All Your Vulns Are Belong to Terms and Conditions
Deconstructs global Coordinated Vulnerability Disclosure (CVD) policies, government equities processes, and regulatory mandates like the EU Cyber Resilience Act.
Summary
The Complexities of Coordinated Vulnerability Disclosure
While Coordinated Vulnerability Disclosure (CVD) is widely celebrated in security theory, executing disclosures across diverse corporate sectors remains fraught with delays, misunderstandings, and legal friction.
Navigating the Regulatory Alphabet Soup: CRA, NIS2, and VDPs
The speaker demystifies emerging international regulatory mandates—including the European Union's Cyber Resilience Act (CRA) and NIS2 directive—that impose statutory disclosure timelines.
Understanding Government Vulnerabilities Equities Processes (VEP)
An in-depth explanation unpacks how national governments evaluate zero-day vulnerabilities, balancing defensive patch coordination against intelligence and offensive retention equities.
Bridging the Divide Between Policymakers and Researchers
The presentation calls for standardized disclosure lexicons and practical CVD legal frameworks to protect ethical researchers while holding recalcitrant vendors accountable.
Related talks
Kaspersky·22 min
Security researchers examine technical aspects of TRUST ME, VULNERABILITY DISCLOSURE POLICY IS NOT THE PROBLEM.
Creator Stage·21 min
Matt Gaffney
Shares firsthand experiences navigating vulnerability disclosure programs in the aviation industry, highlighting common pitfalls and best practices.
Voting Village·15 min
Miracle Owolabi
Advocates for expanding legal safe harbor protections for election security researchers globally, drawing on lessons from research barriers in Nigeria.