It is vital to the commercial interests of providers of Internet of Things (IoT) products and solutions and to the security of their customers, that vulnerabilities are discovered and remediated as soon as possible. Third party security researchers are a valuable adjunct to a provider’s internal resources in addressing this goal. To ensure effective co-operation and maintain good relations with external security researchers, it is important for providers to define and communicate vulnerability disclosure processes that not only describe how they would like vulnerabilities to be reported confidentially to them, but also set expectations as to how they will process and act upon such reports. This process should include provision of feedback to the discovering researcher, and the public announcement of
the security vulnerability, usually after the release of a software patch, hardware fix, or other remediation.
The ETSI 303 645 standard [4], which lays down baseline security requirements for the consumer IoT, includes requirement 5.2, to “Implement a means to manage reports of vulnerabilities”. This states that “The manufacturer shall make a vulnerability disclosure policy publicly available.”, adding that “A vulnerability disclosure policy clearly specifies the process through which security researchers and others are able to report issues.”
This document provides manufacturers, integrators, distributors, and retailers of IoT products and services with a set of guidelines for handling the disclosure of security vulnerabilities, based on best practice and international standards