Security Proposal Nearly Ready for Inspection

A group of software and security vendors that is at work on a standard for disclosing security vulnerabilities hopes to have a completed document ready for public inspection within a month.

The group, known as the Organization for Internet Safety, has been working on the proposal for several months and submitted a preliminary version of it to the Internet Engineering Task Force in February. The proposals authors eventually withdrew the paper from IETF consideration after the standards body decided it wasnt the appropriate place for the document.

Its unclear where the final proposal will land, but if the OIS cant find a suitable forum, it may create one.

The OIS also recently has spent quite a bit of time and effort trying to get its various member companies to approve a set of bylaws, said Scott Blake, vice president of information security at BindView Corp., a Houston-based security vendor and one of the founding members of the OIS. There has been some disagreement about the way the group will handle its members intellectual property, but most of those issues have been resolved.

In addition to the vulnerability-disclosure proposal, the OIS also plans to develop a set of guidelines that would spell out exactly how much information its members should include in their security advisories. For example, the document would address whether exploit code should be included and whether researchers should publish bulletins announcing flaws for which no patch is available.

“Everyone has an opinion on that topic, so its something that needs to be addressed,” Blake said.

In addition to BindView, the other OIS founders are Microsoft Corp., Guardent Inc., @stake Inc., Foundstone Inc. and Internet Security Systems Inc. There are several other members, but their names have not been disclosed.

The group formed as the result of discussions held at Microsofts Trusted Computing conference last November, during which much of the talk centered on the need for a standard way of disclosing vulnerabilities.