Skip to content

The Politics of Vulnerabilities

Scott S. Blake

Scott S. Blake explores the politics of vulnerabilities at DEF CON 10, examining vulnerability-disclosure and practical defenses.

Summary

Architecture and Background

Blake - The Politics of Vulnerabilities The vulnerability reporting process is rife with competing interests. Research is conducted by software vendors themselves, paid consultants, government agencies, professional and academic researchers, as well as people who make their living in other ways. Each of these groups have particular interests in the process.

Vulnerability Analysis

The vendor of the targeted software has their concerns. The public at large has an interest in the process (and its results), but it is unclear what the public should be concerned with. This talk explores vulnerability reporting from all angles, including that of the public good.

Exploitation and Demonstrations

Atendees will learn a rudimentary cognitive framework for understanding the powers in play in vulnerability reporting and apply that to understand the present and the future of security. As BindView's Vice President of Information Security and an internationally recognized security expert, Mr. Blake is responsible for providing security expertise to BindView's corporate strategy and operations.

Remediation and Defensive Strategies

Before taking this role, he was the leader of BindView's RAZOR security research team. Prior to joining BindView, Mr. Blake designed perimeter security, network security architectures, and developed security policies for several large companies including leaders in financial services and telecommunications, as well as several large hospitals and universities. He has spoken at many security conferences, authored numerous articles on security topics and is frequently sought by the press for commentary. He holds a BA in Social Sciences (International Relations) from Simon's Rock College, an MA in Sociology (Political Theory) from Brandeis University, and is a Certified Information Systems Security Professional.

Related talks

Main Stage·37 min

  • DEF CON
  • Policy
  • Date: Aug 2013
  • Location: Las Vegas

James Denaro

James Denaro details how to Disclose or Sell an Exploit Without Getting in Trouble JAMES DENARO PARTNER, CIPHERLAW You have identified a vulnerability and may have developed an exploit.

vulnerability-disclosureethicslegal-defense+1

Main Stage·49 min

  • DEF CON
  • Policy
  • Date: Aug 2002
  • Location: Las Vegas

Michael I. Morgenstern · Richard Schaeffer · Marcus Sachs · O. Sami Saydjari · Steve Lipner · Tom Parker

Michael I. Morgenstern and Richard Schaeffer explores disclosure: the mother of all vulnerabilities at DEF CON 10, examining vulnerability-disclosure and practical defenses.

vulnerability-disclosureresponsible-disclosuresecurity-policy+1