Disclosure Policy of CERT/CC Hear it!

Disclosure Policy of CERT/CC Hacker Definition

As of October 2000, the CERT Coordination Center (CERT/CC) brought in a new policy regarding the disclosure to the public of vulnerability information. According to the CERT/CC, vulnerabilities reported to them will be revealed to the public 45 days after the initial report is made, regardless of the availability of patches. Extenuating circumstances, the new policy states—such as active exploitation, threats of a very serious nature, or situations requiring changes to an established standard—could result in an amended disclosure period.

Because the purpose of the new policy is to balance the public’s need to be informed with the vendor’s need to respond effectively and efficiently to worms and viruses, CERT/CC’s final decision on when to publish the information will be based on the best interests of the community. According to this policy, vulnerabilities reported to the CERT/CC are transmitted to the affected vendors as soon as possible after the initial report is received; confidentiality of the source is maintained.

See Also: Exploit; Vulnerabilities of Computers; Worm.

Carnegie Mellon University. CERT/CC Vulnerability Disclosure Policy. [Online, 2002.] Carnegie Mellon University CERT Website. http://www.cert.org/kb/vul_ disclosure.html.

Browse dictionary entries near Disclosure Policy of CERT/CC

  1. ‹ disclosure
  2. ‹ disclose
  3. ‹ disclimax
  4. ‹ disclamation
  5. ‹ disclaimer
  6. ‹ disclaim
  7. ‹ disciplined
  8. ‹ discipline
  9. ‹ disciplinary proceeding
  10. ‹ disciplinary
  1. disclosure statement ›
  2. disco ›
  3. disco- ›
  4. discography ›
  5. discoid ›
  6. discolor ›
  7. discoloration ›
  8. discolour ›
  9. discombobulate ›
  10. discomfit ›