Keynote: Keep Calm and Keep Coding: How To Not Panic When Big CVEs Drop
summary
When a major CVE drops the concrete steps are: inventory everything, generate SBOMs, ingest them into GUAC to build a dependency knowledge graph, and query it to answer “am I affected” and “where is it used.” An example run shows 27 instances of a vulnerable component across deb packages, containers and images; the graph links to repos and owners so teams can prioritize patch, rebuild and redeploy. US EO 14028 accelerates this workflow.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 0:21Vulnerabilities and Log4Shell impact
- 1:46Why panic varies
- 2:29SBOMs for vulnerability management
- 3:33Co vulnerability case study
- 4:43Seven-day action plan for CVEs
- 5:48SBOMs at scale challenges
- 7:12SBOM implementation questions
- 8:15Third-party dependencies management
- 9:18SBOM limitations and tools
- 9:40GUAC for artifact analysis
- 10:23Check if affected by CVE
- 10:46Locate vulnerabilities in stack
- 11:49Patch and remediation plan
- 12:52Pre-prepared plan benefits
- 13:13Resources and conclusion
related talks
35mKeynote: How I learned to stop worrying and love CVEs
35mKeeping Up with the CVEs: How to Find a Needle in a Haystack?
15mKeynote
33mUnderstanding the Impact of Critical Vulnerabilities in Critical Infrastructure: A De...
14mKeynote: The Human Cost of Security in the AI Era
14mKeynote: Panic in San Francisco: The Critical Vulnerability That Wasn't
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
09mKeynote: Vulnerability Data is Not Enough: The Case for an Actionable UI