Vulnerability Supply Chains
summary
Coordinated disclosure and vulnerability management remain manual and guess-driven since 2002 despite incidents like BadAlloc and KRACK; investigations still turn up thousands or tens of thousands of potentially affected vendors (slides cite 285 and 183 vendors for examples). A practical fix is an software bill of materials that builds a dependency graph, and a structured status model — VEX statements (CSAF-profiled) — that records affected/not-affected and reasons (e.g., code compiled out), while Veracode data shows actual downstream inheritance under 5% in Ruby/Java/Python.
AI-written summary · about
chapters (6)
related talks
31mEfficient Vulnerability Management in Hierarchical Supply Chains
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...
51mVulnerabilities Without CVEs: Governing the Dark Matter of Internal and Unknown Software
40mManaging Risk Across the Vulnerability Ecosystem
27mThe Vulnerability Ecosystem’s Vendor Bias — Exposed by Open Source
48mHow to report a vulnerability: Responsible Disclosure for Developers
29mFragile by Design: Large-Scale Evidence of Supply Chain Risk
33mUnderstanding the Impact of Critical Vulnerabilities in Critical Infrastructure: A De...