Why is patching edge gear still so ticket-driven?
A serious vulnerability can still trigger approvals, scheduled windows, and manual work across a fleet. Is automated rollout practical for edge infrastructure, and what tends to keep teams…
vulnerability management
Can Runtime Security Controls Help Reduce Risk During Long Release Cycles?
Our release cycles are extremely long, and the security backlog grows between releases. I'm spending more time responding to tickets than doing productive work. Even when we use…
How do you prioritize hundreds of container CVEs so the real risks get fixed first?
Our container images are scanned on every build, and the results often contain hundreds of high and critical findings, many of them inherited from base-image packages. In the…
How do you prioritize the hundreds of CVEs found in container images?
I maintain the container images for our services, and vulnerability scanning produces hundreds of high and critical findings every week. Most are inherited from base-image packages, and many…
How should you answer an interview question about patching frequency?
I was asked during an interview how often I update or patch systems. I answered, "It depends on what you're updating, but I update as often as needed."…
How Are You Managing the Surge in Security Patches?
Patch volumes are getting unusually high. Oracle's August critical patch update included 925 CVEs, while Microsoft's August Patch Tuesday had 398 after July's 570. Vendors are increasingly using…
How Can We Update Built-In Windows Apps During Device Provisioning?
We build physical and virtual Windows devices from a base WIM, but the built-in AppX applications in that image sometimes contain vulnerabilities. These apps eventually update after a…
How can we update built-in Windows apps before anyone logs on?
We build physical and virtual Windows devices from a base WIM, but that image often contains vulnerabilities in the bundled AppX applications. The built-in apps eventually update after…
A Green Dependency Scan Doesn't Mean You're Covered
Security scanners are useful, but a single successful scan in CI only tells you that the dependencies looked acceptable at that moment. If a new CVE is published…
How Can I Prepare to Work with Qualys Patch Management?
I'm not a systems administrator, but I've been asked to help my sysadmin with Qualys Patch Management. I've completed some of Qualys's free training and want to show…
How Do I Handle Growing CVE Backlogs in My Container Images?
I've been using Prisma Cloud for container security for about 8 months now, and while it does find vulnerabilities, our backlog of CVEs in Jira keeps growing. Just…
How Can I Effectively Measure Improvements in Container Security?
I'm facing a challenge in demonstrating the effectiveness of our container security initiatives to leadership. While vulnerability numbers may dip for a short time, they often spike again…
How to Handle Vulnerability Reports with RHEL and Crowdstrike?
Hey everyone! I'm dealing with a situation in my role as a sysadmin where I've got my RHEL 9.7 system running with Crowdstrike installed. My manager keeps seeing…
How can I effectively prioritize Kubernetes vulnerabilities across multiple clusters?
I'm feeling a bit overwhelmed handling Kubernetes vulnerabilities for a client who operates multiple clusters in various environments. We've got scanning tools in place to identify issues, but…
Is CrowdStrike's Patch Management Worth Upgrading To?
I'm considering upgrading to the latest version of CrowdStrike that includes patch management features, as we currently use ManageEngine for this purpose. Has anyone here tried CrowdStrike for…
What Base Images Are You Using for SBOM Validation?
My team has been struggling with manual SBOM validation for every image update required by our vendor, which takes us over 15 hours a week! We're constantly cross-referencing…
Is Wiz Still Agentless or Has It Changed?
I recently attended a tech sales demo for Wiz, and I used to believe their product was completely agentless. It seemed to just analyze AWS environments for vulnerabilities…
Should Vulnerability Fixes Be Part of My MSP’s SLA?
I'm trying to figure out how to handle vulnerabilities found in our network by our managed service provider (MSP). It's not explicitly stated in our service level agreement…
Struggling with Defender for Endpoint - Any Tips?
Hey everyone! We recently rolled out Defender for Endpoint as part of our business premium licenses and it's been a bit of a nightmare. Our secure score has…
Best Practices for Managing Application Prerequisites
I've taken over an older application that has several prerequisites like Java, VC redistributables, and some SQL ODBC drivers. The app has been manually maintained and isn't in…