GlobalPlatform Technology

Vulnerability Disclosure and Mitigation
Process
Version 1.0
Public Release
September 2020
Document Reference: GP_PRO_066

Copyright  2020 GlobalPlatform, Inc. All Rights Reserved.
Recipients of this document are invited to submit, with their comments, notification of any relevant patents
or other intellectual property rights (collectively, “IPR”) of which they may be aware which might benecessarily infringed by the implementation of the specification or other work product set forth in thisdocument, and to provide supporting documentation. The technology provided or described herein issubject to updates, revisions, and extensions by GlobalPlatform. Use of this information is governed by
the GlobalPlatform license agreement and any use inconsistent with that agreement is strictly prohibited.

Vulnerability Disclosure and Mitigation Process – Public Release v1.0
THIS SPECIFICATION OR OTHER WORK PRODUCT IS BEING OFFERED WITHOUT ANY WARRANTYWHATSOEVER, AND IN PARTICULAR, ANY WARRANTY OF NON-INFRINGEMENT IS EXPRESSLYDISCLAIMED. ANY IMPLEMENTATION OF THIS SPECIFICATION OR OTHER WORK PRODUCT SHALLBE MADE ENTIRELY AT THE IMPLEMENTER’S OWN RISK, AND NEITHER THE COMPANY, NOR ANY
OF ITS MEMBERS OR SUBMITTERS, SHALL HAVE ANY LIABILITY WHATSOEVER TO ANYIMPLEMENTER OR THIRD PARTY FOR ANY DAMAGES OF ANY NATURE WHATSOEVER DIRECTLYOR INDIRECTLY ARISING FROM THE IMPLEMENTATION OF THIS SPECIFICATION OR OTHERWORK PRODUCT.

Copyright  2020 GlobalPlatform, Inc. All Rights Reserved.
The technology provided or described herein is subject to updates, revisions, and extensions by GlobalPlatform. Use of thisinformation is governed by the GlobalPlatform license agreement and any use inconsistent with that agreement is strictly
prohibited.

Vulnerability Disclosure and Mitigation Process – Public Release v1.03 / 10Contents1Introduction ............................................................................................................................ 52Overview ................................................................................................................................. 7

1.1
1.2
1.3
1.4
1.5
1.6
2.1
2.2
2.3
2.4
2.5

Audience ............................................................................................................................................... 5
IPR Disclaimer....................................................................................................................................... 5References ............................................................................................................................................ 5
Terminology and Definitions.................................................................................................................. 6
Abbreviations and Notations ................................................................................................................. 6
Revision History .................................................................................................................................... 6
Reporting ............................................................................................................................................... 7
Preliminary Verification ......................................................................................................................... 8
Remediation Development .................................................................................................................... 8Release ................................................................................................................................................. 9
Post Release ......................................................................................................................................... 9Annex A Vulnerability Report Information.............................................................................. 10

Copyright  2020 GlobalPlatform, Inc. All Rights Reserved.
The technology provided or described herein is subject to updates, revisions, and extensions by GlobalPlatform. Use of thisinformation is governed by the GlobalPlatform license agreement and any use inconsistent with that agreement is strictly
prohibited.

4 / 10

Vulnerability Disclosure and Mitigation Process – Public Release v1.0

FiguresFigure 2-1: Process Overview ........................................................................................................................... 7

TablesTable 1-1: Normative References ...................................................................................................................... 5
Table 1-2: Terminology and Definitions ............................................................................................................. 6
Table 1-3: Abbreviations and Notations ............................................................................................................ 6
Table 1-4: Revision History ............................................................................................................................... 6Copyright  2020 GlobalPlatform, Inc. All Rights Reserved.
The technology provided or described herein is subject to updates, revisions, and extensions by GlobalPlatform. Use of thisinformation is governed by the GlobalPlatform license agreement and any use inconsistent with that agreement is strictlyprohibited.

Vulnerability Disclosure and Mitigation Process – Public Release v1.0

15 / 10Introduction

The ISO 27000 family addresses security management required to deal with vulnerabilities through definedprocedures. This document outlines GlobalPlatform's implementation of those procedures. Independent of theurgency to deal with a vulnerability, it is important to treat it in a structured manner. Change management orincident response procedures should be considered to treat vulnerabilities, because they can provide guidanceon what to do considering prioritization, response time, response escalation, etc.
As a security standards organization, GlobalPlatform is committed to receiving and responding to reports ofpotential vulnerabilities in, for example, specifications, reference code, and reference documents.
The aim of this document is to define how GlobalPlatform accepts and manages the disclosure of vulnerability
on GlobalPlatform technology.

1.1

Audience

This document is intended primarily for the use of developers, vendors, evaluators, and users ofGlobalPlatform technology, GlobalPlatform members, and anyone that wants to disclose vulnerabilities toGlobalPlatform.

1.2

IPR Disclaimer

Attention is drawn to the possibility that some of the elements of this GlobalPlatform specification or other work
product may be the subject of intellectual property rights (IPR) held by GlobalPlatform members or others. For
additional information regarding any such IPR that have been brought to the attention of GlobalPlatform, please
visit https://globalplatform.org/specifications/ip-disclaimers/. GlobalPlatform shall not be held responsible for
identifying any or all such IPR, and takes no position concerning the possible existence or the evidence,
validity, or scope of any such IPR.

1.3

References

The table below lists references applicable to this specification. The latest version of each reference applies
unless a publication date or version is explicitly stated.
Table 1-1: Normative References
Standard / Specification

Description

RefISO 29147

Information technology — Security techniques —Vulnerability disclosure[ISO 29147]

ISO/IEC 27000

Information technology — Security techniques — Information
security management systems — Overview and vocabulary[ISO 27000]

ISO 30111

Information technology — Security techniques —Vulnerability handling processes[ISO 30111]

Copyright  2020 GlobalPlatform, Inc. All Rights Reserved.
The technology provided or described herein is subject to updates, revisions, and extensions by GlobalPlatform. Use of thisinformation is governed by the GlobalPlatform license agreement and any use inconsistent with that agreement is strictly
prohibited.

6 / 10

1.4

Vulnerability Disclosure and Mitigation Process – Public Release v1.0

Terminology and Definitions
Table 1-2: Terminology and Definitions

TermDefinition

ReporterExpert that notifies GlobalPlatform of a potential vulnerability

1.5

Abbreviations and Notations
Table 1-3: Abbreviations and Notations

Abbreviation / Notation

MeaningCD

Certification Director

CVSS

Common Vulnerability Scoring SystemED

Executive Director

PGP

Pretty Good Privacy

SIRT

Security Incident Response Team

SME

Subject-Matter Experts

TD

Technical Director

1.6

Revision History

GlobalPlatform technical documents numbered n.0 are major releases. Those numbered n.1, n.2, etc., areminor releases where changes typically introduce supplementary items that do not impact backward
compatibility or interoperability of the specifications. Those numbered n.n.1, n.n.2, etc., are maintenancereleases that incorporate errata and precisions; all non-trivial changes are indicated, often with revision marks.
Table 1-4: Revision History
DateVersion

Description

September

1.0

Public Release

Copyright  2020 GlobalPlatform, Inc. All Rights Reserved.
The technology provided or described herein is subject to updates, revisions, and extensions by GlobalPlatform. Use of thisinformation is governed by the GlobalPlatform license agreement and any use inconsistent with that agreement is strictly
prohibited.

Vulnerability Disclosure and Mitigation Process – Public Release v1.0

27 / 10Overview

The term “vulnerability disclosure” is used to describe the overall activities associated with receiving
vulnerability reports and providing remediation information.
Figure 2-1: Process Overview

ReporterTechnicalDirector

Secretariat

Send vulnerability
Acknowledge receipt

Vendor

SIRT

request scope
GP or product
If Product Vulnerability

Send results
OROROR

If GP Vulnerability – SIRT is created

Send results

2.1

ResultDevelopresolution

ReportingGlobalPlatform can receive or monitor for notification of potential vulnerabilities from various sources: internal
discovery, monitoring, public disclosure, or through a vulnerability reporting source.
Vulnerabilities should be reported by sending an encrypted email to vulnerability@globalplatform.org using thecurrent PGP public key for the vulnerability, available in the GlobalPlatform public web site athttps://globalplatform.org/specifications/vulnerability-disclosure/. Unencrypted plaintext email can be received,
but it is discouraged.
Initial receipt of the submission, via email, will be acknowledged within 72 hours.
The GlobalPlatform Secretariat sends an acknowledgement to the Reporter.
In order to ensure that GlobalPlatform will accept the vulnerability report, the Reporter should use the template
defined in Annex A to create the vulnerability report.

Copyright  2020 GlobalPlatform, Inc. All Rights Reserved.
The technology provided or described herein is subject to updates, revisions, and extensions by GlobalPlatform. Use of thisinformation is governed by the GlobalPlatform license agreement and any use inconsistent with that agreement is strictly
prohibited.

8 / 102.2

Vulnerability Disclosure and Mitigation Process – Public Release v1.0Preliminary Verification

The GlobalPlatform Secretariat requests the Technical Director to check if the vulnerability applies to
GlobalPlatform technology. In case of obvious product vendor vulnerability the secretariat may proceed directly
without Technical Director advice.
If the vulnerability applies to a specific product or implementation of GlobalPlatform technology in a product,
the report will be forwarded to the product’s vendor using the vendor’s vulnerability process. In this case thesecretariat will inform the Reporter that the vulnerability has been forwarded to the vendor and the incident isclosed.
If the vulnerability applies to a GlobalPlatform technology, a Security Incident Response Team (SIRT) will becreated with at least the Chair of the committee maintaining the affected specification, Security Task Forcechair, Executive Director (ED), a representative from the GlobalPlatform press agency, Technical Director, andCertification Director (CD).
The board will be informed of the creation of the SIRT and may nominate individuals from their ownorganizations to participate. Nominees who have experience with product security incident response orcybersecurity incident response are preferred. Nominees are expected to be incident managers, notSubject-Matter Experts (SMEs). They may happen to have both skillsets, but SIRT members are primarily
expected to contribute to incident response activities, not subject-matter consultation.
The group will elect a chair; this position may be also managed by the ED, CD, or TD.
The SIRT will use a common PGP Key to protect all information shared during incident management. If
possible, this key is not reused for incidents in different committees and is renewed every two years.
The first action of the SIRT is to assess the level of severity of the disclosure: None, Low, Medium, High, orCritical. If the level of severity of the disclosure is High or Critical, specific deviation of the current publication
rules (for example number or duration of review period) will be proposed to the board for agreement.

2.3

Remediation Development

The SIRT determines how the vulnerability can be remediated comprehensively, how to reduce the impact of
successful exploitation of the vulnerability, or how to reduce exposure.
During this phase, the need for technical consultation with specific work group participants is expected. In suchcircumstances, the SIRT needs to reach beyond their own membership into specific areas of expertise within
GlobalPlatform by consulting with appropriate work group participants. SMEs are expected to provide
consultation, not incident-response services. Such interactions will likely need higher levels of confidentiality
and sensitive handling beyond standard levels of confidentiality within the usual GlobalPlatform activities. The
SIRT chair then contacts that SME, informs the SME about the issue, explains the guidelines and constraints,
and then proceeds with consultation.
The Reporter may also be invited to participate during this remediation development phase.
Depending on the vulnerability, remediation may cover the following:• Development of the specification with a corrective solution• Affected feature moved to obsolete status• Archive of the specification• Publication of a Security Note to inform GlobalPlatform users

Copyright  2020 GlobalPlatform, Inc. All Rights Reserved.
The technology provided or described herein is subject to updates, revisions, and extensions by GlobalPlatform. Use of thisinformation is governed by the GlobalPlatform license agreement and any use inconsistent with that agreement is strictly
prohibited.

Vulnerability Disclosure and Mitigation Process – Public Release v1.0

9 / 10In the event that legal consultation or external expertise is needed, the SIRT chair will request approval ofexpenditure from Board Officers. Special considerations include emergency or time sensitive situations as
determined by the SIRT. Because events occur rapidly in an incident, the board may consider preauthorizing
some basic level of funding.
The SIRT should choose an appropriate date for public vulnerability disclosure and prepare the advisory withthe assistance of the product business division and other major stakeholders, such as legal, public relations,and external coordinators, if applicable. The vulnerability disclosure should align with when the remediation isavailable so that users can take the necessary action immediately.

2.4

ReleaseBased on the SIRT guidance, the GlobalPlatform Secretariat will publish the results in the GlobalPlatform
website and inform the Reporter of the incident outcome.

2.5

Post Release

The secretariat is responsible for ensuring that a report is created and provided to the board, to enable themto monitor the effectiveness of their vulnerability handling processes, including but not limited to the following
measurements:• Speed: The time it takes to address a vulnerability through this process and strive toward improving
the speed of vulnerability remediation. If the risk level of the vulnerability is high, the rapid remediationof the vulnerability can help to limit the damage spreading.
• Completeness: The completeness of the remediation, to ensure that it addresses the root cause of
the vulnerability. However, if urgency is required in order to address a vulnerability that is alreadybeing exploited, vendors may create a less complete remediation as a temporary measure, and thisshould be taken into consideration when monitoring this aspect of the vulnerability handlingprocesses.
• Effectiveness: The number of requests from GlobalPlatform users after the release of theremediation.

Copyright  2020 GlobalPlatform, Inc. All Rights Reserved.
The technology provided or described herein is subject to updates, revisions, and extensions by GlobalPlatform. Use of thisinformation is governed by the GlobalPlatform license agreement and any use inconsistent with that agreement is strictly
prohibited.

10 / 10Annex A

Vulnerability Disclosure and Mitigation Process – Public Release v1.0

Vulnerability Report Information

Include the following information in the Vulnerability Report:• Reporter's email• Short Description• Vulnerability Description (include vulnerability details and how to reproduce the issue)• The version label for the affected software or document• Vendor(s) known to be affected• Any known exploits• Attachments• Reporter's PGP public key (if not already known or if not already available via standard means)• Reporter's estimated CVSSv3 score and vector• Previously disclosed (Y/N – if Y, provide where & when)• Disclosure planned (Y/N – if Y, provide where & when)

Copyright  2020 GlobalPlatform, Inc. All Rights Reserved.
The technology provided or described herein is subject to updates, revisions, and extensions by GlobalPlatform. Use of thisinformation is governed by the GlobalPlatform license agreement and any use inconsistent with that agreement is strictly
prohibited.