2. Principles of Coordinated Vulnerability Disclosure

Change your opinions, keep to your principles; change your leaves, keep intact your roots.
– Victor Hugo

Over the years, the CERT/CC has identified a number of principles that guide our efforts in coordinating vulnerability disclosures and which seem to be present in many successful CVD programs. These principles include the following:

• Reduce Harm
• Presume Benevolence
• Avoid Surprise
• Incentivize Desired Behavior
• Ethical Considerations
• Process Improvement
• CVD as a Wicked Problem

We cover each of these in more detail below.