2020-037-Katie Moussouris, Implementing VCMM, diversity in job descriptions - Part 2

<p>Introduce Katie (bio) (@k8em0) CEO and Owner, LutaSecurity</p> <p>The scope of the VCMM (what is it?)</p> <p>VCMM - Vulnerability Coordination Maturity Model </p> <p><a href= "https://www.lutasecurity.com/vcmm">https://www.lutasecurity.com/vcmm</a></p> <p>Just covers the internal process? To ready an org for a bug bounty program or to accept vulns from security researchers?</p> <p>You mentioned not playing whack-a-mole, when it comes to responding at the beginning of a vuln disclosure program. Is the directing of different categories of bugs one of the things that goes into not having to just wait for the bugs to roll in?</p> <p><br /> Will this work for internal security or red teams as well, or is this more suited to bug bounties?</p> <p>What’s the timeline for this process? “We need something for a product launch next week…”</p> <p>Stakeholders involved? CISO? Security team? IT? Devs?</p> <p>What precipitates the need for this? Maturity? Vuln Disclosure? </p> <p>Are the ISO docs required for this to work, or will they assist in an easier outcome?</p> <p> https://blog.rapid7.com/2017/12/19/nist-cyber-framework-revised-to-include-coordinated-vuln-disclosure-processes/</p> <p><a href= "https://www.rsaconference.com/industry-topics/video/bug-bounty-programs-arent-enough-for-todays-cyber-threats-katie-moussouris-rsac"> https://www.rsaconference.com/industry-topics/video/bug-bounty-programs-arent-enough-for-todays-cyber-threats-katie-moussouris-rsac</a> </p> <p>10 worst jobs (popsci article): <a href= "https://web.archive.org/web/20070712070214/https://www.popsci.com/popsci/science/0203101256a23110vgnvcm1000004eecbccdrcrd.html">https://web.archive.org/web/20070712070214/https://www.popsci.com/popsci/science/0203101256a23110vgnvcm1000004eecbccdrcrd.html</a></p> <p><a href= "https://www.nbcnews.com/tech/security/how-teenage-fortnite-player-found-apple-s-facetime-bug-why-n963961"> https://www.nbcnews.com/tech/security/how-teenage-fortnite-player-found-apple-s-facetime-bug-why-n963961</a></p> <p>How does an org use t