THE COUNCIL ,
HAVING REGARD to Article 5 b) of the Convention on the Organisation for Economic Co-operation and Development of 14 December 1960;
HAVING REGARD to the Recommendation of the Council on Digital Security Risk Management (Digital Security Recommendation) [ OECD/LEGAL/0479 ]; the Recommendation of the Council on National Digital Security Strategies [ OECD/LEGAL/0480 ]; the Recommendation of the Council on Digital Security of Critical Activities [ OECD/LEGAL/0456 ]; the Recommendation of the Council on Digital Security of Products [ OECD/LEGAL/0481 ], the Recommendation of the Council concerning Guidelines for Cryptography Policy [ OECD/LEGAL/0289 ], and the Recommendation on Electronic Authentication [ OECD/LEGAL/0353 ], which form with the present Recommendation a comprehensive set of international standards on digital security featured in the OECD Policy Framework on Digital Security [ C(2022)145/ADD1 ];
HAVING REGARD to the standards developed by the OECD in the area of privacy and transborder flows of personal data, internet and internet policy making, digital economy, innovation, growth and social prosperity;
HAVING REGARD to international technical standards and guidance on vulnerability handling, vulnerability disclosure and vulnerability management;
RECOGNISING that digital security vulnerabilities are a major cause of digital security risk because they can be weaponised to launch attacks organisations and individuals, pursuing various goals such as to extort money, steal sensitive information such as personal data as well as trade and State secrets, inflict reputational damage, disrupt business operations, undermine trust, and track human rights activists and journalists;
RECOGNISING that such attacks affect economic and social prosperity, undermine trust in the digital economy, reduce the potential benefits from digital transformation, threaten the security, privacy and personal data, freedom of expression and safety of individuals, and the delivery of activities that are critical for the functioning of our economies and societies, such as health care, water treatment, energy distribution and elections;
RECOGNISING that all products that include code may also include vulnerabilities; that products might appear free of vulnerabilities at a certain point or in a certain context but may be revealed to be vulnerable later or when the context changes; and that all information systems include vulnerabilities related to misconfigurations and the non-application of products’ security updates and patches;
RECOGNISING that not all vulnerabilities can be eliminated; however, mitigation measures can be developed and applied to many of them;
RECOGNISING that it is essential to treat these vulnerabilities swiftly in order to reduce digital security risk, and in particular to minimise time during which stakeholders are exposed to the possible exploitation of vulnerabilities (“window of exposure”);
RECOGNISING that vulnerabilities that are intentionally inserted in products’ code and in information systems (“backdoors”) increase the level of digital security risk for all stakeholders because they can be discovered and exploited by criminals and other malicious actors;
RECOGNISING that vulnerability researchers can play a crucial role to help discover and report vulnerabilities to organisations that can mitigate them (vulnerability owners);
RECOGNISING that coordination, including across borders, among all stakeholders with a role and responsibility to treat vulnerabilities is essential to reduce digital security risk, and that there is a need to enhance international co-operation to create a global environment conducive to the widest adoption of vulnerability treatment;
RECOGNISING that digital security risk increases for all stakeholders when newly discovered vulnerabilities are not reported to organisations responsible to mitigate them or to a trusted co-ordinator, and in particular when they are communicated to or acquired by other parties seeking to exploit, stockpile or weaponise them, or pursing other objectives than mitigating them; and that the so-called grey market where vulnerabilities can be acquired for such purposes is contributing to increasing digital security risk;
CONSIDERING that the Good Practice Guidance on the Co-ordination of Digital Security Vulnerabilities (hereafter the “Good Practice Guidance”) provides detailed guidance on vulnerability co-ordination to inform policy makers and may be modified as appropriate by the Committee on Digital Economy Policy.
On the proposal of the Committee on Digital Economy Policy:
I. AGREES that the purpose of this Recommendation is to provide guidance on how to implement the Digital Security Recommendation to develop public policies to foster vulnerability treatment in order to reduce digital security risk, thereby strengthening trust and supporting digital transformation;
II. AGREES that, for the purpose of this Recommendation, the following definitions apply:
● Digital security vulnerabilities , or “vulnerabilities”, refers to technical weaknesses in products and information systems that can be exploited to damage economic and social activities. They include:
‒ Code vulnerabilities , which are located in the code of products; and
‒ System vulnerabilities , which affect information systems and include primarily misconfigurations and the non-application of products’ security updates, patches or other mitigations.
● Vulnerability researchers refers to individuals or organisations who identify potential code or system vulnerabilities with the intention to reduce related security risk. They are sometimes also called “ethical hackers”, or “white hat hackers”.
● Vulnerability owners refers to stakeholders with responsibility to mitigate a vulnerability they are aware of. They include code owners (also known as “vendors”), who are responsible to develop and maintain a layer of code embedded in a product, including through vulnerability handling (e.g. developing a patch and distributing it, for example through a security update). Code owners form the first line of defense against malicious actors. They are often called vendors, suppliers, developers, maintainers, or manufacturers. Vulnerability owners also include system owners , who are responsible to mitigate system vulnerabilities, including through vulnerability management (e.g. applying patches and security updates). System owners are the second line of defense. The combination of these first and second lines of defense reduces security risk related to the possible exploitation of vulnerabilities.
● Vulnerability handling refers to the risk-based processes followed by code owners to verify information about a newly discovered vulnerability and resolve that vulnerability by developing and disseminating the appropriate mitigation to affected system owners (e.g. security update, patch, workaround).
● Vulnerability management refers to the ongoing risk-based processes enabling a system owner to know if vulnerabilities are present within its digital ecosystem and take appropriate risk management decisions and actions to mitigate them.
● Vulnerability reporters refers to the individuals or organisations who report a vulnerability. They are sometimes called “finders” and include vulnerability researchers as well as other parties such as co-ordinators, users of the product or information system, penetration testers, etc.
● Vulnerability treatment refers to the overarching process encompassing vulnerability discovery, handling (by code owners), management (by system owners) and disclosure. It includes all the actions taken to discover vulnerabilities, and:
‒ For code vulnerabilities , to develop a mitigation (e.g. a patch, security update, workaround), distribute it to a product’s users, and disclose the vulnerability to the public or the security community; and
‒ For system vulnerabilities , to apply an existing mitigation or remediate the misconfiguration;
● Co-ordinated vulnerability disclosure (CVD) refers to the process through which vulnerability owners and researchers work co-operatively in finding solutions that reduce the risk associated with a vulnerability. CVD is part of vulnerability treatment.
CLARIFYING RESPONSIBILITIES
III. RECOMMENDS that Members and non-Members adhering to this Recommendation (hereinafter the “Adherents”) establish clear responsibilities for all categories of stakeholders regarding vulnerability treatment, and ensure that:
1. All stakeholders are:
a. Aware that their products and information systems can include vulnerabilities;
b. Responsible and accountable, based on their role, ability to act and the context, for addressing vulnerabilities and sharing information using secure channels in a timely manner, and for taking into account the potential impact of their decisions on third parties;
2. Code owners:
a. Adopt a security development lifecycle whereby vulnerability handling is an integral part of basic product maintenance and support, and in line with international technical standards related to vulnerability treatment;
b. Do not intentionally insert vulnerabilities in products;
c. Take measures to ensure that mitigations can be applied to third-party products embedding their code as a component, in order to limit domino effects on the supply chain.
3. System owners apply a vulnerability management process as part of their digital security risk management framework, to identify and address misconfigurations as well as unpatched software and firmware according to the risk they pose, in line with consensus-driven international technical standards.
4. Vulnerability owners:
a. Minimise the window of exposure to the exploitation of vulnerabilities by criminals and other malicious actors. They proceed as rapidly as possible while ensuring that mitigations are sufficiently tested to minimise the likelihood of creating new vulnerabilities and other negative side effects.
b. Work with vulnerability researchers and other vulnerability reporters in a co-operative manner, in line with relevant international technical standards.
5. Vulnerability researchers respect domestic laws, take responsibility for their actions, and understand the legal risk they may face when researching, reporting or disclosing vulnerabilities without following good practices for CVD. They seek assistance of a trusted co-ordinator, as appropriate.
ENCOURAGING RESEARCHERS AND CREATING SAFE HARBOURS
IV. RECOMMENDS that Adherents encourage vulnerability researchers to search for vulnerabilities and report them to vulnerability owners according to good practice, and create conditions to ensure that vulnerability researchers who follow good practice are protected or excluded from criminal and other liability (“safe harbour”), including by:
1. Funding vulnerability research and supporting the vulnerability researchers’ ecosystem;
2. Adjusting domestic legal frameworks to protect these vulnerability researchers from liability, as well as wrongful legal threats made and pressure exerted by vulnerability owners or the government that prevent or discourage vulnerability researchers from contributing to risk reduction by reporting or disclosing vulnerabilities;
3. Adopting measures to discourage such wrongful legal threats and pressure, and to discourage misconduct or violation of trust by co-ordinators;
4. Clarify the legal responsibility of vulnerability researchers and other vulnerability reporters, and raise their awareness about the possible legal consequences of their actions according to domestic law;
5. Encouraging vulnerability owners to:
a. Adopt vulnerability disclosure policies with clear and simple conditions that reduce risk for vulnerability researchers who respect them;
b. Eliminate potential inconsistencies between vulnerability owners’ vulnerability disclosure policies and contractual documents such as terms of use, terms of service, and licences;
FOSTERING TRUST
V. RECOMMENDS that Adherents ensure that stakeholders can access at least one trusted co-ordinator who can assist in resolving issues between CVD participants and facilitate complex CVD processes. A trusted a co-ordinator is a neutral public or private body, domestic or foreign, which:
1. Has a high level of technical digital security competence and expertise;
2. Has well organised, transparent, predictable, and reliable processes, in particular with respect to the security, clarity and regularity of its communications with stakeholders, and the security of vulnerability information it may receive in the course of a CVD process;
3. Provides assurance that vulnerability information will only be shared with or accessed by the vulnerability owner and other trusted parties who meaningfully contribute to co-ordination, and it will not not be shared with or accessed by any party who could abuse it;
4. Has established mutual trusted relationships with other co-ordinators in third countries and can use them to overcome possible cross-border challenges in the communication between CVD stakeholders, including in relation to linguistic, legal, political, cultural and other differences;
5. Can facilitate the CVD process between multiple code or system owners, when the same vulnerability affects more than one code owner using a common mechanism in their systems or codes;
6. Can respect the researcher’s willingness to remain anonymous, including to protect the researcher against wrongful legal threats;
VI. RECOMMENDS that Adherents ensure their digital security policy and institutional frameworks are trusted by vulnerability researchers and that the vulnerability information vulnerability researchers provide to public or private sector co-ordinators will not be misused. For example, the public sector co-ordinator could be integrated to the national CSIRT.
MAINSTREAMING GOOD PRACTICE
VII. RECOMMENDS that Adherents promote and disseminate the Good Practice Guidance to the vulnerability owners and researchers’ communities, and encourage vulnerability owners and vulnerability researchers to use existing good practice such as those included in the Good Practice Guidance, including by:
1. Implementing this good practice within the government, while ensuring that government bodies have the appropriate capacity, funding, and resources to implement it;
2. Integrating vulnerability treatment in public procurement requirements and contractual relationships;
3. Including vulnerability treatment as an indicator of compliance to contractual relationships as well as to existing and new digital security regulation affecting vulnerability owners, for example in areas such as digital security of critical activities or the protection of personal data;
4. Including vulnerability treatment in broader digital security guides, manuals, and guidance, where appropriate, and disseminating information and guides for vulnerability treatment and tools such as vulnerability disclosure policies’ templates, and create communication channels to harmonise good practice;
VIII. RECOMMENDS that Adherents encourage all stakeholders to use existing international technical standards on vulnerability handling, management and disclosure, contribute to their improvement, and to the development of new ones where appropriate, and ensure that domestic technical standards, manuals and guides are consistent with appropriate international standards;
IMPROVING DOMESTIC AND INTERNATIONAL COOPERATION
IX. RECOMMENDS that Adherents intensify domestic and international co-operation, including by:
1. At the domestic level:
a. Integrating the promotion of vulnerability treatment, including CVD, in their national digital security strategy;
b. Leveraging the multi-stakeholder digital security community, including vulnerability researchers, digital security firms, cyber insurers, vulnerability owners, the technical community and civil society, in order to develop and implement public policies to foster vulnerability treatment, including CVD, in the public and private sectors.
c. Taking into account international technical standards and best practices when developing national policies related to vulnerability treatment;
2. At the international level:
a. Sharing good practices on national and regional public policies and initiatives on vulnerability treatment;
b. Facilitating the exchange of information between vulnerability researchers and vulnerability owners across borders;
c. Co-operating to foster interoperability between legal frameworks across jurisdictions in order to ensure that vulnerability researchers who follow good practice are sufficiently protected across borders when reporting and disclosing vulnerabilities;
d. Participating in the development of international technical standards related to vulnerability treatment;
e. Co-operating with all stakeholders at the international level to develop guidance or a code of conduct for vulnerability researchers;
f. Work together at the international level to reduce or eliminate the grey market for vulnerabilities which prevents some vulnerabilities from being known and handled by vulnerability owners as soon as possible;
g. Support multistakeholder co-operation to fund, organise, and streamline international co-ordinated disclosure and resolution of vulnerabilities in key open source products.
***
X. CALLS ON vulnerability owners and vulnerability researchers to follow good practice such as those included in the Good Practice Guidance for the Co-ordination of Digital Security Vulnerabilities.
XI. INVITES the Secretary-General to disseminate this Recommendation.
XII. INVITES Adherents to disseminate this Recommendation at all levels of government.
XIII. INVITES Adherents to the Digital Security Recommendation to take due account of, and adhere to, this Recommendation.
XIV. INSTRUCTS the Committee on Digital Economy Policy, to:
a. Serve as a forum for:
i. exchanging information on public policies related to vulnerability treatment in coordination with other international fora, and
ii. developing analytical work to support the implementation of the Recommendation;
b. Update the Good Practice Guidance in light of future developments in this area;
c. Report to the Council on the implementation, dissemination, and continued relevance of this Recommendation when reporting on the Digital Security Recommendation and at least every ten years thereafter.