Step 0 for a Multi-party Vulnerability Coordination is Yet Another Multi-party Vulnerability Coor...
summary
Ericsson PSIRT analyzes ~15,000 vulnerabilities a year and flags 3,500+ applicable vulnerabilities across a 500+ product portfolio; a real case involves an internally developed, widely reused component that forces fixes across 20+ development teams, multiple supported versions and customer-side actions. A bill-of-materials tool, the Ericsson vulnerability management service, identifies downstream products, after which coordinated info sessions, templates for timelines/severity/workarounds, legal/comms buy-in and controlled disclosure are run. Main claim: step zero is internal multi-party coordination.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:25About Ericsson
- 2:32Agenda
- 3:41Multiparty Vulnerability Coordination
- 5:59What is Step 0
- 8:22Case Study
- 12:30Step 1 Identification
- 13:50Step 2 Info Sessions
- 15:10Step 3 Stakeholders
- 16:16Step 4 Fixed Coordination
- 17:54Challenges
- 19:38Communication
- 21:30Thought Experiment
- 22:35Variants
- 23:50Conclusion
related talks
11mVulnerability Supply Chains
02h 15mFIRSTCON21 - June 9 | Stream 2 (12:00-14:15)
31mEfficient Vulnerability Management in Hierarchical Supply Chains
27mProduct Security Vulnerability Management Metrics are Hard
52mAnatomy of a Vulnerability Response - A View from the Inside
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
59mWho’s Vulnerability Is It Anyway? Harmonizing Stakeholder Roles in Vulnerability Management
01h 00mAdventures in Vulnerability Coordination