China's New Vuln System
summary
China creates what functions as a hot leads desk for offensive teams via a new mandatory NVDB run by MIIT with five front portals, feeding MSS 13th Bureau and PLA-linked labs. Regulations (Sept 2021) impose a 48 hour gag rule on disclosure, require private partners to supply vulnerabilities, and by minimum quotas imply at least 1,190 researchers producing ~2,000 reports and ~141 critical bugs yearly. Public evidence shows delays, internal tagging (CSV D), and links to weaponization.
AI-written summary · about
chapters (7)
- 0:00China's vulnerability system intro
- 1:07Pre-2021 vulnerability databases
- 7:522021 regulations and reporting
- 17:30Military integration in vulnerability handling
- 21:48Impact on ICS vulnerabilities
- 27:53Implications for foreign companies
- 29:59Q&A
related talks
10mChina Stands Up: Cybersecurity Talent and Innovative Policies in Xi's China
30mThe National Vulnerability Database (NVD) – Where It Is and Where It’s Going
41mNIST’s National Vulnerability Database Update and the Vulnerability Enrichment Ecosystem
29mWorms, Tokens, and Trust The Industrialization of Supply Chain Attacks
01h 00mNew immune system of information security from CHINA
29mThe Quality Imperative for CVEs: The Need For Enhancing Vulnerability Reporting Standards
23mHitchhikers' Guide to the Vulniverse
17mThe Hidden Cost of CVEs: Can CSAF and VEX Change the Equation?