VB2014 preview: keynote and closing panel

Posted by   Virus Bulletin on   Sep 16, 2014

Vulnerability disclosure one of the hottest issues in security.

In the proceedings of the 24th Virus Bulletin conference, the words 'vulnerabilty' and 'vulnerabilities' occur more than 200 times. I think there is no better way to demonstrate how important a topic this is.

Some approach vulnerabilities from a purely defensive point of view: how do we make sure our software detects exploits of vulnerabilities? Or even at a meta level: how do we test such software?

Others are worried about vulnerabilities in the software they develop, while yet another group of people spend their time trying to find such vulnerabilities. To bring these latter two groups together, bug bounties have become an increasingly common way to reward responsible disclosure.

Few know more about bug bounties than Katie Moussouris (@k8em0). While working for Microsoft, she was instrumental in introducing the company's bug bounty programme. In her current role, as Chief Policy Officer at HackerOne, she helps other companies deal with vulnerability response and set up bug bounty programmes, most recently Twitter.

In her keynote 'Choose your own keynote adventure - bounties and standards and vuln disclosure, oh my!', Katie will discuss various elements of vulnerability response. The keynote will be very interactive and she will answer questions both from the VB2014 audience and from Twitter.

Some vulnerabilities, however, are so serious and affect so many that the question of how to reward their discoverers becomes almost irrelevant. The most important thing here is to make sure that those affected have patched before those interested in exploiting the vulnerability learn about it.

How we can make sure this happens smoothly will be the topic of the closing panel 'Vulnerability sharing in the age of Heartbleed'. Chaired by Chester Wisniewski (Sophos), the discussion will be the next in a series of gripping closing panels that will show new attendees why people at VB always stay until the very end.

  The VB2013 closing panel.

VB2014 takes place next week in Seattle. It is proving to be the most popular VB conference ever, but you can still register.

Posted on 16 September 2014 by Martijn Grooten

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Firefox 59 to make it a lot harder to use data URIs in phishing attacks

Firefox developer Mozilla has announced that, as of version 59 of the browser, many kinds of data URIs, which provide a way to create "domainless web content", will not be rendered in the browser, thus making this trick - used in various phishing…

Standalone product test: FireEye Endpoint

Virus Bulletin ran a standalone test on FireEye's Endpoint Security solution.

VB2017 video: Consequences of bad security in health care

Jelena Milosevic, a nurse with a passion for IT security, is uniquely placed to witness poor security practices in the health care sector, and to fully understand the consequences. Today, we publish the recording of a presentation given by Jelena at…

Vulnerabilities play only a tiny role in the security risks that come with mobile phones

Both bad news (all devices were pwnd) and good news (pwning is increasingly difficult) came from the most recent mobile Pwn2Own competition. But the practical security risks that come with using mobile phones have little to do with vulnerabilities.

VB2017 paper: The (testing) world turned upside down

At VB2017 in Madrid, industry veteran and ESET Senior Research Fellow David Harley presented a paper on the state of security software testing. Today we publish David's paper in both HTML and PDF format.