Ready...Set...Secure all the COVID vaccines!

The talk describes the security work behind Operation Warp Speed, the effort to develop and deliver COVID-19 vaccines quickly. A small team of mostly government security staff was asked to protect the development, manufacturing and distribution chain across hundreds of organizations. The scope was large, the data flows were tangled, and most engagement with companies was voluntary, so the team had to persuade rather than mandate.

The team built a short, prioritized maturity questionnaire, mapped public assets and shadow IT, and demonstrated real exploitability for some findings to get leaders to act. They tracked remote access zero-days and the SolarWinds compromise, leaned on the volunteer CTI League, and ran crowdsourced bug bounties against vaccine-related applications before launch. They also flagged operational technology in manufacturing and cold storage, advising organizations not to converge OT with IT before they are ready.

The team counts the project as a success: no major compromise, and trial data integrity held, partly because many independent copies of the data existed. Key takeaways for practitioners include engaging the crowd, knowing which government contacts to call, keeping a rapid response plan that works with limited people, and raising the baseline for small suppliers.