Basics count

My Friday Thought: The faster highlighting of critical vulnerabilities today compared to two years ago, point towards ensuring you doing the basics right.

Teams which have already simplified their path to live to ensure a short lead time without comprising quality or secuitry will have already set themselves up to respond to fixes swiftly.

A focus on shifting left with secuitry and integrating simple secuitry scanning into a pipeline will have already changed development and thinking around secuitry often meaning consideration within the pipeline has been already done.

Placing high priority on patching with a short lead time to patch, won't change the significant increase in load, but will have let the teams up for greater sucess. Organisations that place a significant importance on run (or operations) over build (or development) will already have funding and capabilities to respond - this doesn't change the fact they might need more capabilities now, but the conversation was already balanced in their favour.

The current overload of CVE's flooding in have just highlighted what was already true - you need to patch often, have one path to live and where possible have immutable infrastructure to allow you to better respond to any operational impact