This is an Open Source Project, Why do we Need a Vulnerability Management Process?
summary
Argues that Spinnaker adds a concrete vulnerability management process: a security@spinnaker.io front door, CVE intake, CVSS scoring with threat models, and tracking in a private issues repo leading to public disclosure after fixes. Uses standard tools — security scans and CVSS calculators — and relies on a security SIG and CISO guidance. One version bump can eliminate 20 CVEs. The documented taxonomy enforces remediation timelines, reduces emergency fixes, and measurably improves enterprise adoption and contributor engagement.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:23Why are we here
- 1:21Heartbleed
- 2:00What is a Vulnerability
- 3:29Common Vulnerability Scoring System
- 4:35Vulnerability Calculator
- 5:41Threat Models
- 7:19Patching
- 8:12Security Posture
- 10:44Growth
- 12:38Security
- 14:57Open Source Policy
- 15:21Front Door
- 17:02Vulnerability Assessment
- 19:20Tracking Vulnerability
- 21:39Mitigation
- 23:05Open Source Security
- 26:02How can we help
- 28:19Next steps
related talks
08mAutomated & Immutable Spinnaker Deployments with Security...
27mEffective Vulnerability Management for a DevSecOps Pipeline
59mWho’s Vulnerability Is It Anyway? Harmonizing Stakeholder Roles in Vulnerability Management
13mManaging Vulnerabilities in Open-Source Dependencies
48mImproving the Security of a Large Open Source Project One Step...
40mManaging Risk Across the Vulnerability Ecosystem
21mWhat's Community Got to Do with It? Navigating Open Source Contributions in the Financial Industry
33mVulnerability Management Lifecycle in DevSecOps