Other Uses of the Vultron Case State Model
This section collects applications of the Vultron Case State (CS) model beyond coordinating a single case. Each page takes the model's six events and 32 states as given and puts them to a different use: describing who can cause which event, formalizing a policy, defining a contested term, or recommending an action. The pages are research material and are not normative. They build on the notation of the Measuring CVD Foundations, which is the place to start if the state shorthand is new to you.
Pages in this section
The first two pages ask who acts on the model and how a policy can be written against it. The remaining four apply the model to a vocabulary problem, to situation awareness, to a government process, and to the actions a case calls for.
- Defining Zero Days — Formal definitions of zero day and forever day in terms of case states.
- Policy Formalization — Expressing a disclosure policy as timers between state transitions.
- VEP — Mapping the definitions in the United States Vulnerability Equities Process onto state subsets.
- CVD Action Rules — Actions a role can take from each subset of states, and the transition each action causes.
- Stakeholder Roles — Which events each role can cause, and how vendors, system owners, coordinators, and governments each rank the ordering preferences.
- Situation Awareness — Inferring the likely state of a case from incomplete information.
Where the section connects
CVD Roles and Their Influence is the stakeholder reflection that the Measuring CVD section promises, and the two sections share the same partial order over case histories. The actor-discovery problem that an earlier page in this section discussed is now carried as an open question in Future Work, beside the federation design it belongs to.
Reading path: You study how vulnerability disclosure works and want the models behind it
This page is part of Work with the models.
| Start | Previous | Current | Next |
|---|---|---|---|
|