Workflows During DEF CON:

• Security researchers must review the Hippocratic Oath for Hackers and agree to the framework of boundaries and rules of engagement during and post conference engagement, signing it prior to entering the Device Lab

• Researchers who perform testing should expect to follow the manufacturers’ published coordinated vulnerability disclosure policy and report any potential issues found.

• Researchers will have discourse at MDM tables and can ping into the devices and perform tests

• Researchers report to the MDMs in real time and via private discussion channels to discuss findings and vulnerability disclosures are made

People to bring: 

• Product Team: speak to the use cases of the device in various ways

• Product Security: speak to the cybersecurity of the device or guide if a vulnerability is found

• Marketing: great opp to show the interaction between business development and the hacker community

• Clinicians: explain what the device does in a medical way

Coordinated Vulnerability Disclosures:

With the quickly evolving regulations, harmonization of legislation, and timelines ahead of us, the Biohacking Village will serve as a great proving ground for device security. 

As announced last year, the Biohacking Village is a CNA and will be able to assist with any vulnerability findings and disclosures that may need to be reported during the conference. We will be available to discuss the process and internal procedures to get that done in a timely manner.