search

CERTCC / CERT-Guide-to-CVD

Content for the CERT Guide to Coordinated Vulnerability Disclosure
https://certcc.github.io/CERT-Guide-to-CVD/
Other
8 stars 4 forks source link

Supply chain concerns. #11

Open sei-vsarvepalli opened 11 months ago

sei-vsarvepalli commented 11 months ago

Is your feature request related to a problem? Please describe. No

Describe the solution you'd like We should highlight some of the supply-chain CVD processes and concerned areas.

Describe alternatives you've considered There may be just a potential link to Supply-Chain Disclosure if there is such a generic thing. In this context, Disclosure could be not just Vulnerability but any other incident that supply-chain stakeholders should communicate with each other for reliable usage of products/services.

Additional context Recent cybersecurity incidents and US National Cybersecurity Strategy have highlighted supply-chain concerns. We need to consider and perhaps expand more of the Vertical and Horizontal supply-chain concerns. The current supply chain concerns are mentioned in

We could spend a bit more information on how CVD process should inherently observe and adopt supply-chain for OEM's and their relationships to OCM (Original Component Manufacturer) and multi-level OCM providers. Concerns such as OCM being an open source project - how does supply-chain CVD work ripple impact disclosure from OEM to OCM or the other way.

ahouseholder commented 2 months ago

What would you add to https://certcc.github.io/CERT-Guide-to-CVD/howto/coordination/mpcvd/#complicated-supply-chains to make it better?

(If it gets big enough we can split it into a separate page, I just don't know what we'd want to add/change based on what we already have.)

sei-vsarvepalli commented 2 months ago

I would really like to enumerate some of these practical multiparty concern in a little more detail if possible . Perhaps with input from Coordinators?

  1. Embargo date (related publication/release) management in MPCVD
  2. Variance (not statistical but plain English) of impact
  3. Variance of fixes and their deployments
  4. The need for an alliance/agreement among the Vendors where one may not have existed (e.g., opensource and commercial or commercial to commercial)
  5. Potential inter-vendor conversations not known to other Vendors and the Coordinator himself.
  6. Expectation mismatch between the Finder and multiple Vendors

Some of these may not have any solutions but will help the Coordinator set expectations and help adhere to some communications and outreach technique that reduce the risk of MPCVD going awry.

I think as software grows the reuse of software is also likely to grow. The MPCVD is an unavoidable "wicked problem" indeed with parties that are loosely connected and benevolence is the only card to play.