This course aims to educate participants on how the government is facilitating discussions between researchers and vendors regarding vulnerability disclosure. The learning outcomes include understanding the importance of collaboration, building trust, and reducing friction in the disclosure process. Participants will learn about the different perspectives of researchers and vendors, the challenges they face, and the need for predictability in the evolving market. The course teaches skills such as building a set of principles for disclosure and fostering transparency. The teaching method involves presenting historical context, real-life examples, and discussing potential solutions. This course is intended for researchers, vendors, policymakers, and anyone interested in cybersecurity and vulnerability management.
Don't Hate the Disclosure, Hate the Vulnerability - How the Government is Bringing Researchers and Vendors Together to Talk Vulnerability Disclosure
Overview
Syllabus
Intro
Alan Friedman
History
Katie Masseur
More public attention
Dip in the water
The middlemen
The two sides
The researcher side
The heroes
The academics
The knowledge
Slytherin
Everyone is special
Vendors just want money
They want the same thing
Vendors want security
Vendors have different capabilities
Different firms have different abilities
Different firms have different markets
What are the outcomes
Theres no silver bullet
There is no onesizefitsall model
People are looking for different things
Building a set of principles
Magna Carta of Vulnerability Disclosure
How are we going to do that
Finding common ground
Getting things done
Building trust
Building predictability
Reducing friction
Markets evolve
Predictability
Challenges
The US Government
Peer Pressure
Final Bullets
How can you help
Hard question
Mikey Dickerson
A provocative idea
Public pressure moves companies
Software liability
Civil society
Transparency
German Researcher
Companies have gotten worse
Disclosures are getting worse
We have gotten worse in this experience
This conversation has to be with both groups
Taught by
BSidesLV
