Step 0 for a Multi-party Vulnerability Coordination is Yet Another Multi-party Vulnerability Coor...
Channel: FIRST
Date: 2021-06-17

Full Title: Step 0 for a Multi-party Vulnerability Coordination is Yet Another Multi-party Vulnerability Coordination

Speaker: Umair Bukhari (Ericisson, FI)

In the current product development eco-system, a single product offering can consist of dozens of open source and commercial components. Some of these products might still be reused by other offerings even within the organization. As a result, vulnerabilities sometimes cascade through several layers in the portfolio. 

When such an event occurs, PSIRTs usually find them in the limelight for a multi-party vulnerability coordination. What’s usually visible is the:

multi-party coordination with vendors/partners that might need to fix the vulnerability in the underlying component
coordinated vulnerability disclosure towards the customers 
What’s interesting though is a full-scale multi-party vulnerability coordination that happens within the organization away from the eyes of external observers to orchestrate the above two visible aspects of yet another multi-party vulnerability coordination. 

In this talk, I’ll share the insider experiences, challenges, dos & don’ts from a real-life example of orchestrating a large-scale vulnerability coordination. This talk will also focus on providing insight into the multi-party coordination that happens within the organization to handle all the moving parts to achieve a smooth-looking coordination towards vendors, partners, and customers. 

About the Speaker
Umair Bukhari has been a part of Ericsson PSIRT since 2016. He has worked in several roles from vulnerability management to incident response during his time in Ericsson PSIRT, latest being the operation's manager for Ericsson PSIRT. He has had the chance to get the hands dirty, be the first responder to incidents and lead several vulnerability coordination along with establishing several product security initiatives. Lately he is focused on utilizing that first-hand experience in improving operations and maturing PSIRT's processes.