Madison Oliver
Madison Oliver is a senior security manager at GitHub, overseeing the advisory database team responsible for publishing over 6,000 CVEs to date. Previously, as a vulnerability coordinator at the CERT Coordination Center at Carnegie Mellon University, Madison's team published more than 200 CVEs and assisted in the international coordination of many more. Madison has played a pivotal role in the global response to major named vulnerabilities, including Log4Shell, SolarWinds SUPERNOVA, Foreshadow, and KNOB. Her extensive experience in vulnerability transparency is further evidenced by her service on the CVE Program Board and participation in OpenSSF working groups.
Session
The CVE Program is a pillar of the cybersecurity ecosystem. For more than a quarter century, it has provided an authoritative source of data about vulnerabilities for software users. It is also critical for continuing to drive security into the design and development process. However, over the last 18 months, both the CVE Program and the US National Vulnerability Database have faced funding challenges. At the same time, developments in the European Union have led to the creation of the EU Vulnerability Database. Congress has taken note, and in June, members requested a formal audit of the program. What are the challenges facing the CVE Program? How should these be communicated to policymakers in a way that maintains the critical function and avoids a fractioning of the ecosystem? What are new governance models that should be considered?