# Automotive Vulnerability Disclosure: Stakeholders, Opportunities, Challenges
## 4 Disclosure and Usage of Automotive Vulnerability Information
### The Automotive Strategy for Vulnerability Disclosure  
The benefits of a vulnerability disclosure program, as well as its special role with regard to the automotive-specific challenges, have already been discussed in Sections 2 and 3. The orientation towards standard patching times from IT is not recommended for the automotive sector, nor is the application of strict deadlines for the patching process (grace periods). A major uncertainty factor for the definition of generally valid grace periods is the complex horizontal and vertical supplier structure within the automotive industry and occasionally long communication channels. The enormous safety criticality as well as a lack of empirical values for appropriate patching times for vulnerabilities in vehicles require a more careful handling of disclosure. In addition, careful security tests or type approval renewals may be necessary for patches. The time required for such a renewal can neither be estimated in advance nor directly influenced by the manufacturer. Also a time estimate of patch distribution is still problematic today (over-the-air-update technology is hardly widespread), as is the reliable implementation of patches in the target system. Instead of providing a finder concrete information on the patching time in the disclosure policy, transparency should be better achieved by specifically pointing out special challenges in the automotive sector. Broadly recognized and comprehensible criteria for the initial assessment of patching and grace periods in relation to vulnerabilities and their event-triggered adjustment in the course of the disclosure process must be defined jointly (see Section 7). Furthermore, predefined plans for escalation management (e.g., involvement of an independent coordinator) and criteria for triggering them should be agreed. For type approval for their cars, OEMs must prove the existence and suitability of processes, which serve to detect vulnerabilities and attacks and react appropriately. In addition, OEMs have to prove processes, which serve to provide relevant data to support the analysis of attacks. OEMs not only have a special role in the disclosure of reported vulnerabilities. It is also up to them to identify risks (e.g., non-existent processes) from suppliers and service providers and to prove their compliance with existing regulation.  
The disclosure strategy the ISO/IEC 29147 [15] proposes is shown in Figure 1. It shows the dependencies of all parties involved in the process. The finder remains passive and outside after the report has been submitted. A continuous communication in the sense of coordinated disclosure and the associated transparency cannot take place. A process as it is propagated for the automotive sector is hinted by the three thickly drawn bidirectional arrows, which are added to the original image. Thus, this adapted approach is qualitatively in alignment with the FIRST approach for multi-party coordinated disclosure [51], which focuses on the well-being of the customer as the highest good to be protected.