The Vulnerability Identity Crisis
summary
Current vulnerability records lack consistent identity, so the talk proposes a structural working definition and a rearchitecture: a vulnerability is a disposition combining an affected product/system, a fault/weakness (CWE-style), the specific conditions that must hold (attacker and environmental), and an actual security property violation; records use an identifier as a peg with independent assertions/bags (provenance and timestamps) that can be added after publication. MVVE and a detailed ontology underpin practical rules for edge cases like curl, kernels, defaults, and cryptographic decay.
AI-written summary · about
chapters (9)
- 0:00Vulnerability identity crisis
- 1:25Structural definition of vulnerabilities
- 8:28Edge cases break definitions
- 11:58Components of a vulnerability
- 20:42Vulnerability as disposition
- 25:38Redesigning vulnerability records
- 29:32Testing new definition
- 31:06Q&A: Insecure defaults
- 33:06Q&A: Terminology
related talks
57mA Paradigm Shift in Vulnerability Identity: Why Vulnerability Databases Struggle
28mTowards a Minimum Viable Enumeration of Vulnerabilities
45mVulntology - A Methodology to Characterize Vulnerabilities While Providing A Granular & Intuitive...
27mEffective Vulnerability Management for a DevSecOps Pipeline
50mSoftware Identity in the Vulnerability Management Ecosystem
27mThe Vulnerability Ecosystem’s Vendor Bias — Exposed by Open Source
37mVEXed by Vulnerabilities That Don't Affect Your Product? Try This!
11mVulnerability Supply Chains