Mission Possible: 24 Hours To Save The World With Security Compliance
summary
European CRA forces a 24 hour window to triage and report vulnerabilities with fines of about 15 million euros or 2.5% of global revenue, and organizations must prove traceability from binaries to source at massive scale (companies run millions of components). The AboutCode stack (examples: ScanCode, Package-URL, VulnerableCode, DejaCode) builds SBOM automation, a binary→source resolver, and federated vulnerability feeds; current reality shows SBOMs are garbage and missing software catalog and deployment metadata, so tooling plus engineering standards are needed to make reporting workable.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 4:54CRA compliance deadline
- 6:21Paper processes vs security
- 9:1224-hour vulnerability reporting
- 12:21Compliance automation tools
- 15:36Exploitability scoring
- 18:05Broken vulnerability management
- 21:55Closed-source vs open source
- 24:03Software releases and dependencies
- 27:12Notify-and-ignore workflow
- 30:00Product and software catalog
- 33:13Reporting requirements
- 35:19Federated vulnerability systems
- 37:48Open source advantages
- 38:52Engineering standards lessons
- 40:37Q&A
related talks
13mNavigating the complex and rapidly evolving world of product and application security regulations
29mSponsored Session: Who Will Move Your Cheese ? IEC, CRA, Cyber Security
27mHow to implement Security as Code?
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
48mCRA, NIS2, DORA: What Senior Java Engineers Must Deliver Before 2027
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
44mThey're coming to regulate you!