CERTCC / CERT-Guide-to-CVD

Content for the CERT Guide to Coordinated Vulnerability Disclosure
https://certcc.github.io/CERT-Guide-to-CVD/
Other
7 stars 5 forks source link

Graduated & Scoped Disclosure #39

Open ahouseholder opened 4 months ago

ahouseholder commented 4 months ago

Describe the solution you'd like

While we touch on the idea of disclosure following the supply chain in a few places, we don't explicitly talk about disclosure patterns in multiparty cases. This is related to the horizontal/vertical supply chain discussion as well.

There are at least two relevant patterns, I think.

  1. Graduated Disclosure (aka Tiered Disclosure) is when the notification and coordination process follows a single, monotonically increasing scope (i.e., more parties are added to the "in group" as the case progresses). This is how the vertical supply chain can be addressed.
  2. Scoped Disclosure is when the notification and coordination process might be split into multiple, distinct groups that might be following a graduated disclosure model. This is relatively rare (partly because the complexity increase over graduated disclosure can be significant), but might come up in cases where more than one coordinator is the hub for their respective constituencies, or when a case spans multiple stakeholder groups that operate at significantly different tempos. It could also arise in situations where it's necessary for the coordination to flow from vendors to deployers, and sometimes those are distinct coordination efforts.
---
title: Graduated Disclosure Example
---
flowchart TD
subgraph coordination
subgraph group3
  subgraph group2
    subgraph group1
      vendor_a
      vendor_b
    end
    vendor_c
    vendor_d
  end
  vendor_e
end
coordinator
end
coordinator --- group1
coordinator --- group2
coordinator --- group3
---
title: Scoped Disclosure Example
---
flowchart LR
subgraph coordination
subgraph groupA3
  subgraph groupA2
    subgraph groupA1
       vendor_1
    end
     vendor_2
  end
  vendor_3
  vendor_4
end
subgraph groupB2
    subgraph groupB1
      deployer_a
      deployer_b
    end
    deployer_c
end
coordinator
end
coordinator --- groupB1
coordinator --- groupB2
coordinator --- groupA1
coordinator --- groupA2
coordinator --- groupA3