Vulnerability management and exploitability from code to cloud: we have a fantastic panel on the 20th of October with views across the world and industry, EPSS creator Jay Jacobs, Chris Madden from yahoo with one of the implementation of ssvc, Marius Poskus raising cybersecurity CISO star and John Kinsella-Mike Shema deep appsec connoisseurs and hosts of the application security podcast

Panel: What is modern vulnerability and why a data-driven approach appsec vs infrastructure/cloud

What is more exploitable, what is exploitation in the wild, what data-driven approach is more effective and risk-based vs decision

The panel will focus on exploits at scale, and how to reduce vulnerability management burnout.

Some references

Writeup on exploitability data: https://phoenix.security/exploitability-data-visualization/ 

Writeup on CISA KEV: https://phoenix.security/cisa-kev-visualization/  

Audience for Vulnerability and data visualization for exploitability

• application security
• Vulnerability management
• head of application security
• product security
• security engineers 
• CISO
• GRC 

Key Takeaways

• Learn how to prioritize vulnerabilities effectively.
• Understand metrics for an application security program and cloud security.
• Create a compelling narrative around security with product security.
• Involve management and business in the pulse of application security.
• Grasp the concept of product vulnerabilities and exploitability.
• Learn how to insert business criticality into security discussions.
• Understand the challenges of EPSS in non-CVE-based vulnerabilities.
• Identify valid threat feeds and how to automate CTI.

Francesco Cipollone (Moderator)

Francesco is a seasoned entrepreneur, CEO of the Contextual-based vulnerability management platform from code to cloud Phoenix Security, author of several books, host of multi-award Cyber Security & Cloud Podcast, speaker and known in the cybersecurity industry and recognized for his visionary views. He currently serves as Chapter Chair UK&I of the Cloud Security Alliance. Previously, Francesco headed HSBC’s application and cloud security and was Senior Security Consultant at AWS. Francesco has been keynoting at global conferences and has authored and co-authored several books. Outside of work, you can find me running marathons, snowboarding on the Italian slopes, and enjoying single malt whiskeys in one of my favourite London clubs.

Linkedin: https://www.linkedin.com/in/fracipo/

Twitter: https://twitter.com/FrankSEC42

Jay Jacobs

Jay is a Co-founder and Chief Data Scientist at Cyentia Institute, a research firm committed to the advancement of information security through data-driven research. He also serves as the lead data scientist for the Exploit Prediction Scoring System (EPSS) and is the co-chair of the EPSS special interest group at FIRST. Additionally, Jay is a co-founder of the Society for Information Risk Analysts (SIRA), where he has served on the board of directors for several years.

Linkedin: https://www.linkedin.com/in/jayjacobs1/

Chris Madden

Chris has worked as a software engineer and system architect, building secure trustworthy software at scale for embedded and cloud for more than 20 years.

He likes to understand things deeply – and uses data analysis and dumb questions to build that understanding.

Chris recently published Yahoo’s strategy for adopting SSVC on Github and you can find his BSides Dublin talk covering the implementation and research on youtube.
Prioritized Risk Remediation:https://github.com/theparanoids/PrioritizedRiskRemediation

Linkedin: https://www.linkedin.com/in/chrisamadden 

Marius Poskus

As the Vice President / Head of Cyber Security at Glow Financial Services Limited, Marius leads a high-performing team that delivers innovative and effective cybersecurity solutions. With over 10 years of experience, his expertise spans various domains such as cloud security, DevSecOps, AppSec, and more.

Linkedin: https://www.linkedin.com/in/marius-poskus-92611b22/

Appsec Side

John Kinsella

A high-impact, security-focused engineering leader with a wealth of experience ranging from creating products from scratch to overseeing international high-scale engineering and operations teams. John wrote his first computer program in 1982 and has been professionally involved in technology since 1995. His career has spanned roles in the State of California, the US Government, international organizations, and various US corporations.

Linkedin: https://www.linkedin.com/in/jlkinsel/

Mike Shema

Mike Shema specializes in collaborating with both product security and DevOps teams to enhance application safety. Not just a techie, Mike spices up the world of information security with a blend of 80s music, dystopian sci-fi, and spooky horror references. He is also the host of the Application Security Weekly podcast.

Linkedin: https://www.linkedin.com/in/zombie/