Bruce Monroe is the Lead Engineer for Intel Product Security Incident Response Team (Intel PSIRT) as part of the Intel Product Security and Assurance organization. The PSIRT team is responsible for leading Intel’s product security response efforts for potential vulnerabilities in our shipping products and services. Bruce started with Intel in September 1996 and has held numerous roles throughout Intel including working in IT Operations and Product Security. Bruce was a founding member of Intel Security Operations Center following 9/11 and was the first full time hire for Intel’s PSIRT team in 2007.
Bruce was a twelve year USN military veteran before joining Intel. He worked on Mainframe computers, RADAR, Weapons Designation Systems, and Missile Systems. Bruce’s areas of expertise include incident response, project management, operating systems, computer hardware, computer forensics, and network monitoring. Bruce is very interested in all areas of security research and how that research relates Intel’s infrastructure and products.
He is currently Intel’s technical representative to the Internet Consortium for the Advancement of Security of the Internet, and to the Forum of Incident Response Team’s Vendor Special Interest Group. Bruce helped to draft the Common Vulnerability Scoring System Version 3 that is an industry standard for vulnerability scoring. He’s very active in industry incident response circles and has a broad network of security minded professionals both internally and externally. He’s helped develop a number of industry standards on computer forensics, vulnerability, and incident response.
Bruce’s hobbies include golf, tennis, ping pong, computer gaming, music, target shooting, cooking, and all forms of BBQ. He’s very happily married with three grown children and is fortunate to have two of them living locally in Oregon.
In this talk I plan to cover how large industry vendors handle vulnerability information as part of Multiparty Coordinated Vulnerability Disclosure. This will include how partners are informed, when they are informed, and industry best known methods for determining whether, how and why to bring particular partners “into the tent” early in the process The intent of this talk is to document some industry best known methods that could then be leveraged as part of continued evolution of Multiparty Coordinated Vulnerability Disclosure.
