Multi-Party Coordination and Disclosure

Multi-Party Coordination

Decades of vulnerability disclosure activity have highlighted the continued need for study and improvements in the area of vulnerability coordination. Historically, foundational work on best practices, policy, and process for vulnerability disclosure has focused on bi-lateral coordination between one researcher and one vendor. These practices do not adequately scale to address the complexities associated with the widespread use of open source and other third-party software, the proliferation of bug bounty programs, and complicated supply chains.

In March 2016, the U.S. National Telecommunications and Information Association, NTIA, convened a multi-stakeholder process to investigate cybersecurity vulnerabilities. One of the efforts within this process focused on multi-party coordination. In June 2016, the NTIA multi-party effort joined the similar effort underway within the FIRST Vulnerability Coordination SIG. This combined effort has produced a document that derives multi-party disclosure guidelines and practices from common coordination scenarios and variations.