Open Source Summit + ELC Europe 2018

Great, you've put out your first release for your FLOSS project, but now someone has noticed there may be a problem. Bugs happen, and some of them may even be security vulnerabilities. How do you work with your project members to form a team for handling security concerns and deal with embargoes? This talk will go through some of the best practices as articulated in the CII badging program, that help a team prepare to handle security issues. As well it will overview the steps to become a CVE numbering authority (CNA), able to issue CVE's for your open source project. Zephyr project will be used as a case study to illustrate how these best practices have been applied.