Efficient Vulnerability Management in Hierarchical Supply Chains
summary
Siemens builds a central vulnerability intelligence DB and a product-mapping database that links OS packages, proprietary components and SBOM entries, and runs a vulnerability tracker to open tickets along the supply chain; as a CNA it pushes advisories back to public CVE feeds. The team finds the same CVE with different CVSS vectors (one example shows 9.0 vs 7.7), struggles with duplicate scanner alerts, cannot fully automate brownfield package mapping, and is testing AI-assisted ID matching and an SBOM-for-vuln routing approach with partial success.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:04Siemens portfolio challenges
- 3:12Motivation for vulnerability management
- 5:58Supply chain vulnerability problem
- 8:04CVSS score changes
- 10:10Contextualizing vulnerabilities
- 11:33Tooling and data exchange
- 14:00Exponential challenges
- 16:31Vulnerability management vision
- 19:01Vulnerability intelligence systems
- 21:28Centralized data collection
- 22:55Component mapping limits
- 24:40Internal vulnerability forwarding
- 26:06Q&A
related talks
11mVulnerability Supply Chains
57mNestlé Unified Vulnerability Management Approach
26mEffective Software Supply Chain Monitoring
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...
44mSoftware development and vulnerability management to secure the supply chain
49mScaling Software Supply Chain Source Security in Large Enterprises
33mVulnerability Management Lifecycle in DevSecOps
39mCSAF - the Magic Potion for Vulnerability Handling in Industrial Environments