ProductSecurity Incident
Response Team(PSIRT)

2

Executivesummary
Ericsson Product Security Incident ResponseTeam (PSIRT) is responsible for the Ericsson
product vulnerability management process and thecoordination of customer product security incidents
affecting Ericsson products, solutions, and services.
PSIRT is focused on the identification, assessment,
and disposition of the risks associated with Ericsson
products. PSIRT is involved when secure products aredeveloped and used.
PSIRT actively collects vulnerability information fromvarious sources and informs product developmentof its findings. Product development evaluates therelevance of a vulnerability and develops plans on
how that vulnerability can be addressed. This leads toa better understanding of the security posture of eachproduct version.
PSIRT assists the customer units to make sense ofvarious security questions and prepare an informed
response to resolve security issues. This is often done
via the customer service request processes or lessformal means, such as emails or news postings.
To be able to respond effectively to any productsecurity incident, processes and experience must be
put in place beforehand in a very similar way to otheremergency or crisis management processes, and thisis when PSIRT steps into the picture. Sometimes it
may involve collecting the right team and delivering
the solution in time. On other occasions, it may requirearranging access to the site and securing the evidence.

Ericsson | Product Security Incident Response Team (PSIRT)Ericsson | Product Security Incident Response Team (PSIRT)

3

4

Ericsson | Product Security Incident Response Team (PSIRT)

Introduction

Modern telecom networks are a complex
part of the critical infrastructure of ourdigital society. Security of the networks
is essential for keeping critical services
available and reliable. Unfortunately,
seamlessly secure networks rarely exist,
and security must be considered fromthe initial steps of product development
until the end of the product’s life cycle andeven further in the life cycle management
processes.
Almost any modern software consistsof free open source and third-party
components, so does software innetworks. Therefore, processes ofmonitoring authenticity and securityof the used third-party software andhardware are an increasingly importantpart of product security.

suspects that an Ericsson product has avulnerability that could be exploited, oran Ericsson product has fallen victim toa cyberattack, PSIRT takes the lead toinvestigate the situation and if needed,mitigate the incident.
PSIRT is a centralized team in theEricsson CTO office. Centralized security
expertise ensures that Ericsson can
proactively address security issues, handlequestions or incidents, and effectivelyrespond. The efficient handling of anincident, especially if it involves sensitive
information, benefits from a single
point of contact (SPoC), which ensurescoordination and effective flow ofinformation.

PSIRT was established in 2004 andwas accredited by Trusted Introducer(GEANT/TF-CSIRT) in 2005. PSIRT isEnsuring the security of software ina full member of FIRST, a global Forumthe highly dynamic and ever-changingof Incident Response and Security
security landscape is a continuous andevolving process. PSIRT has a central role Teams, since 2006. PSIRT is active in
co-operation with international Computerin this at Ericsson.
Emergency Response Team (CERT)
communities, vendors, and many telecom
Regular risk assessments, technicalvulnerability assessments, and systematic operator Computer Security Incident
Response Team (CSIRT) teams. PSIRT
vulnerability management are a crucial
also works with the ETIS community ofpart of what Ericsson does to protect
against security incidents. When someone telecom professionals.

Ericsson | Product Security Incident Response Team (PSIRT)

5

6

Ericsson | Product Security Incident Response Team (PSIRT)

01

Main operationsof PSIRTPSIRT has two major operations: Vulnerability
management and incident response. PSIRT also works
closely with the internal Security Reliability Model (SRM)
processes. PSIRT has a dedicated subteam to answer
all customer service requests when it comes to security
related questions. That guarantees the seamless flowof product security related information in the customer
support organization.
Vulnerability Management
PSIRT’s one main area of responsibility
is providing a proactive vulnerability
management service for productdevelopment units throughout thecompany. In a large and dynamicallychanging codebase, managing
vulnerabilities is a delicate and complex
task. Accurate and timely coordination
between the vulnerability information
sources, product development, customer
support, customers—and on occasion,
executives and public relations—is handledby PSIRT. Awareness building acrossthe company on current and upcoming
security phenomena related to productdevelopment is on the task list of PSIRT
as well (for example through the Security
Masters program).

Vulnerability
monitoring

PSIRT alert

PDU analysis

Upon receiving a security alert, theproduct development unit will analyze thevulnerabilities listed in the alert and initiate
a procedure for remediation. According
to the global process, the productdevelopment unit responds witha mitigation plan and timeline.
The process described above issupported by an in-house vulnerability
management system, which allows PSIRT
to accurately map new vulnerabilities tothe Ericsson portfolio.
PSIRT is using open industry standards
in the vulnerability management process.
These are CVE (Common Vulnerabilitiesand Exposures) for identification ofvulnerabilities, CPE (Common PlatformEnumeration) for structured naming of
open source and commercial software,

PDU response

Resolutiona &communication

Figure 1: PSIRT vulnerability management process (PDU = Product Development Unit)

Ericsson products use various thirdparty components, both open source andcommercial. When a new vulnerability
could potentially affect an Ericsson product,
PSIRT makes an initial vulnerability
analysis and creates a security alert thatis then sent to relevant security contactsof the product development unit. Everyyear, PSIRT processes thousands ofvulnerabilities, and a subset of thesevulnerabilities result in security alerts being
created for the product development units.

and CVSS3 (Common Vulnerability
Scoring System v3) for presenting
the overall vulnerability impact andseverity. CVE system is maintained by
MITRE organization, while CPE scheme
is maintained by NIST (U.S. National
Institute of Standards and Technology).
FIRST organization (Forum of Incident
Response and Security Teams) isresponsible for CVSS3 specification.

Ericsson | Product Security Incident Response Team (PSIRT)

Incident Response
PSIRT acts as a single point of contact– for internal and external queries – whenit comes to product security matters. In
general, PSIRT will coordinate a responseto any question related to the security ofthe Ericsson product portfolio.
The benefits of having a centralized
incident response unit are clear. PSIRT’sability to reach the product owners, thesecurity contacts and senior management

7prevents the information from getting
lost between the cracks. Constantcommunication with other internal security
organizations is also guaranteed throughwell-established processes and procedures.
If an event is categorized by any
stakeholder as a security or privacy
incident and involves Ericsson products,
PSIRT will ensure that the case isinvestigated appropriately.

PSIRT defines an event as a product security incident if the following conditions are met:
1. The event is categorized by any stakeholder
as a security incident

Figure 2: Definition of a product security incident

2. The event involves Ericsson products,solutions, or 3PPs provided by Ericsson

8Ericsson | Product Security Incident Response Team (PSIRT)

02

PSIRT incident
handling process
PSIRT’s incident handling process follows industry
best practices based on NIST SP800-61 (Computer
Security Incident Handling Guide) and ISO/IEC 27035(Security Techniques—Information Security IncidentManagement) and is aligned with SANS Incident
Handler’s Guidebook.

All security incidents are managed
according to the incident handling process
depicted in Figure 3. In the triage phase,
PSIRT ensures that the reported event isclassified as a product security incident,
urgency and criticality of the issue areidentified and it is prioritized accordingly.
At the start of the investigation phase, theinvestigation team is set up depending on
the nature of the case, all major functions
and departments (Crisis Management,Group Communications, Group Security,

TriageInvestigation

under investigation. Once the systems aresuccessfully recovered and adequatelysecured, the learnings from the investigation
are shared with all concerned parties toavoid similar incidents in the future and toimprove Ericsson’s product security. PSIRTalso uses the findings and lessons learned
from these investigations to improve its own
processes. The order of activities undertaken
in each step depicted in Figure 3 can vary inreal investigations due to the diverse natureof incidents handled by PSIRT.

Containment,
eradication,and recovery

Post-incident
activity

Figure 3: PSIRT incident handling processIT Security) are involved if necessary.
PSIRT also ensures that the coordination
is effective and business owners anddecision makers are aware of the situation.
Special attention is paid to collecting andpreserving as much evidence as possible.
The investigation team then proceeds
to determine the scope of security andprivacy impact based on the collectedbody of evidence. Containment efforts
are started immediately after the impact
analysis to avoid further damage andto deter malicious actors. A root cause
analysis is done in parallel to devise both ashort-term and long-term recovery plan toeradicate the threat and secure the systems

External vulnerability disclosures
Ericsson has a responsible disclosure
policy, through which PSIRT acts as a single
point of contact for security researchers
external to Ericsson if they discover avulnerability in an Ericsson product orservice. PSIRT’s vulnerability disclosure
policy and ways of working are based on
ISO/IEC 29147 standard.
Vulnerability disclosures handled by
PSIRT vary in complexity. An active dialog
between Ericsson and the researcher in suchcases is essential to resolve the reported
vulnerabilities. Therefore, PSIRT internally
coordinates the technical resolution ofreported vulnerability while ensuring that

Ericsson | Product Security Incident Response Team (PSIRT)

communication with the researchers is inplace during the whole process, from thepoint of informing Ericsson to the point
where a fix is delivered.
Product support for customers
PSIRT also has an important role in theEricsson global support and engineeringtask force that provides customer support
on product related questions. Customer
questions that are related to security or03

9

privacy can be assigned from any place inthe world into the PSIRT security support
queue. These support requests are further
analyzed and resolved in cooperation withthe best security experts from productdevelopment and PSIRT. Customer
requests may be related to hardeningor configuration aspects, as well as thesecurity status of software components
used in Ericsson products.

Feedback loop
for continuous
improvement
In a large company like Ericsson, having
established processes is key. Quality
supports security, but it cannot exist
without an efficient feedback process from
customers and product development teams.
From a security perspective, PSIRT ensuresthe effectiveness of this feedback loop.
When it comes to vulnerability
management, PSIRT is automaticallypart of the process flow, from alertingto validating the alert answers sent by
the product development units. Thevulnerabilities have typically been
estimated and scored by external security
researchers to reflect their impact andrelevance. Translating this estimate to thetelecom context is challenging and requires
an understanding of the context where theproducts will be deployed. PSIRT supports
this learning process by giving feedback to
product development based on extensive
experience in the field.

As part of PSIRT’s incident handlingand vulnerability management capabilities,
PSIRT is available to answer customer
service requests in cases of security
concerns. This ensures that Ericsson activelylearns from different threats and concernspresented by customers.
Moreover, PSIRT actively contributes toother security assurance processes such as
risk assessments and technical vulnerability
assessments. PSIRT supports productdevelopment units and assists with theimplementation of Ericsson’s internal SRM
by providing guidance on how to perform asolid vulnerability test and produce robust
hardening guidelines.
PSIRT is composed of experienced, welltrained security specialists and the work is
all about ensuring that network products
developed by Ericsson are secure today andwill remain secure in the future. Challenges
of complexity and continuous change are
the bread and butter for PSIRT and aredealt with daily.

Ericsson enables communications service
providers to capture the full value ofconnectivity. The company’s portfolio spans
Networks, Digital Services, Managed Services,and Emerging Business and is designed to help
our customers go digital, increase efficiency
and find new revenue streams. Ericsson’s
investments in innovation have delivered thebenefits of telephony and mobile broadband
to billions of people around the world. The
Ericsson stock is listed on Nasdaq Stockholm
and on Nasdaq New York.

Ericsson.com

The content of this document is subject
to revision without notice due tocontinued progress in methodology,
design and manufacturing. Ericssonshall have no liability for any error ordamage of any kind resulting from theuse of this document

1/287 01-FGB 1010955© Ericsson AB 2022