A group representing several security and software vendors on Wednesday finally released a draft of a plan that asks security researchers to voluntarily keep a lid on the vulnerabilities they find and to follow a strict protocol for dealing with vendors.
The plan is the work of the Organization for Internet Safety and is available for public comment until July 4. The groups “Security Vulnerability Reporting and Response Process” has been in the works since last fall, but is based on an earlier document written by security experts at @stake Inc. and The Mitre Corp.
The draft lays out a regimented timeline and set of steps for the interaction between the person who discovers a vulnerability and the vendor or vendors affected by the problem. It addresses a wide range of issues, including how and when to notify the vendor, how the vendor should respond, how long the researcher should wait for a response and how to resolve communications problems or disputes.
The goal of all of this structure is to prevent details of new vulnerabilities from being leaked publicly before vendors and customers have a chance to fix them. To that end, the draft specifically prohibits including “proof of concept code or test code that could readily be turned into an exploit, or detailed technical information such as exact data inputs, buffer offsets or shell code strategies.”
The draft did not receive a warm response on many of the popular security mailing lists. Several subscribers to the Full Disclosure list derided the plan as a way for software vendors to censor the work of security researchers and prevent word of new flaws from ever getting out.
The OIS was founded last year by Microsoft Corp., @stake, Guardent Inc., Symantec Corp., BindView Corp., Network Associates Inc., Oracle Corp., Internet Security Systems Inc., Foundstone Inc., The SCO Group and Silicon Graphics Inc.
OIS plans to release the final draft of the plan at the end of July at the Black Hat Briefings in Las Vegas.
Latest Security News: