Vulnerability Management Using CVD
Coordinated Vulnerability Disclosure: Support for Processes
Virtually every piece of software and every IT system has vulnerabilities and security flaws that eventually come to light. However, many companies are still unable to handle reports of such vulnerabilities. Examples such as the log4j vulnerabilities or Heartbleed—which affected millions of systems—have highlighted the general importance of promptly reporting a vulnerability to the vendor and developing effective corrective measures.
Security vulnerabilities can exist in all of a company’s IT systems. For example, automakers are responsible for the control systems in the vehicles they sell. Systems from suppliers and external IT service providers may also be affected. Similarly, the automaker is also responsible for security vulnerabilities in components that it merely purchases and over whose development it has only limited insight.
Establishing appropriate processes for constructively addressing vulnerabilities offers manufacturers several advantages: Effective vulnerability management ensures legal compliance, thereby supporting compliance efforts, increasing trust, and protecting the company’s reputation.
Fraunhofer SIT supports companies in
- develop processes for the internal handling of vulnerabilities (ISO/IEC 30111)
- to develop processes for reporting vulnerabilities by external parties (Coordinated Vulnerability Disclosure) (ISO/IEC 29147)
- Establish a Product Security Incident Response Team (PSIRT)
- Develop processes for Product Security Incident Response Teams
- Understand the legal framework to ensure compliance with the law
- Conduct a risk assessment for individual potential vulnerabilities
Vulnerabilities are often discovered by external parties
Traditional approaches assume that vulnerabilities can be discovered either by the company’s own employees or by external partners contracted by the company. Experience shows, however, that critical vulnerabilities are often found by third parties who have no contractual relationship with the company in question and are not integrated into its internal processes.
These may include security researchers, ethical hackers, or even chance discoveries. Companies need a clear procedure for handling IT security vulnerabilities that are reported to them. For example, it has become standard practice for researchers to disclose discovered security vulnerabilities after 90 days. Within this timeframe, the manufacturer can take necessary measures. This also serves to protect the company’s own customers and reputation.
When handling such reports, a distinction is made between a CERT (Computer Emergency Response Team) for the company’s own systems and a Product Security Incident Response Team (PSIRT).
The Responsibilities of CERT and PSIRT:
- receiving vulnerability reports
- validating and prioritizing all reports
- Coordinating the response
- if necessary, coordinating with the development department to create necessary patches
- Communicating with the reporter
- Providing technical and organizational (immediate, interim, and final) measures to the affected stakeholders (customers, partners, suppliers, etc.).
Likewise, CERT and PSIRT must project an image that makes it easy for reporters to share their findings with the appropriate parties. Last but not least, transparency in how a company handles security incidents also contributes to its corporate image.
From a regulatory perspective as well, the issue of coordinated vulnerability disclosure is becoming increasingly important. One of the objectives of the new NIS 2 Directive (Directive (EU) 2022/2555 of December 14, 2022, on measures for a high common level of cybersecurity in the Union) is to make the voluntary framework for coordinated vulnerability disclosure between reporters and manufacturers more attractive. To this end, entities that develop or manage ICT systems are required to establish appropriate procedures for handling discovered vulnerabilities and to implement procedures for receiving information about vulnerabilities from third parties.
