3 ms·

> The legislation doesn't require publication; it requires confidential reporting. Doesn't it? The legislation [1] says: > Article 11 Reporting obligations of

> The legislation doesn't require publication; it requires confidential reporting. Doesn't it? The legislation [1] says: > Article 11 Reporting obligations of manufacturers > 1. The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any actively exploited vulnerability [...] ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notification to the CSIRT designated for the purposes of coordinated vulnerability disclosure Maybe your interpretation is different to mine - but to me that sounds like every report will be subject to "coordinated vulnerability disclosure" [1] https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-34e9-11ed-9c68-01aa75ed71a1.0001.02/DOC_1&format=PDF#page=41&zoom=160,-12,363 https://eur-lex.europa.eu/resource.html?uri=cellar:864f472b-...

Retric 3y ago
> unless for justified cybersecurity risk-related grounds Means they can keep things confidential, assuming it’s still relevant.
mqus 3y ago
"unless for justified cybersecurity risk-related grounds" sounds to me like "let us fix it first, in a reasonable timeframe" is absolutely an option. So it does not require publishing in the first 24 hours (which was afaict) the basis of this argument.
emn13 3y ago
My assumption is that the involved parties will attempt to use reasonably self-interested common sense unless required otherwise. The text does not appear to say there must be immediate publication, therefore I'm assuming that won't happen, but it's legalese; it's possible I've misinterpreted this. The reason I think there's room for normal processes here is that they're talking about ENISA forwarding that notification to CSIRT (without the 24-hour deadline? possibly later?), and they talk of "unless for justified cybersecurity risk-related grounds", and even if CSIRT and ENISA have _notifications_ eventually (potentially well past that 24 hours), it doesn't say that requires immediate publication, merely that the notification is for _purposes_ of "coordinated vulnerability disclosure". It doesn't say that disclosure must be immediate, nor in fact does it even say it must _ever_ actually occur; simply that that's the aim. If anything, that constrains the organization; so it wouldn't be valid grounds to withhold forwarding to CSIRT if some intelligence agency for instance happened to find that convenient (not that I'm under any illusions that that is therefore inconceivable or that there aren't potentially 100 other loopholes). Sounds to me like both ENISA and CSIRT have the option to sit on things, as it is, and also as if the manufacturer can ask them to do so. Also, that word "justified" can mean pretty much anything. It might turn out to mean "we haven't finished our impact assessment yet", and therefore by default _all_ vulnerability notifications initially are not forwarded because of course they won't be assessed in that kind of time-frame, or if forwarded at least not published. Basically: this all sounds so vague that it doesn't appear (but IANAL) that the proposed rule requires YOLO style vulnerability notifications, so I'm going to presume they'll treat this with the necessary caution.

Retric 3y ago

> unless for justified cybersecurity risk-related grounds Means they can keep things confidential, assuming it’s still relevant.

mqus 3y ago

"unless for justified cybersecurity risk-related grounds" sounds to me like "let us fix it first, in a reasonable timeframe" is absolutely an option. So it does not require publishing in the first 24 hours (which was afaict) the basis of this argument.

emn13 3y ago

My assumption is that the involved parties will attempt to use reasonably self-interested common sense unless required otherwise. The text does not appear to say there must be immediate publication, therefore I'm assuming that won't happen, but it's legalese; it's possible I've misinterpreted this. The reason I think there's room for normal processes here is that they're talking about ENISA forwarding that notification to CSIRT (without the 24-hour deadline? possibly later?), and they talk of "unless for justified cybersecurity risk-related grounds", and even if CSIRT and ENISA have _notifications_ eventually (potentially well past that 24 hours), it doesn't say that requires immediate publication, merely that the notification is for _purposes_ of "coordinated vulnerability disclosure". It doesn't say that disclosure must be immediate, nor in fact does it even say it must _ever_ actually occur; simply that that's the aim. If anything, that constrains the organization; so it wouldn't be valid grounds to withhold forwarding to CSIRT if some intelligence agency for instance happened to find that convenient (not that I'm under any illusions that that is therefore inconceivable or that there aren't potentially 100 other loopholes). Sounds to me like both ENISA and CSIRT have the option to sit on things, as it is, and also as if the manufacturer can ask them to do so. Also, that word "justified" can mean pretty much anything. It might turn out to mean "we haven't finished our impact assessment yet", and therefore by default _all_ vulnerability notifications initially are not forwarded because of course they won't be assessed in that kind of time-frame, or if forwarded at least not published. Basically: this all sounds so vague that it doesn't appear (but IANAL) that the proposed rule requires YOLO style vulnerability notifications, so I'm going to presume they'll treat this with the necessary caution.