The Birds, the Bees, and the CVEs

Iain Deason, a vulnerability analyst at CISA, began with how coordinated disclosure works for products that critical infrastructure relies on. The stages run from discovery and vendor validation to a patch or mitigation and a public advisory. Timelines range from about 30 days to two years, and control systems patch slowly because some sit underwater or in orbit.

Five case studies followed. A real-time operating system flaw spread through products from large vendors to small projects, and tracing the supply chain took over a year. A GPS tracker advisory drew press coverage that overstated the risk. A ventilator advisory with a low score still raised patient safety concerns, which pulled in medical expertise. A middleware standard flaw needed a consortium fix and mattered because it was used in dams and the International Space Station.

For practitioners, the takeaway was preparation. Publish a vulnerability disclosure policy, consider becoming a CVE Numbering Authority, and keep separate playbooks for pre-disclosure reports, zero-days and exploited bugs. Consequence-based analysis helps teams make risk decisions when the data is messy.