The CERT Guide to Coordinated Vulnerability Disclosure
Original Report
The CERT Guide to Coordinated Vulnerability Disclosure was originally published as CMU/SEI-2017-SR-022
This web version is an evolution of that original report.
This is the web edition of The CERT® Guide to Coordinated Vulnerability Disclosure. We started with the original report in its entirety and have been working to make it more accessible and easier to navigate. We're also in the process of revising the guide based on feedback we've received since its original publication.
Got a suggestion? Submit it here.
What is The CERT Guide to CVD about?
Security vulnerabilities remain a problem for vendors and deployers of software-based systems alike. Vendors play a key role by providing fixes for vulnerabilities, but they have no monopoly on the ability to discover vulnerabilities in their products and services. Knowledge of those vulnerabilities can increase adversarial advantage if deployers are left without recourse to remediate the risks they pose. Coordinated Vulnerability Disclosure (CVD) is the process of gathering information from vulnerability finders, coordinating the sharing of that information between relevant stakeholders, and disclosing the existence of software vulnerabilities and their mitigations to various stakeholders including the public. The CERT Coordination Center has been coordinating the disclosure of software vulnerabilities since its inception in 1988. This documentation is intended to serve as a guide to those who want to initiate, develop, or improve their own CVD capability. In it, the reader will find an overview of key principles underlying the CVD process, a survey of CVD stakeholders and their roles, and a description of CVD process phases, as well as advice concerning operational considerations and problems that may arise in the provision of CVD and related services.
CVD Quick Start
This is the Quick Start meta-guide for the CERT Guide to Coordinated Vulnerability Disclosure (CVD).
The CERT Guide to CVD in a Nutshell contains an overview of the entire document, and is a good place for all readers to become familiar with what's in the guide without necessarily poring over the details. Where you go from there depends on what you're trying to achieve.
-
Finders, Reporters, Vendors, and Coordinators
If you're a researcher, vendor, or coordinator trying to coordinate a disclosure and you need help, you might want to start with Troubleshooting Coordinated Vulnerability Disclosure to find the problem area(s) you're currently dealing with. From there you can follow the links into the document for more details.
-
Vendor PSIRTs
If you're a vendor trying to establish a vendor product security incident response team (PSIRT), you may be interested in Principles, Preparation, and Operation as starting points. Additionally, you can use Troubleshooting Coordinated Vulnerability Disclosure as a rubric of scenarios to consider when planning your operational processes. Disclosure Policy Resources contains links to a number of disclosure policy examples and templates.
-
Coordinators
If you're a coordinator spinning up your CVD capability, you should become familiar with the Principles, Roles, Coordination, and Operation sections. The Reference section may also be useful to you.
-
Policy-Makers
If you're a policy-maker (or influencer thereof), the sections HowTo Overview, Principles, Roles, and Phases are probably most useful to you to start, but there are many edge cases in Troubleshooting Coordinated Vulnerability Disclosure that are worth considering when you're thinking about writing policy that sets out how things are expected to be done. Disclosure Policy Resources contains links to a number of disclosure policy examples and templates.
Of course, we think it's best if you eventually become familiar with the entire site, but hopefully the hints above will help you find the most effective places to start.
Community Engagement
At the bottom of each page, you'll find a set of links to help you interact with the CERT Guide to CVD team. You can ask questions, report problems, request features, or join the conversation on the CERT Guide to CVD Community Discussions. We're always looking for feedback on how to make the site better, so don't hesitate to reach out.
-
Have a question or want to discuss something? Join the conversation on the CERT Guide to CVD Community Discussions.
-
Have a question about the content of the site? Ask it here.
-
Found a problem with the site? Report it here.
-
Have an idea for a feature you'd like to see on the site? Request it here.