FIRSTCON21 - June 8 | Stream 2 Part 1 (12:00-13:00 UTC)
summary
Dell's PCERT centralizes scalable root cause analysis by prioritizing breadth over deep dives, auto-mapping vulnerabilities to CWE→SDL control mapping and feeding BI dashboards for trend and just-in-time education; a real case shows a storage product port exposed due to a missed threat model and leads to a CVE and a recommendation to add network scans. Brazil's RNP maps personal-data flows with 76 spreadsheets and interviews, scores risks by probability×impact, identifies mapped 86 systems and 10 critical systems to prioritize LGPD compliance and has trained 150+ professionals.
AI-written summary · about
chapters (19)
- 0:00Event introduction
- 2:32Root cause analysis in secure dev
- 7:05Scaling root cause analysis at Dell
- 10:38Quantity over deep analysis
- 12:23Asset categorization challenges
- 14:27Starting data collection
- 17:13PCERT workflow integration
- 21:28Root cause analysis example
- 24:39Stakeholders and data consumption in root cause analysis
- 30:32Maturing RCA process
- 32:36Key insights from data
- 41:49LGPD compliance intro
- 44:06Brazil's LGPD regulation
- 46:39RNP's compliance strategy
- 48:13Data mapping methodology
- 51:09Risk analysis priorities
- 53:13Data mapping results
- 55:03Training academic community
- 57:10Closing remarks
related talks
31mRoot Cause Analysis (RCA) in Dell PSIRT
20mConnecting the Dots in a Cyber Pandemic Era
33mUnderstanding the Impact of Critical Vulnerabilities in Critical Infrastructure: A De...
53mPanel Discussion: Enabling Accurate, Decentralized Root Cause Mapping at Scale
34mLightning Talks
30mRound Table | Cyber Resilience: Prepare, Test and Survive
09mOpening Remarks + CTF Overview
27mGet Your Security Priorities Straight! How to Identify Workloads Und...