OIS Releases Vulnerability Reporting Plan
Organization for Internet Safety on Wednesday released a draft of a plan that asks security researchers to voluntarily keep a lid on the vulnerabilities they find and to follow a strict protocol for dealing with vendors.A group representing several security and software vendors on Wednesday finally released a draft of a plan that asks security researchers to voluntarily keep a lid on the vulnerabilities they find and to follow a strict protocol for dealing with vendors. The plan is the work of the Organization for Internet Safety and is available for public comment until July 4. The groups "Security Vulnerability Reporting and Response Process" has been in the works since last fall, but is based on an earlier document written by security experts at @stake Inc. and The Mitre Corp. The draft lays out a regimented timeline and set of steps for the interaction between the person who discovers a vulnerability and the vendor or vendors affected by the problem. It addresses a wide range of issues, including how and when to notify the vendor, how the vendor should respond, how long the researcher should wait for a response and how to resolve communications problems or disputes.
The goal of all of this structure is to prevent details of new vulnerabilities from being leaked publicly before vendors and customers have a chance to fix them. To that end, the draft specifically prohibits including "proof of concept code or test code that could readily be turned into an exploit, or detailed technical information such as exact data inputs, buffer offsets or shell code strategies."