A group of software and security vendors that is developing a standard for disclosing security vulnerabilities said it hopes to have a completed document ready for public inspection within a month.
The Organization for Internet Safety, or OIS, which has been working on the standard for several months, submitted a preliminary version of the proposal to the Internet Engineering Task Force in February, but the proposals authors withdrew it from IETF consideration after the standards body decided it wasnt the appropriate place for the document.
Its unclear where the completed proposal will land, but if the OIS cant find a suitable forum, it might create one.
The OIS recently tried to get its member companies to approve a set of bylaws, said Scott Blake, vice president of information security at BindView Corp., a Houston-based security vendor and an OIS founding member. There has been disagreement about the way the group will handle its members intellectual property, but most of those issues have been resolved.
In addition to the vulnerability-disclosure proposal, the OIS plans to develop guidelines that would spell out how much information its members should include in security advisories. For example, the guidelines would address whether exploit code should be included and whether researchers should publish bulletins announcing flaws for which no patch is available.
“Everyone has an opinion on that topic, so its something that needs to be addressed,” Blake said.
In addition to BindView, the other OIS founders are Microsoft Corp., Guardent Inc., @Stake Inc., Foundstone Inc. and Internet Security Systems Inc. There are several other members, but their names have not been disclosed.
The group formed as the result of discussions held at Microsofts Trusted Computing conference in November, during which much of the talk centered on the need for a standard way of disclosing vulnerabilities.