FIRST updates Guidelines and Practices for Multi-Party Vulnerability Coordination and Disclosure

mood · May 18, 2020

FIRST updates guidelines for multi-party vulnerability disclosure
Best practice playbook expanded to include clear comms, safe harbor clauses, and disclosure embargoes
May 18, 2020
https://portswigger.net/daily-swig/first-updates-guidelines-for-multi-party-vulnerability-disclosure

The Forum of Incident Response and Security Teams (FIRST) has released updated guidelines to assist and simplify multi-party coordinated vulnerability disclosure.
FIRST is an international confederation of incident response teams that tasks itself with promoting security best practices and maintaining the widely-used CVSS scoring system.

Previous vulnerability disclosure guidelines released by the non-profit have been mainly focused on relationships between two parties: the stakeholder (vendor or organization) and the bug finder.
However, as software development becomes more complex and connected to supply chains, coordinated vulnerability disclosure practices need to evolve, explained Art Manion, vulnerability analysis technical manager at CERT Coordination Center.
Click to expand...

Multi-party vulnerability disclosure
A new set of guidelines has been produced by FIRST, in collaboration with the National Telecommunications and Information Administration (NTIA).

The document is aimed at anyone involved in multi-party vulnerability disclosures – from security researchers to incident response teams.
The updated advice (version 1.1) was unveiled earlier this month to address shortcomings in how multiple parties should engage and cooperate during the security vulnerability disclosure process.
Click to expand...

Best practices
The document includes strong suggestions on how to implement best practices, policy, and processes for coordinated vulnerability disclosure.
It differs from ISO standards that are usually written for one group – vendors –focusing on bilateral disclosure.

Instead, it provides “practical guidance” for all possible stakeholders within the supply chain.
Click to expand...

Log in or Sign up

FIRST updates Guidelines and Practices for Multi-Party Vulnerability Coordination and Disclosure

mood Updates Team

Log in or Sign up

FIRST updates Guidelines and Practices for Multi-Party Vulnerability Coordination and Disclosure

mood Updates Team

Useful Searches