National CSIRT as a CVD Hub: Lessons from CERT.PL’s Vulnerability Coordination Cases

National CSIRT as a CVD Hub: Lessons from CERT.PL’s Vulnerability Coordination Cases

Speakers: Michał Dondajewski, CVD Coordination Specialist, CERT.PL

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=mJ52or3IadI

Overview

In this insightful VulnCon presentation, Michał Dondajewski, a CVD Coordination Specialist at CERT.PL, shares the unique experiences and challenges faced by Poland's national Computer Emergency Response Team (CSIRT) in its role as a Coordinated Vulnerability Disclosure (CVD) hub. As the designated national coordinator under the NIS2 Directive and a CVE Numbering Authority (CNA), CERT.PL stands at the forefront of managing vulnerability reports, liaising between researchers and vendors, and ensuring public transparency in the Polish cybersecurity landscape.

The talk delves into the intricacies of establishing a robust CVD process within a national framework, navigating legal complexities, and overcoming significant operational hurdles. Dondajewski candidly discusses CERT.PL's "pain points," such as difficulties in vendor engagement, legal basis disputes, and managing the intent of vulnerability reporters. The presentation offers invaluable lessons learned over three years of operating as a CNA, providing a practical blueprint for other national CSIRTs and cybersecurity stakeholders grappling with similar responsibilities.

This discussion is particularly pertinent as European Union member states implement the NIS2 Directive and prepare for the upcoming Cyber Resilience Act (CRA). CERT.PL's journey highlights the critical role national CSIRTs play in fostering a secure digital environment, not just by reacting to incidents but by proactively coordinating the disclosure and remediation of vulnerabilities at a national and international scale. The insights shared are crucial for understanding the evolving landscape of vulnerability management and the strategic importance of national coordination efforts.

Background

▶ Watch: Introduction to CERT.PL's CNA role (0:00)

CERT.PL, operating under NASK (the National Research Institute), has served as Poland's National CSIRT for 30 years, managing the national .pl domain. Its role as a national cybersecurity cornerstone was further solidified with the introduction of the NIS2 Directive, which mandates every EU member state to designate a CSIRT as a coordinator for Coordinated Vulnerability Disclosure. This directive provided CERT.PL with a clear legal basis for its CVD activities, a significant development given previous ambiguities.

Prior to the explicit legal mandate of NIS2, CERT.PL leveraged existing legislation, such as the 2017 Polish law counteracting security flaws in IT systems. This law provides a legal safe harbor for ethical hacking, stating that individuals acting solely to secure IT systems, who immediately notify administrators and cause no public harm or damage, shall not be subject to punishment. This crucial legal precedent enabled researchers to operate without fear of legal repercussions, fostering a more open environment for vulnerability discovery and reporting.

To effectively fulfill its duties as a CVD coordinator and ensure global transparency, CERT.PL chose to become a CVE Numbering Authority (CNA). This strategic decision, implemented in August 2023, made CERT.PL the first and, to date, the only CNA in Poland, and the 73rd in Europe. Operating under the root of ENISA, CERT.PL's CNA scope encompasses vulnerabilities discovered by its own teams or reported to it for disclosure. The organization is committed to enriching its CVE entries with detailed CWE (Common Weakness Enumeration) and CVSS (Common Vulnerability Scoring System) scores, further enhancing the utility of its disclosures. Poland's unique structure with three national CERTs—military, governmental, and CERT.PL—necessitates internal coordination to ensure the correct constituency is informed and involved, especially when a vulnerability might affect multiple sectors or governmental entities.

Key Findings

▶ Watch: Polish law legalizing ethical hacking for security (8:00)

CERT.PL's experience as a national CVD hub has yielded several critical findings, highlighting both successes and persistent challenges in the coordinated disclosure landscape. One notable success involves cases of mass vulnerability reporting, where a single researcher or team identifies dozens of vulnerabilities simultaneously. In such instances, CERT.PL has successfully collaborated with cooperative vendors, even establishing shared spreadsheets for efficient, bulk CVE assignment and disclosure, streamlining a process that would otherwise be cumbersome for individual reports. This approach significantly improved the speed and scale of vulnerability information exchange.

The volume of reported vulnerabilities and assigned CVEs has seen substantial growth, indicating an increasing awareness and utilization of CERT.PL's services. In the last year, CERT.PL published over 160 CVE entries, more than doubling the number from the previous year. This upward trend underscores the growing importance of national CVD coordination and the active engagement of the research community.

Despite these successes, CERT.PL has identified several "pain points" that frequently impede effective CVD:

1. Lack of Vendor Contact and Cooperation: This is the most significant hurdle, affecting an estimated 15-20% of all cases. Many vendors are unresponsive to initial contact attempts, and some actively refuse to acknowledge or publish CVE entries, or even question the legality of penetration tests (especially before the NIS2 directive provided a clear legal basis).
2. Unclear Researcher Intentions: In some unfortunate instances, researchers have attempted to extort money from vendors by offering "security audit offers" after discovering vulnerabilities, without providing specific details. CERT.PL views such actions as criminal and recommends police involvement, emphasizing that bug bounty programs are not mandatory.
3. Unimportant or End-of-Life (EOL) Software: A considerable number of reports pertain to software deemed unimportant or already past its end-of-life. While CERT.PL processes these, they divert resources. To address this, CERT.PL has developed guidelines encouraging researchers to first check for existing CVD policies or more specific CNAs, and to try direct vendor contact before escalating.
4. Multi-Stakeholder Cases: Vulnerabilities affecting multiple vendors or critical sectors (e.g., medical software across many clinics) require complex coordination involving sectoral CSIRTs and other national entities, adding layers of complexity to the disclosure process.

Looking ahead, CERT.PL expresses significant optimism about the forthcoming Cyber Resilience Act (CRA). This legislation is expected to mandate that manufacturers and importers establish clear points of contact for vulnerability reporting and take mandatory action to remediate identified vulnerabilities. This legal framework is anticipated to significantly alleviate the persistent challenge of vendor unresponsiveness and non-cooperation, fundamentally improving the efficiency and effectiveness of vulnerability coordination across the EU.

Technical Deep Dive

▶ Watch: CERT.PL's 90-day vulnerability disclosure policy (20:00)

CERT.PL's Coordinated Vulnerability Disclosure (CVD) process is designed to be comprehensive and transparent, aligning with its role as both a national CSIRT and a CNA. The preferred initial approach encourages researchers to directly contact the affected vendor. This direct engagement fosters rapid communication and quicker remediation. However, if direct contact is unsuccessful or problematic, CERT.PL steps in as the national coordinator.

The core CVD process, once a report is submitted to CERT.PL, involves several key stages:

1. Report Reception: Vulnerabilities are submitted electronically, often via a dedicated form on CERT.PL's website. Anonymity for reporters is a mandatory option, ensuring individuals are not afraid to come forward.
2. Vendor Identification and Notification: CERT.PL identifies the providers of affected products or services and informs them about the detected vulnerabilities.
3. Coordination and Verification: If necessary, CERT.PL coordinates communication between the reporter and the manufacturer/provider, facilitating verification of the report and agreeing on disclosure timing.
4. Remediation and Waiting Period: The vendor is given time for remediation. CERT.PL operates with a default 90-day disclosure policy, meaning CVE entries are published 90 days after vulnerability details are sent to the vendor. This period can be shortened if the vulnerability is publicly released earlier, or extended in justified cases through negotiation with cooperative vendors. If a vendor remains unresponsive after multiple attempts, CERT.PL will still publish the information after the 90-day period, acknowledging the lack of vendor engagement.
5. CVE Assignment and Publication: CERT.PL verifies if the vulnerability qualifies for a CVE identifier and proceeds to assign one. The information, including the CVE entry, is then published on CERT.PL's website and shared with relevant parties.

To streamline the reporting process, CERT.PL asks researchers a concise set of questions:

• "Have you tried to contact the system owner? If so, what was their response?" (Assesses researcher's transparency)
• "What system does the notification relate to?" (Requires exact domain or IP address for identification)
• "If you are an owner of the system for whatever reason, please let us know." (Clarifies reporter's relationship to the system)
• "Please describe what the vulnerability is." (Broad description of the flaw)

As a CNA, CERT.PL's scope covers vulnerabilities discovered by its own research or those reported to it for disclosure, regardless of geographical origin, provided the vendor is not already a CNA. CERT.PL actively enriches its CVE entries with CWE (Common Weakness Enumeration) and CVSS (Common Vulnerability Scoring System) scores, striving for comprehensive and standardized vulnerability information.

Internally, CERT.PL primarily uses its existing incident response tooling for email-based coordination, integrating CVD cases into its broader incident management workflow. For unresponsive vendors, CERT.PL employs a multi-pronged outreach strategy, including phone calls (effective domestically), Discord, Slack, LinkedIn, and filling out generic contact forms. Notably, CERT.PL has established a GitHub account to directly raise issues with vendors who maintain public repositories, serving as an alternative communication channel when traditional methods fail.

The legal framework is foundational to CERT.PL's operations. While the NIS2 directive now explicitly grants CERT.PL the right to coordinate CVD, there were periods where its legal basis was questioned by vendors. In such cases, CERT.PL relied on interpretations of its mandate and other legal authorizations. Furthermore, if a vendor denies a reported vulnerability, CERT.PL, as a national-level CERT, has the right to independently examine the product to verify the vulnerability, irrespective of End User License Agreements (EULAs) or terms of service. This independent judgment is considered the final word on the existence of a vulnerability. When publishing details of vulnerabilities where a vendor has been unresponsive, CERT.PL carefully balances providing enough information to identify the flaw without offering sufficient details to easily reproduce it, mitigating the risk of creating exploitable zero-days.

Demo / Proof of Concept

▶ Watch: Handling researchers seeking payment for vulnerabilities (24:00)

The presentation by Michał Dondajewski primarily focuses on the operational processes, legal frameworks, challenges, and strategic approaches adopted by CERT.PL in its role as a national CVD hub and CNA. As such, the talk did not feature a live demonstration or a specific proof of concept for any particular vulnerability or technical tool beyond mentioning the use of their internal incident response system and a GitHub account for vendor outreach. The content is centered on the how of vulnerability coordination at a national level, rather than what specific vulnerabilities were found or how they could be exploited.

Defensive Implications

▶ Watch: Handling vendor requests for Non-Disclosure Agreements (34:00)

CERT.PL's experiences offer several critical defensive implications for various stakeholders within the cybersecurity ecosystem:

For Software Vendors and Manufacturers:

• Establish Clear Communication Channels: The persistent challenge of vendor unresponsiveness highlights the urgent need for clear, accessible, and monitored security contact points (e.g., dedicated security@ email addresses, security.txt files). The upcoming Cyber Resilience Act will make this mandatory, but proactive establishment is crucial now.
• Embrace CVD Policies: Vendors should develop and publicly communicate their own CVD policies. Engaging with national CSIRTs and CNAs like CERT.PL is not just a compliance matter but a best practice for responsible product stewardship and customer safety.
• Understand Legal Frameworks: Be aware of national laws regarding ethical hacking (like Poland's 2017 law) and directives such as NIS2, which empower national CSIRTs. Questioning the legal basis of a national coordinator is increasingly untenable.
• Cooperate for Remediation: Actively engage with researchers and coordination bodies. Cooperation on assigning CVEs, agreeing on disclosure timelines, and providing patches builds trust and protects users. Ignoring reports can lead to public zero-day disclosures, potentially harming reputation and customer security.
• Prepare for CRA: European vendors and importers must prepare for the Cyber Resilience Act, which will mandate clear points of contact and proactive vulnerability removal, shifting the burden of responsibility more firmly onto manufacturers.

For Organizations Using Software:

• Monitor Advisories: Regularly check advisories published by national CSIRTs like CERT.PL. These advisories provide critical information about vulnerabilities affecting software you might be using, especially for products where vendors are unresponsive.
• Be Aware of Zero-Days: Understand that if a vendor does not cooperate, a national CSIRT might publish a "zero-day" advisory to inform users, balancing the need for awareness against the risk of exploitation. Have incident response plans ready for such eventualities.
• Prioritize Supported Software: The issue of unimportant or end-of-life (EOL) software highlights the risk of using unsupported products. EOL software often has unpatched vulnerabilities, making it a significant security liability.

For Cybersecurity Researchers:

• Adhere to Ethical Hacking Laws: Always operate within the legal boundaries of ethical hacking in the country where the system owner resides.
• Follow CVD Best Practices: Attempt direct vendor contact first. If unsuccessful, report to a national CSIRT or relevant CNA. Provide clear, detailed reports, including proposed CWEs and CVSS scores, to facilitate the coordination process.
• Avoid Extortion: Do not attempt to monetize vulnerability discoveries through coercive means. This is illegal and undermines the spirit of responsible disclosure.
• Understand CSIRT Scope: If a vendor is already a CNA, report to them directly. Otherwise, national CSIRTs like CERT.PL are valuable resources, even for vulnerabilities outside their immediate national borders.

For Other National CSIRTs and CNAs:

• Learn from Pain Points: CERT.PL's challenges with vendor engagement are common. Adopt diverse outreach strategies (GitHub, social media) and maintain clear disclosure policies.
• Strengthen Legal Mandates: Advocate for clear legal frameworks that explicitly empower national CSIRTs for CVD coordination, as NIS2 has done for CERT.PL.
• Leverage Networks: Utilize CSIRT networks (e.g., EU CSIRT Network) for cross-border coordination, especially for multi-stakeholder or international vulnerabilities.
• Automate and Scale: As vulnerability reports increase, invest in tooling and staff to automate parts of the CVD process and manage the growing workload.

Key Takeaways

• National CSIRTs are Vital CVD Hubs: With directives like NIS2 and the upcoming Cyber Resilience Act, national CSIRTs like CERT.PL are increasingly designated as central coordinators for vulnerability disclosure, playing a critical role in national and international cybersecurity.
• Vendor Engagement Remains the Toughest Challenge: A significant percentage (15-20%) of cases face unresponsive or uncooperative vendors, necessitating diverse outreach strategies (GitHub, social media, phone) and a firm, transparent disclosure policy.
• Clear Legal Frameworks are Essential: Explicit legal mandates for ethical hacking and CVD coordination (like Poland's 2017 law and the NIS2 directive) empower CSIRTs, allowing them to operate effectively and even conduct independent vulnerability verification when vendors deny findings.
• Transparency and Responsible Disclosure are Key: CERT.PL's 90-day disclosure policy balances giving vendors time to remediate with the public's right to know, carefully crafting advisories to inform users without enabling immediate exploitation in zero-day scenarios.
• Scaling CVD Requires Investment: The rising volume of vulnerability reports (160+ CVEs in 2023, double 2022) necessitates continuous investment in automation tools and an expanding team to manage the workload efficiently.
• The Cyber Resilience Act Holds Great Promise: The CRA is anticipated to significantly improve vendor cooperation by mandating clear points of contact and mandatory vulnerability remediation, addressing a long-standing "pain point" for national CVD coordinators.

About the Speaker(s)

Michał Dondajewski is a CVD Coordination Specialist at CERT.PL, where he has worked for four years. He began his career as a first-line incident responder, later transitioning to second-line response, primarily handling CVD coordination cases. His natural inclination for communication led him to join CERT.PL's CNA team, where he now focuses on national and international cooperation with external partners. Michał is also a proud co-chair of the CSIRT network CVD working group and is currently pursuing a PhD on AI-related threats.