Building a PSIRT for a Standards Organization
summary
Standards group creates a vulnerability response framework after ten months and 150+ substantive comments, establishing a VRT of 4–6 responders nominated by the board whose membership persists across board turnover but ends if the employer leaves. Incidents average one–three per year; cases assign by a simple round‑robin file. Team uses PGP, CVSS, TLP, Signal; publishing is approved by any two officers and $800 of legal hours is preallocated for emergency consultation. IP control is the primary obstacle.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 3:14PSIRT need for standards group
- 6:02Overcoming IP concerns
- 8:51VRT roles and responsibilities
- 11:45Handling vulnerability reports
- 13:49Multi-party incident coordination
- 15:35VRT tooling and support
- 16:41Legal and publishing approvals
- 18:10Lessons learned
- 19:13VRT outcomes and takeaways
related talks
01h 29mFrameworks and Related Standards
45mRunning an efficient bug bounty program and PSIRT... (Garrett McNamara, Jeff Guerra)
37mPrioritizing Vulnerability Response with a Stakeholder Specific Vulnerability Categorization
29mBuilding a Product Security Incident Response Team: Learnings From the Hivemind
01h 27mOpen-source Tools and CSIRT Success Stories
52mAnatomy of a Vulnerability Response - A View from the Inside
25mConsiderations in CSIRT Activities in the Risk of Infection with New Real Viruses
27mStep 0 for a Multi-party Vulnerability Coordination is Yet Another Multi-party Vulnerability Coor...