Hitchhikers' Guide to the Vulniverse
summary
A rapid tour of the actual artifacts and rules used to manage vulnerabilities: identifiers (CVE issued by CNAs), root causes (CWE, ~200 entries), and severity via CVSS 4.0 17 dimensions plus the human-readable CVSS vector string; machine-readable inventory via SBOM 3 formats 6 types 7 required elements; coordination practices like embargoes (open source ~7–14 days), TLP red/amber/green/clear, CRD, and advisories (CSA/GSA). Newer exchanges include VEX: not affected affected fixed under investigation; operational signals include NVD, EPSS, SSVC and KEV for known exploited flaws.
AI-written summary · about
chapters (11)
- 0:00Introduction to vulnerability management
- 1:45Vulnerability reporting process
- 3:51Issue analysis and identifiers
- 6:44Severity scoring with CVSS
- 9:10Software Bill of Materials (SBOM)
- 10:12Coordinated vulnerability disclosure
- 12:59Traffic Light Protocol (TLP)
- 14:25Security advisories and VEX
- 16:55Public disclosure and risk assessment
- 21:31Support life cycles and CRA
- 22:15Summary and closing remarks
related talks
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
36mAll you wanted to know about sw vulnerabilities…but were too busy to look into
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
45mVulntology - A Methodology to Characterize Vulnerabilities While Providing A Granular & Intuitive...
37mPrioritizing Vulnerability Response with a Stakeholder Specific Vulnerability Categorization
39mCVE 101: The Unfolding Of A Zero Day Attack
11mVulnerability Supply Chains