Managing Coordinated Vulnerability Disclosure: The Art of Wrangling Cats

No ratings

Presented at GrrCON Cyber Security Summit and Hacker Conference 2023 by

Tina Zhang-Powell

Security researchers around the world are doing a great job reporting security vulnerabilities to affected vendors and companies to help protecting users world-wide. We all enjoy learning the technical details and stories behind the vulnerabilities. However, the process of Coordinated Vulnerability Disclosure (CVD) is not always straightforward as it seemed. When a coordinated vulnerability disclosure involves multiple vulnerability and/or vendors, there are a lot more goes into the disclosure process. The Microsoft Vulnerability Research (MSVR) program has been a part of many different CVDs and we are the middle-man that ensures the disclosure is done responsibly. This talk will present you with some insight into the “invisible” but important portion of the CVD process that we don’t often see or hear about that involves the case management team (“the cat wranglers”) that coordinates these disclosures.