you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 1 day ago (6 children)

Erh we have the NIS2 directive… requirements are skyyyyyy high for critical infrastructure which is surprisingly a lot of industries. Among other things vulnerability management is a topic companies subject to NIS2 must cover. Not saying that it cannot happen to have outdated crap connected somewhere but the exposure is getting fast smaller and smaller.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 3 points 1 day ago

    The problem as that these directives and standards are completely beside the point. They do manage a lot of security-relevant stuff, but in the end what's hacked isn't the documentation the standards require but the actual code running on the machine.

    And there's pretty little that the standard can do against actual honest bugs and mistakes in the code.

  • source
  • parent
  • [–] 3 points 1 day ago (4 children)
  • [–] 2 points 1 day ago (3 children)