SESSION

Some manufacturers have a mistakenly knowledge about product security, they think that 3rd party testing is the only thing need to do for product security. In fact, product security cannot be fulfilled by a single activity that neither penetration testing, nor static code analysis. The real cybersecurity challenge comes after the product released. Faced with security vulnerabilities, manufacturers should establish product security incident response procedure to handle vulnerabilities from external source. This article will introduce how to build a product security incident response proecdure and explain the relevant details. In addition to incident response procedure, we will also introduce how to manage open source libraries through the software bill of materials (SBOM), combined with product security incident response procedures, to rapidly handle new vulnerabilities to open source libraries.