No. 73: Stop Managing Risk in Cybersecurity
Stop managing risk! It doesn't work! Official bodies shall tell manufacturers which security measures are needed to meet the minimum bar. Telling them to figure it out themselves is a waste of time. Safety doesn't use risk assessment but more effective people. What can security learn?
Read next
Understanding the CVSS Metrics for Exploitability
Instead of fixing hundreds of CVEs, manufacturers can provide enough security measures to make the exploitation unlikely. The decrease of the CVSS metrics is a useful indicator how effective the security measures are. This post is about understanding the CVSS metrics.
Running Example for CRA: Heat Pumps in Private Homes
From now on, I'll use heat pumps in private homes as the running example for my CRA articles.