PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

To Attest or Not to Attest: Questions from the Trump Cyber Executive Order

hackerone.com | blog | #cisa | #vdp | #policy | #executive-order | #software-supply-chain | #us-government | #nist-ssdf
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trump's cyber EO rolls back federal validation of software attestations, but vendors must still self-attest to NIST SSDF and run a vulnerability disclosure program (VDP).
Published
Collected

Related coverage

blog · hackerone.com
Report Smarter, Not Harder: HackerOne's Case for Better CIRCIA Rules
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · bugcrowd.com
CISA’s VDP platform: Five years of collaborative defense
CISA’s VDP Platform marks five years with nearly 45,000 submissions and 5,300+ vulnerabilities fixed across 60+ federal agencies. See the key findings.
blog · wiz.io
The President’s Executive Actions on AI Have a Lot to Say on Cybersecurity
Analysis of two presidential actions - the AI Innovation and Security Executive Order and NSPM-11 - pushing agencies to context-based remediation, including CISA's BOD 26-04 patching directive.
blog · wiz.io
Biden's AI Executive Order: What it says, and what it means for security teams
A security-engineer breakdown of Biden's 2023 AI Executive Order: NIST safety and red-team testing standards, DHS critical-infrastructure oversight, and what it means for security and privacy teams.
vulnerability · yeswehack.com
US House passes bill mandating vulnerability disclosure policies for federal contractors
The US House passed a bill mandating VDPs for federal contractors, consistent with NIST guidelines; the roundup also covers the UK Home Office's own vulnerability disclosure policy launch.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
Back