Anatomy of a Vulnerability Response - A View from the Inside

on YouTube ↗52m

" summary

A large-organization case study traces a generic watchdog timer function firmware flaw that forces updates across 500 models, showing one-to-one hardware fixes that take weeks–months versus one-to-many cloud/driver fixes in minutes–days. The process uses PSIRT intake, embedded vulnerability-response security champions, dedicated program management for triage→remediation→release, coordinated disclosure with bug‑bounty channels, and SBOM/HBOM for inventory. Results: SDL extended into firmware/hardware, disclosure cadence optimized, and a 10× industry rise in bug‑bounty adoption that eases researcher partnerships.

AI-written summary · about

" chapters (30)

1. 0:00Vulnerability response intro
2. 1:05Objectives and industry view
3. 2:30Vulnerability lifecycle
4. 3:12Why Dell's view matters
5. 4:37Org size impact
6. 5:40Tech stack complexity
7. 7:07Vulnerability types
8. 10:19VR process overview
9. 11:24Watchdog timer example
10. 13:54Researcher's role
11. 15:20Initial triage delays
12. 16:23Product team triage
13. 18:57End-of-life policies
14. 20:22Researcher communication
15. 22:29Remediation complexities
16. 24:14Program management
17. 27:06Disclosure phase
18. 29:24Zero-day response
19. 30:28Transformational impact
20. 32:15Researcher engagement
21. 34:46Long-term relationships
22. 37:37Researcher community influence
23. 39:03Key takeaways
24. 41:11Lessons for researchers
25. 42:14Future threats and AI
26. 43:18Q&A
27. 43:41Researcher engagement strategies
28. 47:10SBOM and HBOM role
29. 48:56Audit of VR processes
30. 50:38Disclosure timelines

" related talks

• 33mUnderstanding the Impact of Critical Vulnerabilities in Critical Infrastructure: A De...Iain Deason · Critical Software Summit @ Open Source Summit Europe 2022
• 18mWhat You Need to Know and Do about Vulnerability DisclosureAnne Bertucio · OpenSSF Day 2022
• 11mVulnerability Supply ChainsArt Manion · SupplyChainSecurityCon North America 2021
• 49mWhen Hardware Gets Pwned Mechanics Of Detection, Response And RecoveryAaron Guzman, James DeLuccia, Marcus Richerson · Hardwear.io USA 2026
• 10mHandling Security IssuesMarkus Holtermann · LeadDev Berlin 2019
• 37mThe Firmware Supply-Chain Security Is Broken: Can We Fix It?Kai Michaelis, Richard Hughes, Alex Matrosov, Alex Ermolov · Black Hat Asia 2022
• 48mHow to report a vulnerability: Responsible Disclosure for DevelopersBrian Demers · JCON Europe 2023
• 23mConflicts in Vulnerability Management and PatchingAntonio Nappa · droidcon Berlin 2024