# Automotive Vulnerability Disclosure: Stakeholders, Opportunities, Challenges
## 5 Conclusions  
In this paper, the implementation of VD in the automotive environment is discussed. Potentials and challenges for their implementation are specified. In Sections 1 and 2, the development of VD and the resulting findings from the IT environment are highlighted. Based on decades of experience and further development in IT, conclusions can be drawn for the automotive sector. The special conditions and challenges in this environment, which are also named and discussed are taken into account. In Section 3, pleasant and unpleasant practical examples from the automotive environment are considered and existing opportunities and challenges are reflected. In Section 4, the authors discuss the key areas of activity within the industry regarding vulnerability management and especially  
Figure 2: Overview of the phases of automotive vulnerability disclosure from a process and technical perspective.  
vulnerability disclosure. Furthermore, roles and requirements of various potential stakeholders in the automotive environment are discussed and potentials for improvement are identified. The responsible disclosure, as well as the public handling of vulnerabilities in IT (NVD, CVE, etc.) gained importance in the last 8 years. Such a development is also to be expected for the automotive industry and has already begun. A growing public awareness of the vehicle as a potentially vulnerable target will reinforce this development. A study from 2007 suggests that an open approach to vulnerabilities and their announcing but also their fixing has an impact on the monetary value of companies. In addition, current regulations, as well as government and industry associations (e.g., EU, UN, AUTO-ISAC) are increasing the pressure on manufacturers to implement measures to maintain security in the post-production phase. Vulnerability management measures and, in particular, VD processes are essential components for meeting the given challenges. In recent years, the public visibility of vulnerabilities, as measured by reserved CVEs, is also increasing. VD programs are now widespread among OEMs, but they still can learn from IT in designing a VD process, draw on mature technical protocols and platforms for information exchange (vulnerability description, sharing platforms, public databases), vulnerability assessment schemes, and mature processes for responsible disclosure. However, adaptions are needed due to specifics of their industry. This is the enormous relation to the safety of their products, the advancing autonomization and connectivity, significantly longer product life cycles, complex supplier structures, as well as a more difficult patch dissemination according to today's state. The timing of processes should therefore take particular account of potentially highly sensitive, life-threatening vulnerability information (grace periods). In addition, the will and capability of manufacturers for joint efficient vulnerability management, both internally and externally, should be built. Efforts should be intensified to exploit the hacker scene and its noteworthy value in maintaining security in the post-production phase. Essential to this is the benefit of an appropriate disclosure policy to eliminate existing legal uncertainty and create transparent disclosure processes. Different concepts of handling VD were discussed and finally Coordinated Disclosure was identified as the most target-oriented for the automotive environment. To achieve sufficient patch dissemination, OTA updates are important.