From Coordinated Disclosure to Cooperative Vulnerability Research When Dealing with Critical Software Stacks

This course aims to explore the shift from coordinated disclosure to cooperative vulnerability research when dealing with critical software stacks. The learning outcomes include understanding the importance of early cooperation with vendors, debunking common misconceptions, and exploring the cultural and perspective divides between developers and security researchers. The course teaches skills such as identifying vulnerabilities, understanding vendor responses, and incentivizing vendors to participate in vulnerability research. The teaching method involves expert-led sessions, real-world examples like the Busybox vulnerability, and audience engagement through Q&A sessions. The intended audience includes security researchers, developers, vulnerability brokers, and individuals interested in improving the vulnerability disclosure process.