Ideas whose time has come CVD SBOM and SOTA -

In this address at the DEF CON 27 TransportHax Village, Art Manion from the CERT Coordination Center (CERT/CC) discusses the critical evolution of Coordinated Vulnerability Disclosure (CVD), Software Bills of Materials (SBOM), and Software Origin Transparency and Authenticity (SOTA) across critical infrastructure sectors. Drawing on his extensive experience managing thousands of vulnerability disclosures at 05:00, he tracks the transformation of vendor attitudes from hostile denial toward collaborative remediation.

Art explains the multi-party coordination challenges handled by CERT/CC at 10:00, showing how vulnerabilities impacting shared libraries or hardware components ripple across interconnected supply chains. At 15:00, he examines pioneering regulatory guidance from the FDA for medical device manufacturers, illustrating how establishing post-market vulnerability handling policies creates a proven template for automotive, aerospace, and transportation safety.

Diving into supply chain visibility at 20:00, Art highlights the monumental challenge of uniquely identifying software packages across the internet, discussing Package URLs (purl) and Common Platform Enumerations (CPE). He examines SOTA frameworks at 25:00, emphasizing that securing transport systems requires knowing not just what code is running, but where it originated and whether its integrity was cryptographically preserved. He concludes at 29:00 with a roadmap for institutionalizing transparency across critical infrastructure. (AI summary — Gemini Flash)