|
Issue No. 35 (November - December 2005)
Dimitrios Lekkas and Diomidis Spinellis Bulletins of security advisories typically include a description of a vulnerability, its possible impact on specific targets and candidate solutions. These are published by Security Response Centers, operating as independent organizations or as specialized departments of software and hardware vendors, to help the interested community operate their systems and networks in a secure manner. The life-cycle of a security advisory starts form the ‘vulnerability disclosure’ i.e. the discovery of a security problem after users’ reports or as a result of research and product evolution. The product vendor decides on the necessary workaround, builds patches and fixes and publishes a detailed ‘security advisory’. At the same time the advisory may also appear in other vendor-independent fora such as the reports of various Computer Emergency Response Teams and the Common Vulnerability and Exposures (CVE) dictionary. Various revisions of the advisory may be published during its life-cycle, while the vendors release relevant patches and workarounds or, at a later stage, incorporate a solution into a major product release. A security advisory remains of interest to the community during the life-cycle of the relevant vulnerability, until the number of systems it can exploit shrinks to insignificance. Download List of working papers |