Computer Incident Response and Product Security

Chapter 11. Security Vulnerability Handling by Vendors

This chapter covers the process of handling security vulnerabilities. Although this description is strongly influenced by an existing process used by Cisco, this text is not the exact description of the process used by Cisco. This chapter deviates from Cisco practice in places and introduces new elements. The purpose of this chapter is to provide a description of a general vulnerability handling process that can be adopted by many vendors rather than a detailed description of the process of a single vendor.

Known Unknowns

It was Mr. Donald Rumsfeld who used the phrase “known unknowns,” and we will have to borrow it here. A certain level of nonobjectivity exists in handling security vulnerabilities. ...