustrating that people jus think "CVE == already ransomwared or broken into."

[-]

ScotchyRocks@reddit

This all wreaks of communications issues.

You two may be working on two different puzzles. But haven't clearly stated that.

Nah you're right he doesn't understand what he's asking that's common on non technical managers if he understood the challenge we would ask the team to prioritise CVE against something less pressing or important, or look for areas of improvement like automation to free up man power to deal with CVEs, it's not rocket science the dude just doesn't know what they're talking about and doesn't seem to want to know just wants nice graphs to show upper mgmt.

Use an patronising example next time, here you have 6 spoons I'm currently putting 3 spoons on CVE 2 spoons on project work and 2 spoons on BAU how many spoons do you want to take from project work or BAU to put in CVE

[-]

CrackCrackPop@reddit

Just provide him a solution, tell him about rapid response systems like RHEL or SLES.

Like how livepatching and scheduled reboots on every machine can be implemented.

About the usual response time of the paid time of either RHEL / SLES and how quickly they fix the CVEs in general.

Lastly give him a quote of the licensing, about 7000$ per year per ESXi core

[-]

CamelDangerous6437@reddit

"I asked if he wanted an explanation now."

Debates like that shouldn't be done in front of the group that your manager oversees. The professional play would have been to talk to the manager, one on one, at a properly scheduled time. Debating in front of the group/team just makes y'all look like you're in a dick swinging contest ('I'm smarter!" vs "I'm in charge!").

The manager SHOULD know more about what they are managing. And you need to work on presenting your ideas in a more professional manner.

[-]

RedDidItAndYouKnowIt@reddit

I haven't seen this posted yet. You're in the right but you're not achieving your goal. So two books I am certain can help you to have productive conversations with him and achieve what you need:

How to Win Friends and Influence People

Critical Conversations

You're not the dumbass, you're the engineer. You're the scientist. It's ok to call out stupid things as stupid, just do it professionally. Always calm, always a level voice, never hyperbole.

There will be a time when you both are in a room trying to make a persuasive case. Let his hot headedness make his.

[-]

Dizzy_Bridge_794@reddit

You could have answered more tactfully.

[-]

baudwithcompter@reddit

Just look into your magic IT crystal ball and make sure you solve those CVE’s before they happen!

[-]

ShortFuzes@reddit

Just out of curiosity... Any tips for securing a job as a Linux Sysadmin? Or breaking into it per se?

[-]

KnowledgeTransfer23@reddit

Tell him if you were a mechanic and he was your boss, would he be asking about lowering the number of recalls on Chevy trucks?

You can't control how many recalls are issued. You can only maybe increase the number of recall fixes you do for your customers.

Maybe then he would understand.

kakistocracy

[-]

tactiphile@reddit

This needs to be OED's or Merriam-Webster's 2024 word of the year

[-]

relevantusername2020@reddit

funny i actually had a comment written out a bit ago about how ive been getting into the habit of checking the word of the day (and daily quotes - the word kind not the gambling market kind) from bing and merriam webster, spurred by microsoft rewards, and well. ive always been a bookworm and loved reading and words and whatnot, but the other thing ive been really getting into the last year or so is etymology, and (stick with me i know im all over the place, ADHD) theres a great website, etymonline.com, and its kinda funny. they have a trending words section, and ill often see a word trending there and then not long later ill start seeing it everywhere, or itll be the word of the day, and i mean i know reddit likes to refer to the baadar meinhoff* effect but actually? nah. im pretty sure etymonline and associated word nerd websites are just the resources that word nerds actually use, so when a word is trending, then its likely the people who write the things that the peanut gallery reads will be using that word soon. if that makes sense.

Cybersec here - you're absolutely not in the wrong. This guy clearly has no understanding of what CVEs even are.

If he really pushes the point, I would ask him to formalise a KPI for your team and ask the cybersec team to advise on how many CVEs you should be "allowing" every month.

Grab some popcorn.

[-]

StaffOfDoom@reddit

You weren’t wrong, like a motorcycle rider isn’t wrong…you did all the right things but you’re still getting ran over. Why? Because you called out a new(ish) hothead manager in front of everyone. If there is a next time, explain to the person outside of a group what all these technical things mean so he can save face…in fact, be proactive. Next new guy in your business (whatever company you land at next) explain all of this at the front of the load, not in the middle of the meeting.

Try explaining in simple terms that CVE’s are generated by a third party and not internally. That patch cycles dictate the fix availability, not how hard your team works, and it’s part of a cycle.

[-]

OldManAngryAtCloud@reddit

You are not the dumbass. I ran into something very similar to this at my previous job when our CEO wanted to see these sorts of metrics in the idiotic monthly IT Scorecard. The request was originally "# of know vulnerabilities in the environment" each month. I told the CEO I could absolutely do that, but that the number was ultimately meaningless. At first he didn't understand, but then I pointed out that if a new critical vulnerability for an application on all of our systems is discovered on the 30th of the month then the scorecard is going to show a sudden increase of thousands of vulnerabilities, whereas if it is discovered at the beginning of the month it will never be reflected in the scorecard as it will get patched before the next scorecard comes out.

He understood this and agreed that metrics around active patching and precent change of vulnerabilities month over month was more meaningful.

[-]

bigpirm1977@reddit

Your only fault is not simplifying to the point a child or my mother could understand. You can’t use logical, or legalise, or overly complicated terms with any technical words with some executives, directors , or managers.in your case it’s clear this person doesn’t understand the basics of this system, so it’s your job to help them. I would schedule a private meeting and magically say:

“We don’t control the number of identified CVEs, an external org finds them and publishes them, we react to them. Do you only want us to react to a certain number or certain criticality? I’m not sure that’s advisable or possible.”

Then I would follow up with whatever the determination was in writing.

[-]

villan@reddit

Makes me think of a cave guide I talked to telling me that they frequently get asked how many undiscovered caves there are in the area.

[-]

anotherkeebler@reddit

I used natural disasters as an analogy: we don’t control them. What we DO control is how effectively we manage them

[-]

kosmosepiraat@reddit

Oh.. So you're the one to blame for always making all of those CVEs? I get a lot of CVEs daily on my job also and have to deal with those. Could you please stop making those so I have more time to deal with more important stuff?

[-]

Yucchie@reddit

What on earth… He’s basically asking you to predict/stop the future from happening

Ask him if he can tell you how many litres of fuel will be delivered to his gas/filling station tomorrow

When he doesn’t know keep pressing for an answer. Really question him on why he can’t get an answer (which is presumably what he’s doing to you) - you want to get his cogs going so he reaches that point of frustration

He’ll inevitably snap back that he can’t predict the future

“Exactly. That’s what you’re asking us to do so stop. I’m on your side, but this is a shit metric. Find another one like xyz which works well in this many cases”

With managers like this, you have to learn the dance of managing from below

[-]

Tanium also gives you a score. Shouldn’t the goal be keep systems at x score? CVE is kinda useless metric in Tanium as it means a lot of things.

"I've been thinking for a while that this guy is just dumb."

There is a reason they are in management

[-]

notfoundindatabse@reddit

Could this be a delivery issue? For instance, you mentioned you thought he was dumb for a while. If I think someone is dumb I have a tendency to switch of and become a condescending asshole. This is not fair to the person I am speaking with and I have to ACTIVELY fight this behavior. If I don’t, I am a dick. No one wants to listen to a dick. Could you also suffer from this? Perhaps the relationship needs a reset?

[-]

stshelby@reddit

You are right, but propose a solution as well - based on time to patch based on severity, with a hard focus on internet-facing hosts

[-]

PlaneHashes@reddit (OP)

We do it. Solutions are in place. Vulns are mitigated daily.

Your manager or his manager might as well ask you to lower the amount of precipitation month over month. It's clear that neither understands what makes for an actionable metric/KPI.

I sympathize with you as I started my career as a sysadmin and had to deal with this type of thing more than I care to remember. I transitioned into Cyber Security a couple decades ago and unfortunately these type of individuals really give the profession a bad rap.

Cyber Security professionals exist to help the organization manage risk. Thousands of CVEs mean absolutely nothing if they aren't applicable to your environment or can't be exploited based on the architecture or other mitigating controls.

Many of the other commenters are right on target, you typically want to start with the age and severity of the vulnerability (although this should be adjusted based on environmental conditions... sensitivity of the system, other mitigating controls, etc.) but none of this matters if they are just tracking the raw number of new CVEs...

While you already have a full plate, I would possibly suggest reporting new useful metrics noting that many are not targets but are useful for understanding the risk landscape over time. This is effectively doing their job but sometimes you need to educate the ignorant.

Here are some more appropriate metrics for a Vulnerability Management Program:

Vulnerability Discovery and Assessment

Number of Discovered Vulnerabilities: Total vulnerabilities identified during scans over time.
Scan Coverage: Percentage of assets scanned compared to total assets in the environment.
Scan Frequency: How often assets are scanned for vulnerabilities.
False Positive Rate: Percentage of vulnerabilities identified as false positives.

Vulnerability Risk and Severity

Vulnerability Criticality Breakdown: Distribution of vulnerabilities by severity (e.g., Critical, High, Medium, Low).
Vulnerable Assets Count: Number of assets with one or more open vulnerabilities.
Percentage of Critical Vulnerabilities: Share of identified vulnerabilities rated as critical in relation to total findings.

Remediation and Response

Mean Time to Remediate (MTTR): Average time taken to remediate a vulnerability after detection.
Vulnerability Aging: Count or percentage of vulnerabilities open for:
0–30 days
31–90 days
90 days
Remediation Rate: Ratio of vulnerabilities resolved to vulnerabilities identified.
Patch Success Rate: Percentage of deployed patches that successfully mitigate vulnerabilities.

Compliance and Risk Alignment

Compliance Coverage: Percentage of assets that meet compliance scan criteria (e.g., PCI DSS, HIPAA).
Risk Score Reduction: Aggregate reduction in risk score over time, reflecting improvements in the organization's security posture.
Critical SLA Compliance Rate: Percentage of critical vulnerabilities remediated within Service Level Agreement (SLA) timeframes.

He’s a dumbass.

Yet there are actions you could take to reduce the number of new CVEs affecting your environment, by reducing the number of different systems and packages running in it. If there’s less variety of operating systems, and you reduce the number of libraries and dependencies, make your servers leaner by removing/uninstalling unneeded packages and services, you could lower your average CVEs.

This may very well not be your decision or under your control of course. Developers being what they are, they usually can’t update their shit and you need 6 versions of .NET and 18 versions of php, or they always want the newest shiny toy and add to the pile of libraries installed…

[-]

PlaneHashes@reddit (OP)

As you say, I have no control over that part. I have to maintain what exists. We push for lean servers but sometimes it's not possible.

Still I can live with that.

If only he was asking for leaner servers, I wouldn't have said anything.

But asking us to solve more so there are less new CVEs... WTF. Next time, ask for no rain tomorrow too.

[-]

HotPieFactory@reddit

But how mad he got, got me thinking if I'm being the dumbass in this situation.

No, he's mad you showed everyone in the meeting what a dumbass he is. Not your fault of course. You've been polite in your first explanation.

[-]

drunkenitninja@reddit

You're good. Sounds like this "manager" is new, or at least new to IT. I wish I could understand why managers believe that they know more than the SME's that they're supposed to be managing.

This is the classic problem with people managing teams without prior experience in what the team actually does,

As I said. Shutting the fuck up and doing my job was something I learned with my senior admins 10 years ago. This has saved me from a lot of unnecessary discussions.

But man, I have a limit, and this new management keeps going on and on about this stupid number.

The truth hurts, that is a 100% True. Corporate assholes are being borne and hired every day. Leadership does not want you to have idea's because, when you say the truth the invertors that have no clue what you are talking get spooked the fk out, not because the way you say it because they are to head down in the toilet that that business has become they scared. Yes Men-ism became a value in some company's instead of NOT being one. All tech people are replaced by business fed retards that have no grip on reality. That is why you should not argue with business fed cretins, they know shit, but get scared fast.

[-]

PlaneHashes@reddit (OP)

Indeed.

[-]

ruyrybeyro@reddit

Boo hoo, you called off the 'security guy'—you know, the one who couldn’t tell an OS from a stats sheet, scraped by with a few certs, strutted around in a suit, and stuffed PowerPoints with random numbers from black-box tools. What a pity.

[-]

PlaneHashes@reddit (OP)

I have all the data on what we do, how many vulns we fix. Showed him.

Dude is fixated that we have less newly discovered vulnerabilities on the next report.

Doesn't budge. Says I'm wrong in saying that we have no control over what will be discovered.

[-]

ruyrybeyro@reddit

Who knows, maybe he’s onto something. Ask him for the next EuroMillions numbers.

[-]

Essa_ea@reddit

I like your approach, you are being realistic in what you do.

[-]

PlaneHashes@reddit (OP)

Thank you!

[-]

D_Fieldz@reddit

Sounds like he wants to make his mark, goes for low hanging fruit of which he has low understanding.

A tale as old as time, don't fret. Managers, especially newer ones can be a pest.

[-]

PlaneHashes@reddit (OP)

Indeed. I've seen from this thread that I've been lucky. First time facing a guy like this.

[-]

RatsOnCocaine69@reddit

How do you track vulnerabilities (and their remediations) if you don't have an overview of your servers though? I get there are seemingly too many to track but then how do you do config management? If not, whose jurisdiction is asset management?

[-]

PlaneHashes@reddit (OP)

We track it on a DB where remediation plan and result are saved. When I said I don't even know how many servers I overview, it was just an expression to convey that the size of the infra is gigantic.

[-]

Temetka@reddit

It’s time for malicious compliance until he goes away.

[-]

PlaneHashes@reddit (OP)

Thought about it: stop scanning for vulnerabilities. Then the number of new ones goes to zero and we will all be happy!