# Automotive Vulnerability Disclosure: Stakeholders, Opportunities, Challenges
## 1 Introduction  
In industries like IT or sectors of critical infrastructure, which have had to deal with cybersecurity for a long time, the awareness of responsible handling of vulnerabilities found in the field has only grown over many years. According to a study from 2007 [1], vulnerability reports for software vendors correlated noticeably with their stock value and major incidents caused an average market value loss of approx. 0.6% in cases investigated. However, it should also be mentioned that the failure to fix a vulnerability within given time limit led to even higher losses. Compared to a decade earlier, there is a high degree of transparency in the IT industry, for example through publicly accessible databases of fixed and disclosed vulnerabilities (e.g., National Vulnerability Database- NVD [2]) and, last but not least, bug bounty programs. In contrast to the general IT landscape, automotive industry is still in the early stages of this transformation. However, some automobile manufacturers take the lead and are, for example, already successfully represented on platforms such as HackerOne and Bugcrowd (see Section 2 Vulnerability Disclosure). In the first two years after starting a disclosure program, GM was able to eliminate 700 vulnerabilities and establish a network of 500 white-hat hexes [3]. Other manufacturers carry out vulnerability disclosure (VD) programs on their own account and independently of such platforms (BMW, Mercedes-Benz, Bosch, Continental, Siemens, etc.). The automotive industry faces very special challenges due to the strict requirements of functional safety related subsystems like braking or advanced driver assistance systems, as well as extraordinarily long product lifetimes (in Germany as of 2014 18 years on average) [4]. This requires the continuous preservation of a high level of vehicle security in road traffic over decades of strong technological change. According to [5], about half of all newly delivered vehicles are equipped with external connectivity capabilities. Modern carscontain two to five times as many lines of code as a standard PC operating system, and up to seven times as much as many passenger aircrafts (100 million) and, thus, provide ample opportunity for security gaps. With development towards a higher degree of connectivity (e.g., fleet management, update-over-the-air, V2X, cloud services), exploitation of a local vulnerability in a single vehicle or backend server can quickly scale to a global fleet. In addition, there is a particular complexity, especially in the vertical supply chain, which makes rapid vulnerability management considerably more difficult compared to many general IT products. Due to great potential threat to drivers or even public safety, handling of vulnerabilities in connected vehicles is even more challenging [6]. Regulatory authorities around the world have recognized these ever-increasing challenges. In January 2021, the two UN regulations on Cybersecurity and Cyber Security Management Systems [7] and on Software Updates and Software Updates Management Systems [8] entered into force. They are the first ever internationally harmonized and binding norms in the area of cyber security and the broad adoption of these regulations across the world is expected [9]. The upcoming ISO/SAE 21434 standard [10] is intended to support the implementation of measures to comply with the UNECE regulation [7]. It is already in the status of formal approval since March 2021. Since the two regulations are also highly relevant with regard to the Coordinated Vulnerability Disclosure, they will be dealt with specifically in the following. In order to obtain type approval according to UN regulation, vehicle manufacturers must prove by means of document checks that they have appropriate measures in place with regard to cyber security for all phases of the product life cycle. The proof obligation on the one hand covers processes, responsibilities and governance to treat cyber risks (e.g., Cyber Security Management System (CSMS)).