From NIST to FIRST: How GitHub’s Product Security Response Organization Transitioned
summary
GitHub documents a concrete migration from NIST to the FIRST Services Framework and a split of IR into a corporate CERT and a product PSIRT, using SIM3 as the maturity benchmark and taking about a year of work to reach FIRST membership. Intake uses ZenDesk, email and HackerOne + GitHub Issues + automation; a dedicated bounty team (5‑year investment) handles triage, retest and reward decisions. Results: tighter bug‑bounty integration, smoother audits, but high noise from LLM‑generated reports.
AI-written summary · about
chapters (13)
- 0:00GitHub’s security journey
- 1:52Program goals and PERS
- 3:39NIST 800-61 for incident response
- 6:23NIST aligned with FIRST PERT
- 7:45Splitting into CERT and PERT
- 8:27FIRST CESERT membership with SIM3
- 11:19Maturing security with FIRST
- 12:42Bug bounty vulnerability discovery
- 16:14Triage and stakeholder coordination
- 19:04Remediation and engineering
- 20:34Disclosure strategies
- 22:39Framework alignment benefits
- 23:51Q&A on AI in bug bounties
related talks
45mRunning an efficient bug bounty program and PSIRT... (Garrett McNamara, Jeff Guerra)
36mUsing data-driven metrics to anticipate and prevent security incidents
26mLife of a Bug (an insight on the GitHub bounty...
39mA Guide to Securing GitHub Based on Lessons Learned- 39mA Guide to Securing GitHub Based on Lessons Learned
51mHow Sworn Enemies Found a Truce (Sort of) to Achieve NIST Compliance
27mBuilding a Secure Open Source Project on GitHub
19mFlipping the script on application security