Coordinated Vulnerability Disclosure

Below is a round up of a series of blog posts I authored for the Software Engineering Institute blog describing the coordinated vulnerability disclosure (CVD) process and challenges in coordinating vulnerability responses with vendors.

SEI Blog Post: CVD Series: Principles of Coordinated Vulnerability Disclosure (Part 2 of 9) provides an overview of some important concepts for companies to consider when forming a coordinated vulnerability disclosure response and policy. (Part 1 only has a brief introduction and list of credits; Parts 3 through 9 do not appear to be published any longer.)

SEI Blog Post: Reach Out and Mail Someone shares some experience with reaching vendors about software vulnerabilities in their products; if a CVD process does not yet exist, email may not reach the right team to address the vulnerability, so I would work through the CERT/CC to send physical mail to vendors to notify them of security issues.

SEI Blog Post: How To Win Friends and Coordinate A Vulnerability is a short post announcing the creation of the “VulWiki” as an online repository for both independent security researchers and software vendors to learn more about CVD and how to professionally navigate various challenges in the process. I contributed a good amount of the initial content available on the VulWiki.

(Note: Updated 2024-07-09 to add correct links to the SEI blog.)