Presentation is loading. Please wait.

Presentation is loading. Please wait.

ISO 29147 How to leverage Dick Hacking Cornerstones of Trust 2014.

Similar presentations

Presentation on theme: "ISO 29147 How to leverage Dick Hacking Cornerstones of Trust 2014."— Presentation transcript:

1 ISO 29147 How to leverage Dick Hacking Cornerstones of Trust 2014

2 Dick Hacking Set up the response program at NetApp Worked on Security issues in products for the last 30 years at CapGemini, Unisys and Zilog Also familiar with SEC 17a4-compliant data retention products Job seeker, currently

3 I've looked at clouds from both sides now From up and down, and still somehow It's cloud illusions I recall I really don't know clouds at all

4 Agenda What are ISO 29147 and ISO 30111? In-depth How can we use these new standards Benefits to Practitioners Benefits to Vendors

5 What are they? These standards together form a standardized vendor framework for a response and disclosure process to address Suspected Security Vulnerabilities in products

6 ISO 29147 Addresses how vendors should be responding to and disclosing suspected security vulnerabilities in their product Covers the two ends of the cycle – Specifies how to act on received reports – Specifies what kinds of information to consider including in a disclosure notice – Suggests how to distribute information about the report (internally and externally)

7 ISO 30111 This standard covers the Engineering tasks needed to mitigate any problem(s) validated in a suspected vulnerability report – Triage – Investigation – Resolution Usually internal to the vendor

8 Goals of Vulnerability Disclosure Ensuring that identified vulnerabilities are addressed Minimizing the risk from vulnerabilities Providing users with sufficient information to evaluate risks from vulnerabilities to their systems Setting expectations to promote positive communication and coordination among involved parties

9 ISO 29147 In Depth Addresses both real and perceived vulnerabilities Prescribes a special handling mechanism Uses both perceived and real impact metrics Ensures that all reports are tracked and responded to Does NOT address timeframes

10 ISO 30111 In Depth Communication with support providers Communication with Product Management Communications with developers and QA Timing of public disclosure notices Timing of fixed releases

11 Recognizes that third-party (open-source) code could be involved Provides for Coordinators between finders and vendors to minimize the possibility of blackmail or extortion Ensures a consistent mechanism

12 Disclosure Notice Content Whether it’s real or perceived How to recognize the vulnerability How to evaluate impact on your systems How to mitigate before a fix is available Which release(s) fix the issue(s) How to repair any damage

13 How Can We Use These Standards Need to know all Vendors’ CSIRT mail aliases Know where to find previously addressed issues on vendor support site Make your own template for submission – Contact info – Minimum needed to describe problem, product Release version numbers are critical – Do not include reproduction info initially

14 Minimum Submission Info Product Name and version Release Version installed Operating System Client or Server issue Brief symptoms CVSS from your point of view Remediation(s) attempted with results Is there corrupted or lost data?

15 Benefits to Practitioners Clean method to report vulnerabilities Clean method to research known issues Common expectations as to responses

16 Benefits to Vendors Repeatable and well-oiled response process Guidance as to expectations by customers Common severity calculations – CVSS Common Vulnerability Scoring System

17 How to Help Vendors Look up known and addressed issues Update all software/applications promptly Submit a report to the vendor Wait for further instructions to submit exact reproduction information in a secure manner Don’t report multiple issues in the same mail unless they have a common root-cause

18 Further Reading CVSS Standards guide – CVSS Calculator – ion=2 ion=2

19 Further Reading ISO 15408 Information technology — Security techniques — Evaluation criteria for IT security ISO 27034, Information technology – Security techniques - Application security ISO 28001, Security management systems for the supply chain — Best practices for implementing supply chain security, assessments and plans

20 Caveat The US price for the two standards is over $400. The more useful one is ISO 29147

21 Contact Info Dick Hacking 650-224-5418

Download ppt "ISO 29147 How to leverage Dick Hacking Cornerstones of Trust 2014."

Similar presentations

Ads by Google