Vultron is a research project. It explores how to make a federated, decentralized, and open-source protocol for coordinated vulnerability disclosure (CVD). Vultron comes from the CERT/CC's decades of experience. The CERT/CC coordinates the global response to software vulnerabilities.
The goal is to make one protocol for all organizations. An organization can use the protocol to coordinate the disclosure of vulnerabilities. These vulnerabilities occur in information processing systems, such as software, hardware, and services. A second goal is to build interoperability across independent organizations. Their processes and policies are different, but they can work together. Together, they can coordinate an applicable response to vulnerabilities.
Vultron is a collection of ideas, models, code, and work in progress. It is not ready for production use.
For uvicorn/ASGI deployment, use vultron.adapters.driving.fastapi.main:app as the primary API entrypoint.
The app_v2 object is in vultron.adapters.driving.fastapi.app. This object is the mounted sub-application.
Developers use it directly in local development and tests.
Vultron is a continuation of the CERT/CC's work on improving the coordination of vulnerability disclosure and response. Our previous work in this area includes:
-
The CERT Guide to Coordinated Vulnerability Disclosure (Version 1.0, Version 2.0 )
-
Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization (SSVC) (Version 1.0, Version 2.0, github )
-
The Vulnerability Information and Coordination Environment (VINCE) (blog post, github )
-
A variety of related research, including
More recently, the CERT/CC has been working towards formalizing this knowledge into a protocol for CVD. This work began with A State-Based Model for Multi-Party Coordinated Vulnerability Disclosure (MPCVD), which also appeared in an abridged form as Are We Skillful or Just Lucky? Interpreting the Possible Histories of Vulnerability Disclosures in the ACM Journal Digital Threats: Research and Practice. In 2022, we published a collection of Coordinated Vulnerability Disclosure User Stories derived from both our process modeling work and from the experience of building VINCE. That same year, we published Designing Vultron: A Protocol for Multi-Party Coordinated Vulnerability Disclosure (MPCVD), which serves as the basis for the work contained in this repository.
Vultron is:
- A set of high-level processes. These processes show the steps in coordinated vulnerability disclosure.
- A formal protocol. The protocol gives the interactions of those processes.
- A set of behavior logic. Humans can obey this logic as procedures. In many cases, code can also do these actions when the state of a case changes. This code needs only minimal human input.
- A minimal data model. The model gives the data that is necessary to monitor each participant's status and the full status of the case through the CVD case.
The Designing Vultron: A Protocol for Multi-Party Coordinated Vulnerability Disclosure (MPCVD) report first gave all of the items above.
In this repository, we make the first steps to build the protocol and behavior logic from that report. Currently, the work maps the formal protocol onto the syntax and semantics of the ActivityPub protocol. You can find examples of these first steps in doc/examples
Vultron is not a drop-in replacement for these items:
- a tracking system, such as Bugzilla or Jira
- a CVD or threat coordination tool, such as VINCE or MISP
- a vulnerability disclosure program, such as DC3 VDP
- a vulnerability disclosure platform or service, such as HackerOne, Bugcrowd, or Synack
As an alternative, we hope that Vultron can be a lingua franca. It can interchange vulnerability case coordination data between those systems and services.
Vultron is not a vulnerability prioritization tool. But it is compatible with common prioritization schemes, such as SSVC and CVSS.
Vultron is not a product. It is a feature set. You can build this feature set into many CVD-related products and services to let them interoperate.
For more about our work in modeling, formalizing, and describing the CVD process, see:
- Designing Vultron: A Protocol for Multi-Party Coordinated Vulnerability Disclosure (MPCVD) (2022) is the initial Vultron report.
- SEI Blog post on Vultron (2022-09-26)
- SEI Podcast on Vultron (2023-02-24)
- CERT Guide to Coordinated Vulnerabilty Disclosure (2017, 2019)
- A State-Based Model for Multi-Party Coordinated Vulnerability Disclosure (MPCVD) (2021)
- Coordinated Vulnerability Disclosure User Stories (2022)
- Multi-Method Modeling and Analysis of the Cybersecurity Vulnerability Management Ecosystem (2019) is a snapshot of some related System Dynamics and Agent-based modeling we did of CVD and related processes.
- Coordinated Vulnerability Disclosure is a Concurrent Process (2015) is an older talk which looks at a number of prior models of the CVD process, and shows some of our early attempts to formally describe the concurrency aspects of the CVD process.
This repository is licensed under the MIT (SEI) license. See also the included copyright statement.
Tell us if you have feedback on this topic. This includes feedback if the copyright or license makes it difficult for you to collaborate with us. Please tell us in an issue.