Open Discussion - International Challenges with CVD, CNA, and CVE
summary
Discussion documents concrete pain points and fixes: inconsistent definitions of coordinated vulnerability disclosure that fragment triage, expensive bug-bounty missteps (one company spent $2.5M in one month after skipping maturity steps), and platform limits like the Vince portal controlled by CISA that block point-to-point notifications for international stakeholders. Proposals include machine-readable advisories (machine-readable CF), pre-release rule pushes (Snort/Yara) instead of full PoC, a modular state-machine exchange (Voltron protocol), and coordinator training to onboard CNAs.
AI-written summary · about
chapters (12)
- 0:00CVD challenges introduction
- 5:22Defining CVD challenges
- 7:54Communication failures in CVD
- 10:47Bug bounty programs in CVD
- 22:59Global CVD coordination
- 39:17Role of CVD coordinators
- 45:18CNA recruitment and maturity
- 50:38Vulnerability disclosure history
- 53:26Risk assessment and CVE improvements
- 57:47Behavioral change in CVD
- 1:02:27CVD education gaps
- 1:03:51Open discussion and next steps
related talks
57mPanel Discussion: This One Time at CVD Camp
51mPanel Discussion: It is a Tale as Old as Time…. a CNA, the NVD, and a CVE Consumer Walk Into a ...
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
44mA Researcher Centric Approach to Coordinated Vulnerability Disclosure
08mClosing Remarks
58mPanel Discussion - The Risks of Requiring Premature Vulnerability Disclosures
35mWelcome & Opening Remarks