CA/Vulnerability Disclosure - Revision history

Bwilson: /* How to Disclose a Reportable Vulnerability */ Rephrased instructions

2025-04-22T22:36:24Z

How to Disclose a Reportable Vulnerability: Rephrased instructions

← Older revision		Revision as of 22:36, 22 April 2025
Line 33:		Line 33:
	[[File:CA-Security-Bug.png\|300px]]		[[File:CA-Security-Bug.png\|300px]]

	Don't check the Security ~~box that says~~, ~~"Many users could be harmed by this security problem: ...." That checkbox is~~ for a different security review ~~process~~.		Don't check the other Security boxes, as they are for different security review processes.

	All CA security disclosures will be treated with strict confidentiality. The information provided will remain private and secure throughout the investigation and resolution process. Once the incident is resolved, a new, separate, and public bug report should be created by the CA operator. Such public report shall contain only sanitized information that has been reviewed and approved by the CA operator to ensure that no confidential details are disclosed. But make sure that you report security incidents to other root stores as well. Note that Mozilla may share information with other root store representatives and add them to the cc: list with access to review and comment on such disclosures made in Bugzilla. (People cc:'ed in the bug have access to view the bug, so review the cc: list to ensure that no unintended people are in that list.)		All CA security disclosures will be treated with strict confidentiality. The information provided will remain private and secure throughout the investigation and resolution process. Once the incident is resolved, a new, separate, and public bug report should be created by the CA operator. Such public report shall contain only sanitized information that has been reviewed and approved by the CA operator to ensure that no confidential details are disclosed. But make sure that you report security incidents to other root stores as well. Note that Mozilla may share information with other root store representatives and add them to the cc: list with access to review and comment on such disclosures made in Bugzilla. (People cc:'ed in the bug have access to view the bug, so review the cc: list to ensure that no unintended people are in that list.)

Bwilson: /* How to Disclose a Reportable Vulnerability */ Added paragraph re: confidentiality

2024-06-11T20:59:21Z

How to Disclose a Reportable Vulnerability: Added paragraph re: confidentiality

← Older revision		Revision as of 20:59, 11 June 2024
Line 33:		Line 33:
	[[File:CA-Security-Bug.png\|300px]]		[[File:CA-Security-Bug.png\|300px]]

	~~Ensure~~ that you report security incidents to other root stores as well. Mozilla may share information with other root store representatives and add them to the cc: list with access to review and comment on such disclosures made in Bugzilla. (People cc:'ed in the bug have access to view the bug, so review the cc: list to ensure that no unintended people are in that list.)		Don't check the Security box that says, "Many users could be harmed by this security problem: ...." That checkbox is for a different security review process.

			All CA security disclosures will be treated with strict confidentiality. The information provided will remain private and secure throughout the investigation and resolution process. Once the incident is resolved, a new, separate, and public bug report should be created by the CA operator. Such public report shall contain only sanitized information that has been reviewed and approved by the CA operator to ensure that no confidential details are disclosed. But make sure that you report security incidents to other root stores as well. Note that Mozilla may share information with other root store representatives and add them to the cc: list with access to review and comment on such disclosures made in Bugzilla. (People cc:'ed in the bug have access to view the bug, so review the cc: list to ensure that no unintended people are in that list.)

	=== Types of Vulnerabilities/Incidents to be disclosed ===		=== Types of Vulnerabilities/Incidents to be disclosed ===

Bwilson: /* Markdown Template */ Clarified contact information

2024-01-04T21:01:00Z

Markdown Template: Clarified contact information

← Older revision		Revision as of 21:01, 4 January 2024
Line 182:		Line 182:

	### Contact Information		### Contact Information

			Email Address
	</pre>		</pre>

Bwilson: /* Contact Information */ Clarified

2024-01-04T20:59:25Z

Contact Information: Clarified

← Older revision		Revision as of 20:59, 4 January 2024
Line 122:		Line 122:

	==== Contact Information ====		==== Contact Information ====
	Provide contact information for the responsible individuals within the CA’s organization who can address any further inquiries or provide additional information related to the vulnerability/incident.		Provide contact information (e.g. email address or group distribution list) for the responsible individuals within the CA’s organization who can address any further inquiries or provide additional information related to the vulnerability/incident.

	== Markdown Template ==		== Markdown Template ==

Bwilson: /* Response and Mitigation */ Minor edit

2023-11-22T19:27:50Z

Response and Mitigation: Minor edit

← Older revision		Revision as of 19:27, 22 November 2023
Line 112:		Line 112:
	# Summarize the immediate actions taken to contain and mitigate the effects of the vulnerability/incident, including isolation of affected systems, removal of unauthorized access, application of patches, updates, or configuration changes, and restoration of services.		# Summarize the immediate actions taken to contain and mitigate the effects of the vulnerability/incident, including isolation of affected systems, removal of unauthorized access, application of patches, updates, or configuration changes, and restoration of services.
	# Highlight any collaboration or assistance received from external parties, such as incident response teams, forensics, or law enforcement.		# Highlight any collaboration or assistance received from external parties, such as incident response teams, forensics, or law enforcement.
	# Detail any mitigation steps ~~and other~~ action items being taken to mitigate the effects of the vulnerabilities/incident, including the type of action (e.g. patching, access control, training, etc.), the status of each action, and the date each action will be completed.		# Detail any other mitigation steps or "action items" being taken to mitigate the effects of the vulnerabilities/incident, including the type of action (e.g. patching, access control, training, etc.), the status of each action, and the date each action will be completed.

	==== CA Remediation Measures ====		==== CA Remediation Measures ====

Bwilson: /* Response and Mitigation */ Minor edit

2023-11-22T19:26:13Z

Response and Mitigation: Minor edit

← Older revision		Revision as of 19:26, 22 November 2023
Line 112:		Line 112:
	# Summarize the immediate actions taken to contain and mitigate the effects of the vulnerability/incident, including isolation of affected systems, removal of unauthorized access, application of patches, updates, or configuration changes, and restoration of services.		# Summarize the immediate actions taken to contain and mitigate the effects of the vulnerability/incident, including isolation of affected systems, removal of unauthorized access, application of patches, updates, or configuration changes, and restoration of services.
	# Highlight any collaboration or assistance received from external parties, such as incident response teams, forensics, or law enforcement.		# Highlight any collaboration or assistance received from external parties, such as incident response teams, forensics, or law enforcement.
	# Detail any other action items being taken to mitigate the effects of the vulnerabilities/incident, including the type of action (e.g. patching, access control, training, etc.), the status of each action, and the date each action will be completed.		# Detail any mitigation steps and other action items being taken to mitigate the effects of the vulnerabilities/incident, including the type of action (e.g. patching, access control, training, etc.), the status of each action, and the date each action will be completed.

	==== CA Remediation Measures ====		==== CA Remediation Measures ====

Bwilson: /* Types of Vulnerabilities/Incidents to be disclosed */ Added explanation about serious vulnerabilities

2023-11-22T19:21:31Z

Types of Vulnerabilities/Incidents to be disclosed: Added explanation about serious vulnerabilities

← Older revision		Revision as of 19:21, 22 November 2023
Line 39:		Line 39:
	Vulnerabilities/incidents that may “significantly impact the confidentiality, integrity, or availability” of a CA's internal systems, regardless of direct impact on certificate issuance, must be reported if they pose ongoing risk to the overall integrity and security of CA operations. This includes significant impact not just to issuing systems, but also to network and server security, internal software, and the availability and reliability of certificate status services, such as CRLs and OCSP. The determination of “significance” is made by the CA Operator based on industry best practices and the guidance below, particularly that guidance found under the heading “'''[[CA/Vulnerability_Disclosure#Determining_Significance\|Determining Significance]]'''”.		Vulnerabilities/incidents that may “significantly impact the confidentiality, integrity, or availability” of a CA's internal systems, regardless of direct impact on certificate issuance, must be reported if they pose ongoing risk to the overall integrity and security of CA operations. This includes significant impact not just to issuing systems, but also to network and server security, internal software, and the availability and reliability of certificate status services, such as CRLs and OCSP. The determination of “significance” is made by the CA Operator based on industry best practices and the guidance below, particularly that guidance found under the heading “'''[[CA/Vulnerability_Disclosure#Determining_Significance\|Determining Significance]]'''”.

	'''Security Incidents include the following:~~'''~~		'''Serious vulnerabilities''' include critical software and web application vulnerabilities, faulty APIs that could lead to data breaches, zero-day exploits, and malware infections.

			'''Security Incidents''' include the following:

	* Successful unauthorized accesses, acquisitions, disclosures, or thefts of sensitive data or CA equipment involving the CA's systems, infrastructure, networks, applications, or sensitive information (private keys, user credentials, or personally identifiable information).		* Successful unauthorized accesses, acquisitions, disclosures, or thefts of sensitive data or CA equipment involving the CA's systems, infrastructure, networks, applications, or sensitive information (private keys, user credentials, or personally identifiable information).
	* ~~Malware infections, ransomware~~, or other data integrity issues that irrecoverably damage or compromise sensitive CA data.		* Ransomware attacks, or other data integrity issues that irrecoverably damage or compromise sensitive CA data.
	* Confirmed advanced persistent threats that attempt to compromise the CA's infrastructure, systems, or the reliability or validity of certificates.		* Confirmed advanced persistent threats that attempt to compromise the CA's infrastructure, systems, or the reliability or validity of certificates.

Bwilson: /* Markdown Template */ Minor edits

2023-11-22T19:10:47Z

Markdown Template: Minor edits

← Older revision		Revision as of 19:10, 22 November 2023
Line 167:		Line 167:


	### ~~Longer-Term~~ Remediation ~~Measures~~		### Remediation Plan

	#### Outline/Summary of Remediation Plan		#### Outline/Summary of Remediation Plan

Bwilson: /* Vulnerability/Incident Details */ Minor edits

2023-11-22T19:09:29Z

Vulnerability/Incident Details: Minor edits

← Older revision		Revision as of 19:09, 22 November 2023
Line 95:		Line 95:
	==== Vulnerability/Incident Details ====		==== Vulnerability/Incident Details ====
	# Timeline - A date-and-time-stamped sequence of all relevant events, including events before the vulnerability/incident became known, such as when something changed or was introduced, the initial compromise, lateral movement (if applicable), and actions taken by the CA during and after the discovery of the vulnerability/incident.		# Timeline - A date-and-time-stamped sequence of all relevant events, including events before the vulnerability/incident became known, such as when something changed or was introduced, the initial compromise, lateral movement (if applicable), and actions taken by the CA during and after the discovery of the vulnerability/incident.
	# Type and Detailed Description, including the ~~duration of the vulnerability/incident, identity of threat actors,~~ nature of the compromise, ~~and~~ the specific systems, infrastructure, or processes affected.		# Type and Detailed Description, including the nature of the compromise, the specific systems, infrastructure, or processes affected, the duration of the vulnerability/incident, and the identity of any threat actors.
	# Root Cause(s) - Identify the root cause(s) or contributing factors that led to the vulnerability/incident and how they were not previously discovered. Note that the description of root cause(s) does not need to be duplicated here if it can be fully provided in the [https://www.ccadb.org/cas/incident-report public-facing Incident Report].		# Root Cause(s) - Identify the root cause(s) or contributing factors that led to the vulnerability/incident and how they were not previously discovered. Note that the description of root cause(s) does not need to be duplicated here if it can be fully provided in the [https://www.ccadb.org/cas/incident-report public-facing Incident Report].

	==== Severity/Impact Assessment ====		==== Severity/Impact Assessment ====

Bwilson: /* Markdown Template */ Minor edits

2023-11-22T19:05:21Z

Markdown Template: Minor edits

← Older revision		Revision as of 19:05, 22 November 2023
Line 124:		Line 124:
	== Markdown Template ==		== Markdown Template ==
	<pre>		<pre>
	## ~~Vulnerabilty~~/Incident Disclosure Form		## Vulnerability/Incident Disclosure Form

	### Concise Summary		### Concise Summary
Line 136:		Line 136:
	-		-
	#### Type and Detailed Description		#### Type and Detailed Description
	~~Duration~~		Nature of the compromise:
	~~Identity of threat actors~~		Specific systems, infrastructure, or processes affected:
	Nature of the compromise		Duration:
	Specific systems, infrastructure, or processes affected		Identity of threat actors:


	#### Root Cause(s)		#### Root Cause(s)