CVE/FIRST VulnCon 2024 & Annual CNA Summit
2024-03-25..2024-03-27
-- online --
[CVE/FIRST VulnCon 2024 & Annual CNA Summit, CVE/FIRST VulnCon 2025, CVE/FIRST VulnCon 2026 & Annual CNA Summit]
who it's for
CVE Program managers, national CERT staff, product security teams, vulnerability coordinators, open source maintainers, software supply chain engineers, security policy makers
topics
SBOM generation and ingestion; VEX and CSAF advisory formats; CVE CNA operational rules; automated CVE to OSV conversion; vulnerability coordination processes; EPSS and exploit telemetry; CVSS v4.0 scoring changes; supply chain vulnerability mitigation; firmware supply chain security; advisory database architectures; vulnerability disclosure policy design
| title | author | length |
|---|---|---|
| Welcome Remarks | Peter Allor | 11m |
Inaugural VulnCon 2024 announces a push to coordinate the fragmented vulnerability ecosystem through a formal CVE Program and FIRST agreement, stressing… | ||
| Supply Chain Security: The Office of the National Cyber Director Perspective | Andrew Pasternak | 48m |
The Office of the National Cyber Director pushes two concrete moves: a February report Back to the Building Blocks calling for adoption of memory-safe… | ||
| A Legislation Guide for Keeping pace with Cybersecurity Paradigm Shift toward Vulnerability | Tae Seung Lee | 28m |
Compares US, EU and OECD cyber laws and guidance (OM memo 20-32, CISA playbook, NIS2, Cyber Resilience Act) and identifies seven requirements for vulnerability… | ||
| The Trials and Tribulations of Bulk Converting CVEs to OSV | Andrew Pollock | 53m |
Describes an automated pipeline that pulls NVD CVE data, maps CPE vendor:product pairs to git repos, fuzzily matches version numbers to git tags and commits… | ||
| Crossing the Streams - How Downstream Can Understand Upstream Vulns | Christopher R Robinson, Madison Oliver | 59m |
Downstream gets concrete: upstream projects should publish a security policy and contact, use CVE or GitHub Advisory/OSV IDs, and offer private intake and… | ||
| A Roadmap for Your OSS Security Lifecyle Journey to Protect Customers | Lisa Bradley, Sarah Evans | 51m |
Dell teams build an executive Product Security Operations Committee and an Open Source Assurance Program, integrate inventories into a single aggregator… | ||
| Seeing the Vulnerable Forest Through the Exploited Trees | Jay Jacobs | 57m |
Dataset combines sensors from Foret Shadowserver AlienVault GreyNoise F5 Cisco and Cyentia and records 13,266 CVEs across ~2,830 days as ~8.1 million rows of… | ||
| SBOMs – The Missing Link | Cassie Crossley | 57m |
Schneider Electric collects and catalogs thousands of SBOMs (about 4,000 SBOMs covering roughly 400–500 product SKUs), enforces a policy that a release must… | ||
| Understanding Red Hat's SBOM - The Future of Software Transparency | Przemysław Roguski | 54m |
Red Hat publishes an official Red Hat Build SBOM strategy: GA releases get static SBOMs, RHEL streams produce SBOMs at GA while OpenShift emits per z‑stream… | ||
| CVE Is The Worst Vulnerability Framework (Except For All The Others) | Ben Edwards, Sander Vinberg | 56m |
Analysis of 25 years of CVE/CWE/CVSS data finds structural shifts, not steady truth: seven breakpoints in weekly CVE publication, a model projecting a median… | ||
| Revising the CVE CNA Operational Rules: AMA | Art Manion | 58m |
A year-long rewrite nearly finishes: the CNA Operational Rules are almost entirely new, not just edited. The rules codify a first refusal for the supplier CNA… | ||
| Why Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards | Yotam Perkal | 58m |
Vulnerability volume rises ~20% year‑over‑year and NVD entries doubled in 3–4 years, leaving 16.3% of flaws open >1 year and many “vintage” CVEs still… | ||
| CVSS SIG Past, Present & Future + CVSS v4.0 Beyond the Numbers | Nick Leali | 01h 16m |
CVSS v4.0 ships (published 2023-11-01) with concrete changes: new supplemental metrics, reworked subsequent system impact fields, attack requirements and… | ||
| Panel Discussion: This One Time at CVD Camp | Art Manion, Deana O'Meara, Madison Oliver, Christopher R Robinson | 57m |
Open source projects becoming CNAs (GitHub/Red Hat cited) drives a real influx of IDs and the panel names 20–25% yearly CVE growth as baseline, urging… | ||
| Firmware Supply Chain Security BoF | Jerry Bryant | 56m |
Discussion documents concrete failures: UEFI and BMC firmware carry exploitable code (examples BlackLotus and Ring Hopper) that can persist past OS reimages… | ||
| Panel Discussion: Enabling Accurate, Decentralized Root Cause Mapping at Scale | Alec Summers, Chris Levendis, Deana O'Meara, Erin Alexander | 53m |
Working group pilots a federated model (RCM WG) that pairs CVE records with one or more CWE entries via the new CVE JSON data format; published guidance and a… | ||
| Day 1: Wrap Up & Lessons Learned | Peter Allor, Josh Dembling | 19m |
Day one surfaces concrete wins and pain points: the event squeezes 38 sessions from ~60 submissions into tight scheduling, the conference app works well and… | ||
| Daily Updates & Announcements | Peter Allor | 06m |
A vendor-area women in cyber security table is available for networking and ally support; organizers encourage mid-level staff to join a new Next Generation… | ||
| Building a Better Database: How GitHub Structures Their Advisory Database to Drive Developer ... | Jon Moroney | 24m |
GitHub structures an advisory database indexed by package ecosystem (not CPE) so scanners can match artifacts deterministically, power Dependabot to open and… | ||
| Vulnerability Coordination in the EU | Johannes Kaspar Clos | 58m |
ENISA implements an EU vulnerability database that pulls and normalizes advisories from 27 member states and ~40 national CSIRTs (about 600 members), uses CSAF… | ||
| Nestlé Unified Vulnerability Management Approach | Angelo Punuriero, Jenifer Jimenez, Martin Karel | 57m |
Nestlé builds a Brinka‑based platform that ingests vendor advisories, scanner feeds, pen tests and asset inventories, auto‑bundles fixes to each team’s… | ||
| Finding, Managing, Preventing Vulnerabilities: An Automotive Perspective | Andreas Weichslgartner, Joyabrata Ghosh, Vineeth Bharadwaj | 57m |
Claims that memory safety dominates automotive CVEs (about half of analyzed CVEs) and that ~75% of exploited bugs are memory-corruption lead to concrete… | ||
| China's New Vuln System | Dakota Cary | 41m |
China creates what functions as a hot leads desk for offensive teams via a new mandatory NVDB run by MIIT with five front portals, feeding MSS 13th Bureau and… | ||
| The CWE Program: Current State and Road Ahead | Alec Summers | 57m |
CWE adopts a federation model since 2019, adds Hardware coverage and a REST API, and runs a GitHub-based CWE Content Development Repository now in pilot with a… | ||
| Panel Discussion: Don’t be Vexed by VEX - VEXperts Panel | Adolfo García Veytia, Art Manion, Christopher R Robinson, Justin Murphy | 01h 00m |
Panel summarizes where VEX is actually used, what tools exist, and what still breaks: lightweight openVEX JSON‑LD statements and CAF/CSAF profiles are… | ||
| Adventures in Vulnerability Coordination | Daniel Larson, Iain Deason | 01h 00m |
CISA describes step‑by‑step coordination: use of the open‑source vents platform to manage 2–400 concurrent cases, reliance on SMEs and legal counsel, and an… | ||
| Effective Vulnerability Management for Over 400 Projects at the Eclipse Foundation | Marta Rybczynska, Michael Winser | 30m |
The Eclipse Foundation consolidates vulnerability intake across over 400 projects and 1,800 named committers by creating a centralized security team, a… | ||
| Day 2: Wrap Up & Lessons Learned | Peter Allor, Josh Dembling | 22m |
Conference wrap up lists concrete wins and fixes: EPSS visualizations deliver large datasets and surprising insights, all sessions are posted immediately for… | ||
| Democratizing Exploitability Data with OpenVEX | Adolfo García Veytia | 50m |
OpenVEX claims to let maintainers publish artifact-level exploitability statements so scanners stop flagging false positives; it ships a JSON‑LD spec plus… | ||
| CSAF/VEX: Improved Security Data | Martin Prpič | 45m |
Red Hat publishes advisories and VEX files where advisories point to fixed artifacts and VEX (grouped by CVE) asserts whether each product/component is… | ||
| What It Takes to Lead America’s Vulnerability Management Team | Bob Lord, Chris Hughes, Lindsey Cerkovnik, Patrick Garrity, Sandy Radesky | 01h 05m |
CISA outlines concrete changes: it stood up a Security‑by‑Design team and a Cyber Resilience team, runs a Rapid Action Force that tests mitigations, publishes… | ||
| CNA Challenges From a National CERT Perspective | Mohd. Akram Khan, Seema Khanum | 24m |
CERT-In became CNA in Oct 2021 and operationalizes a Responsible Vulnerability Disclosure policy to assign CVE IDs for India-developed products, but CVE scope… | ||
| From SBOM to VEX - Discovering What's in the Box and How Badly it Can Hurt You | Ben Hirschberg | 56m |
Compares full SBOM scans to an eBPF-based runtime filtering that records files touched by a running container, then intersects that with the SBOM to produce an… | ||
| CISA’s Known Exploited Vulnerabilities (KEV) Catalog | Tod Beardsley, Elizabeth Cardona | 58m |
KEV is a curated list that requires CVE ID, requires reliable evidence of exploitation (execution of malicious code without owner consent), and requires clear… | ||
| Information Sharing to Mitigate Emerging Vulnerabilities | Joshua Justice, Tyler Curry | 52m |
Health‑ISAC reports delivering 1,000+ emerging vulnerability exposure alerts in 2023, using targeted Shodan scans to inventory medical imaging systems and… | ||
| Reducing Ratio of Reserved But Public CVEs | Shelby Cunningham | 43m |
GitHub moves from under 5,000 advisories to over 177,000 advisories, and building automation around the CVE Services API makes the concrete claim that… | ||
| Black and Blue, or White and Gold? Minimizing Vulnerability Scoring... | Michael Schueler | 35m |
Comparison of 80 Cisco CVEs disclosed May–Nov 2023 to NVD rescoring shows most discrepancies come from sparse CVE text, limited product context, a tooling bug… | ||
| Panel Discussion - The Risks of Requiring Premature Vulnerability Disclosures | Kathleen Noble, Tanvi Chopra, Rob Spiger, Michael Woolslayer | 58m |
Governments increasingly mandate reporting unmitigated flaws to agencies (seen in the EU CRA, China’s rule, France’s law and FISMA proposals), requiring… | ||
| Elevating Security Standards: Intel's Integration of Common Security Advisory Framework into ... | Julia DeWeese, Mike Wiles | 48m |
Intel maps its existing advisories to CSAF, builds a phased MVP, and moves toward generating CSAF first to auto-render human HTML; tooling already… | ||
| CNA Feedback Session to the CVE Program | Mz Megazone | 53m |
Room discussion focuses on operational details: CVE Services is in community testing with a 30‑day window and planned deployment in late April; the new record… | ||
| Panel Discussion: It is a Tale as Old as Time…. a CNA, the NVD, and a CVE Consumer Walk Into a ... | Christopher R Robinson, Andrew Pollock, Madison Oliver, Tanya Brewer | 51m |
Panelists describe concrete actions and numbers: GitHub runs a curated Advisory DB (live since 2019) with humans reviewing every advisory and a public feedback… | ||
| EPSS: Challenges and Opportunities Going Forward + EPSS AMA | Jay Jacobs, Sasha Romanosky | 01h 23m |
A live standard for estimating the probability a CVE is exploited in the next 30 days is now public and four years old, with scores produced for ~230,000 CVEs… | ||
| Pushing Coordinated Vulnerability Disclosure forward in Asia Pacific | Tomo Ito | 24m |
A new Asia-Pacific CVD working group within APCERT brings six operational members (JPCERT/CC, KR, TW, IN, MY, AU) and holds its first meeting in January to… | ||
| Conference Closing Remarks | Peter Allor, Josh Dembling | 19m |
Conference organizers commit to publish themes and outcomes after a brief retrospective, promise recorded sessions and slides within one to four weeks, and… | ||
| nothing matches | ||