ETSI has released its Guide to Coordinated Vulnerability Disclosure. The Technical Report ETSI TR 103 838 will help companies and organisations of all sizes to implement a vulnerability disclosure process and fix vulnerability issues before they’re publicly disclosed.
As of early 2022, according to ETSI, only about 20% of ICT and IoT companies have a publicly identifiable dedicated means to notify a company of a potentially serious security issue with their products or services. Many companies provide a website “contact us” page or have a presence on social media through which a security issue could be reported.
However, in most cases without a formal separate CVD process, many companies lack the internal process to handle such reports in a timely manner especially where third party elements are included in their products.
Alex Leadbeater ETSI TC Cyber Chair noted that “While some large companies offer excellent paid vulnerability identification CVD schemes, a significant majority of companies ICT and IoT companies still do not have any form of CVD scheme in place. This is especially true of smaller companies and for companies with products that are not subject to formal regulatory related cyber security or safety testing. Such schemes are equally important for both physical product manufacturers and service or App providers”.
As mandated in ETSI EN 303 645 Cyber Security for Consumer Internet of Things: Baseline Requirements, a CVD scheme is a key requirement in ensuring on-going strong cyber security after a product has been placed on the market. Ranked after not using default passwords, an inability to handle cyber security vulnerabilities in life has been a significant contributory factor in many recent IoT product security failures.
The ETSI Report contains advice on how to respond to and manage a vulnerability disclosure, a defined triage process, advice on managing vulnerabilities in third party products or suppliers. It also includes an example of a vulnerability disclosure policy. This is especially important for SMEs or larger companies who do not already have experience of CVD schemes or dealing with security vulnerabilities that are reported by security researchers.
Security plays a crucial role in the development and lifecycle of systems, products and services. At any time in the lifecycle, a vulnerability can be found that weakens the security if left unaddressed. If a vulnerability is found in development, this can be addressed before the product is released. Often, however, vulnerabilities are found after a system, product or service has been deployed. In this case, it can be difficult for the finder to know how or where to report the vulnerability.
Having a clearly sign-posted disclosure process demonstrates that an organisation takes security seriously. By contrast, if an organisation does not provide a vulnerability disclosure route, finders who discover vulnerabilities may resort to public disclosure of the information, or vulnerabilities and subsequent exploits may go undetected until an otherwise avoidable serious widescale security event occurs. This public release can result in reputational damage and can lead to a compromise.
As demonstrated by the recent Log4j security bug, early identification and resolution of security vulnerabilities through a CVD scheme should be a key part of every company’s cyber security strategy.
