Adventures in Vulnerability Coordination
summary
CISA describes step‑by‑step coordination: use of the open‑source vents platform to manage 2–400 concurrent cases, reliance on SMEs and legal counsel, and an FDA MOU for medical devices. Examples show one case lasting about five months, another over one year where a researcher’s 90-day disclosure forced accelerated publication, CVE records reserved then published, FOIA requests and post‑publication cleanup, SII scanning for device prevalence, and that SBOMs would materially improve impact tracking.
AI-written summary · about
chapters (15)
- 0:00Welcome
- 1:02Housekeeping
- 2:29Speakers and format
- 3:31Coordinated vulnerability disclosure
- 8:07Foundational principles
- 12:23CVD tools at CISA
- 18:28Case study: choose your own adventure
- 21:15Critical infrastructure case
- 31:19Lessons from first case
- 35:13Transition to international case
- 36:36International coordination case
- 47:14Lessons from international case
- 50:49Process improvement
- 53:16Call to action
- 54:17Q&A
related talks
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
44mA Researcher Centric Approach to Coordinated Vulnerability Disclosure
01h 04mOpen Discussion - International Challenges with CVD, CNA, and CVE
18mWhat You Need to Know and Do about Vulnerability Disclosure
33mUnderstanding the Impact of Critical Vulnerabilities in Critical Infrastructure: A De...
52mAnatomy of a Vulnerability Response - A View from the Inside
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
01h 08mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software