Vulnerability Reporting
Communicating vulnerability findings through internal reporting, external disclosure, responsible disclosure programs, and compliance reporting requirements.
Understanding Vulnerability Reporting
Vulnerability reporting communicates findings to stakeholders who need to act. Internal reporting drives remediation, external disclosure protects users, and compliance reporting meets regulatory requirements.
Reporting contexts: • Internal reporting — To IT, management, risk owners • External disclosure — To vendors, public • Responsible disclosure — Coordinated with vendors • Compliance reporting — Regulatory requirements
The 2021 Microsoft Exchange vulnerabilities (ProxyLogon) demonstrated disclosure challenges. When Microsoft was notified, they had limited time before attackers began exploitation. Coordinated disclosure gave time for a patch, but the timeline was compressed by active attacks.
How and when you report can be as important as what you report.
Why This Matters for the Exam
Vulnerability reporting is tested on SY0-701 because communication drives action. Questions cover reporting audiences, disclosure types, and appropriate timing.
Understanding reporting helps with vulnerability management, compliance, and security program communication. Proper reporting ensures vulnerabilities get fixed.
The exam tests recognition of reporting types and appropriate practices.
Deep Dive
What Is Internal Vulnerability Reporting?
Internal reporting communicates findings within the organization.
Internal Audiences:
| Audience | Information Needs |
|---|---|
| IT Operations | Technical details, remediation steps |
| Management | Risk summary, resource needs |
| Risk Owners | Asset-specific findings |
| Compliance | Regulatory implications |
| Executives | Strategic risk overview |
Internal Report Contents:
Executive Summary: - Total vulnerabilities found - Critical/High count - Risk level change - Key recommendations Technical Details: - Vulnerability list by severity - Affected systems - CVE references - Remediation guidance Metrics: - Scan coverage - Mean time to remediate - Open vs closed vulnerabilities - Trend analysis
Reporting Frequency:
Immediate: - Critical vulnerabilities - Active exploitation - Compliance violations Regular: - Weekly/monthly scan summaries - Quarterly trend reports - Annual executive briefings Ad-hoc: - Penetration test results - Audit findings - Incident-related
What Is External Vulnerability Disclosure?
External disclosure shares vulnerability information outside the organization.
Disclosure Types:
| Type | Description | Use Case |
|---|---|---|
| Coordinated | Work with vendor before public | Standard practice |
| Full disclosure | Immediate public release | Controversial |
| Non-disclosure | Never disclose publicly | Internal only |
Coordinated Disclosure Process:
1. Discover vulnerability 2. Report to vendor privately 3. Allow time for patch (usually 90 days) 4. Coordinate disclosure timing 5. Publish after patch available 6. Credit researcher if desired Timeline: Day 0: Report to vendor Day 1-90: Vendor develops patch Day 90: Public disclosure (with or without patch)
Full Disclosure Arguments:
For: - Pressures vendors to fix quickly - Users can take protective action - Transparency Against: - Exposes users before fix - May enable attackers - Doesn't give vendor time
What Are Bug Bounty Programs?
Bug bounties incentivize external researchers to find and report vulnerabilities.
Bug Bounty Components:
| Component | Description |
|---|---|
| Scope | What can be tested |
| Rules | How to test safely |
| Rewards | Payment structure |
| Safe harbor | Legal protection |
| Disclosure | How findings are handled |
Bug Bounty Benefits:
For organization: - Additional testing capacity - Diverse perspectives - Pay-for-results model - Continuous testing For researchers: - Legal authorization - Financial reward - Recognition - Skill development
Bug Bounty Platforms:
- •- HackerOne
- •- Bugcrowd
- •- Synack
- •- Intigriti
What Is Responsible Disclosure?
Responsible disclosure balances public safety with vendor needs.
Responsible Disclosure Principles:
1. Report privately first 2. Provide reasonable time to fix 3. Don't exploit beyond proof 4. Work cooperatively 5. Disclose only after patch (or deadline)
Standard Timeline:
Industry standard: 90 days Google Project Zero: 90 days (strict) CERT/CC: 45 days (shorter) Timeline adjustments: - Active exploitation: Shorter - Complex fix needed: May extend - No response from vendor: May shorten
What Compliance Reporting Is Required?
Regulations may mandate vulnerability reporting.
Regulatory Requirements:
| Regulation | Requirement |
|---|---|
| PCI-DSS | Quarterly vulnerability scans, remediation tracking |
| HIPAA | Risk assessment including vulnerabilities |
| SOX | IT control testing including vulnerabilities |
| NIST | Continuous monitoring requirements |
Compliance Report Contents:
Typical requirements: - Scan date and scope - Vulnerabilities found by severity - Remediation status - Compensating controls - Exception documentation - Trend over time Retention: - Keep reports for audit period - Document remediation actions - Maintain evidence of fixes
What Are Reporting Best Practices?
Report Clarity:
Good vulnerability report includes: - Clear title/summary - Severity/CVSS score - Affected systems - Technical details - Reproduction steps - Impact statement - Remediation recommendation - References (CVE, advisories)
Audience Adaptation:
Technical audience: - Full technical details - CVE numbers - Exact versions affected - Exploit technique Executive audience: - Business impact - Risk rating - Resource requirements - Comparison to peers Compliance audience: - Regulatory mapping - Control effectiveness - Audit evidence - Remediation timeline
How CompTIA Tests This
Example Analysis
Scenario: A security researcher discovers a critical vulnerability in your company's customer-facing web application. Design a vulnerability disclosure and reporting process.
Analysis - Disclosure Process Design:
Scenario Details:
Vulnerability: SQL injection in login form Severity: Critical (9.8) Discoverer: External security researcher Impact: Potential access to customer database
Intake Process:
Receiving external reports: 1. Published security contact (security@company.com) 2. Security.txt file on website 3. Bug bounty program (optional) 4. Safe harbor statement Upon receipt: 1. Acknowledge within 24 hours 2. Assess severity 3. Assign to remediation team 4. Begin investigation
Internal Reporting:
| Audience | Timing | Content |
|---|---|---|
| Security team | Immediate | Full technical details |
| IT operations | Within 4 hours | Remediation guidance |
| CISO | Within 8 hours | Risk summary, response plan |
| Legal | Within 24 hours | Disclosure coordination |
| Executives | Within 48 hours | Business impact briefing |
Internal Report Template:
Title: Critical SQL Injection - Customer Portal Severity: Critical (CVSS 9.8) Discovered: [Date] by external researcher Summary: SQL injection vulnerability in login form allows unauthenticated access to customer database. Affected Systems: - www.company.com (Production) - staging.company.com Technical Details: - Parameter: username field - Payload: ' OR '1'='1 - Impact: Full database access Remediation: - Immediate: WAF rule blocking injection - Fix: Parameterized queries (dev in progress) - Timeline: Fix in 72 hours Status: Under active remediation
External Disclosure Coordination:
With researcher: Day 0: Receive report, acknowledge Day 1: Confirm vulnerability, thank researcher Day 3: Share remediation timeline Day 7: Update on progress Day 14: Patch deployed, validate Day 21: Coordinate public disclosure Communication: - Regular updates to researcher - Credit in advisory (if desired) - Bug bounty payment (if program exists)
Public Disclosure:
After patch deployed: 1. Publish security advisory 2. Notify affected customers 3. Credit researcher (with permission) 4. Update CVE if applicable Advisory contents: - Vulnerability description - Affected versions - Fix version/date - Acknowledgment - References
Key insight: Good disclosure is collaborative—acknowledge quickly, communicate regularly, remediate promptly, and credit researchers. This builds trust with security community and ensures vulnerabilities get fixed before exploitation.
Key Terms
Common Mistakes
Exam Tips
Memory Trick
- •Disclosure Types - "CFN":
- •Coordinated = Cooperate with vendor first
- •Full = Fast public release (controversial)
- •Non-disclosure = Never goes public
- •Coordinated Disclosure Steps - "RAPCD":
- •Report privately
- •Allow time for fix
- •Provide updates
- •Coordinate timing
- •Disclose with patch
- •Internal Report Audiences - "TORCE":
- •Technical teams (how to fix)
- •Operations (what's affected)
- •Risk owners (their assets)
- •Compliance (regulations)
- •Executives (business impact)
90-Day Rule: "90 days is standard for vendor response" After 90 days, disclosure may proceed
Bug Bounty Rule: "Pay Researchers, Protect Users" Financial incentive = more vulnerabilities found safely
Test Your Knowledge
Q1.A security researcher finds a vulnerability and reports it privately to the vendor, waiting 90 days before public disclosure. What type of disclosure is this?
Q2.What is the PRIMARY purpose of a bug bounty program?
Q3.Which vulnerability report audience needs business impact and resource requirements rather than technical CVE details?
Want more practice with instant AI feedback?
Continue Learning
Ready for the Exam?
See exactly where you stand on this concept and 182 others.
99% pass rate · Pass guarantee