Elevating Security Standards: Intel's Integration of Common Security Advisory Framework into ...

on YouTube ↗48m

" summary

Intel maps its existing advisories to CSAF, builds a phased MVP, and moves toward generating CSAF first to auto-render human HTML; tooling already auto-populates CVSS (v3.1 and v4.0 co-published) and extracts tracked fields, while 5 of 12 sections are automated and seven remain freeform for now. Validation is implemented in-house (started in Python, now a ServiceNow-based JS validator), ESOM/product inventory is in flight, and the org covers roughly 60–65k SKUs.

AI-written summary · about

" chapters (28)

1. 0:00Intel's security advisory journey
2. 2:48Talk goals and agenda
3. 3:53Intel's advisory process
4. 7:24Mapping advisories to SEAF profiles
5. 11:27Why Intel adopted SEAF
6. 13:14SEAF implementation strategy
7. 15:02SEAF JSON structure
8. 17:12SEAF product tree structure
9. 19:44Vulnerability details in SEAF
10. 21:30Intel's advisory workflow
11. 24:00Data collection and triage
12. 26:04Reviewing security advisories
13. 28:54Challenges in validating advisories
14. 30:18Streamlining review with SEAF
15. 31:42Improvements in Intel's process
16. 32:45Lessons from Intel's SEAF journey
17. 34:51Q&A: Hardware vs software disclosures
18. 35:56Q&A: Automating CVE descriptions
19. 37:40Q&A: Communicating SEAF changes
20. 38:44Q&A: Extending SEAF for hardware
21. 40:07Q&A: Product team adaptation
22. 41:55Q&A: SEAF-first drafting challenges
23. 42:59Q&A: Tooling for SEAF generation
24. 44:11Q&A: Validation tool
25. 44:34Q&A: Product version in SEAF
26. 45:58Q&A: CBRF and VEX plans
27. 46:42Q&A: Public VEX repositories
28. 47:23Q&A: CVRF vs SEAF differences

" related talks

• 39mCSAF - the Magic Potion for Vulnerability Handling in Industrial EnvironmentsTobias Limmer, Thomas Pröll · 34th Annual FIRST Conference 2022
• 25mCSAF 2.0 - A New Start to Automate AdvisoriesThomas Schmidt · FIRSTCON21 Virtual Edition 2.0
• 45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...CRob, Madison Oliver · Open Source Leadership Summit @ Open Source Summit North America 2023
• 46mThree Musketeers: CVE, CSAF, and VEXJonathan M. Spring, Eoin Wilson-Manion, Tyler Zellers · CVE/FIRST VulnCon 2026 & Annual CNA Summit
• 39mSecurity Advisory Programs: Creating Transparency Along the Software Supply ChainTyler Townes · SupplyChainSecurityCon @ OSS NA 2023
• 13mSecuring the Software Commons: Standards, Automation, and AI for a Resilie...Abhishek Arya · Open Source Summit Europe 2024
• 37mGoverning Global Vulnerabilities: Standards for Open Source ResilienceYogesh Mittal · DevConf.IN 2026
• 32mOperationalizing SSVCLindsey Cerkovnik, Sean Letona · CVE/FIRST VulnCon 2025