What It Takes to Lead America’s Vulnerability Management Team
summary
CISA outlines concrete changes: it stood up a Security‑by‑Design team and a Cyber Resilience team, runs a Rapid Action Force that tests mitigations, publishes advisories in CSA/SEAF machine‑readable (JSON5) formats, and drives KEV and CVD operations while recruiting CNAs. Panel cites ~365 CNAs across ~65 countries and exponential CVE growth since 2016, stresses data quality fixes (CPE/CWE fields), operationalizes SSVC decision trees, and urges shift left and class‑based defect elimination.
AI-written summary · about
chapters (10)
- 0:00Vulnerability management leadership
- 3:10CISA team structure
- 8:58CVE data and growth
- 16:23Vulnerability response challenges
- 25:06Secure by design principles
- 33:57Progress in vulnerability elimination
- 44:35CISA operational steps
- 48:54Secure by Design alerts
- 57:37Community change and regulations
- 1:04:42Closing discussion
related talks
56mCISA’s North Star Vision for the CVE Program
01h 00mCVE Records: The Cybersecurity Glow-Up You Didn’t Know You Needed
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
37mMore Than a CSIRT: Lessons Learned from Supporting a National Response to COVID-19
40mHow CISA Is Charting a Path Toward Defensible Infrastructure
48mCISA-ENISA Joint Messaging
52mData-Driven Cyber Policy: From Dream to Reality