CVD
Coordinated vulnerability disclosure
The process in which the finder of a vulnerability, the affected vendors and any coordinators share information privately, prepare fixes and publish advisories on an agreed schedule, often within 90 days. ISO/IEC 29147 and ISO/IEC 30111 describe the vendor’s side.
- Also called
- coordinated disclosure
Covered in
Run coordinated vulnerability disclosure from report to advisory
Make private reporting discoverable, verify reports, coordinate a tested remedy, and give affected users enough information to act.
Set up a PSIRT: services, intake, triage, SLAs and the CNA role
How to structure and run a product security incident response team on the FIRST PSIRT Services Framework: organizational models, intake channels, triage, response targets, a case record and SLA script, becoming a CVE Numbering Authority under the CNA rules 4.2.0, and coordinating with other vendors.
Start with a VDP, then add bug bounties and penetration tests
Publish a vulnerability disclosure policy and security.txt first, add a bug bounty only when you can triage and fix at the pace rewards bring, and buy penetration tests with a written scope, rules of engagement and a retest.