No More Secrets in Cybersecurity: Implementing ‘Radical Transparency’
summary
Industry data shows CVEs exploited in under five days, down from about eight days a year earlier, driving the Secure by Design pledge and calls to disclose every vulnerability every time. CISA finds 40,000+ CVEs lack CWE enrichment so buyers cannot compare security outcomes; CTA keeps intelligence tagged to the submitting vendor (no anonymous sources). Recommended actions: adopt NIST SSDF and software attestation, shift accountability to vendors, and run a vulnerabilities equities process that defaults to disclosure and periodic review.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 3:56CISA’s cybersecurity efforts
- 4:37Radical transparency matters
- 8:09CISA’s vision for transparency
- 12:52How transparency disrupts threats
- 14:40Responsible transparency in practice
- 22:12Risks of non-disclosure
- 25:20Rebuilding trust with vendors
- 32:47Vendor standards customers demand
- 36:18Government’s role in transparency
- 41:12Call to action
- 43:22Q&A
related talks
58mPanel Discussion - The Risks of Requiring Premature Vulnerability Disclosures
27mHow to implement Security as Code?
39mSecurity Advisory Programs: Creating Transparency Along the Software Supply Chain
01h 08mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
29mThe Quality Imperative for CVEs: The Need For Enhancing Vulnerability Reporting Standards
31mThe Product Security Imperative: Lessons from CISA
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data