Meta tags:
description=Coordinated, confidential vulnerability remediation for the open source software critical infrastructure depends on;

Headings (most frequently used words):

the, akrites, coordinated, vulnerability, open, and, shared, sirt, to, confidential, source, software, critical, infrastructure, on, from, discovery, response, how, of, technology, industry, patch, dedicated, together, remediation, for, depends, name, comes, akritai, byzantine, empire, frontier, guardians, who, stood, watch, where, threats, arrived, first, defenses, were, thinnest, has, outrun, defence, why, working, separately, makes, it, worse, security, incident, team, flows, through, program, information, is, protected, by, use, tlp, protocol, collective, resilience, an, letter, launch, effort, remediate, vulnerabilities, in, world, runs, reports, outpace, triage, signal, collapses, everyone, races, disclosure, duplicate, at, scale, maintainer, overload, pre, exposure, sector, blindness, one, front, door, does, relate, or, integrate, with, other, similar, efforts, hardened, coordination, premier, general, associate, commons, read, press, release, origin, problem, stronger, solution, question, upstream, confidentiality, framework, membership, join, us, stay, informed, about,

Text of the page (most frequently used words):
the (52), and (38), #upstream (10), akrites (9), open (9), software (8), sirt (8), reports (8), #vulnerability (8), critical (7), source (7), coordination (7), tlp (7), security (7), disclosure (7), from (7), same (7), infrastructure (6), patch (6), that (6), industry (6), one (6), maintainers (6), confidential (5), coordinated (5), access (5), depend (5), tools (5), findings (5), finding (5), vulnerabilities (5), join (4), problem (4), for (4), all (4), together (4), members (4), governing (4), board (4), cvd (4), response (4), case (4), team (4), can (4), have (4), framework (3), solution (3), foundation (3), about (3), vendors (3), participation (3), secure (3), end (3), with (3), working (3), projects (3), they (3), vince (3), centralized (3), incident (3), validates (3), cve (3), shared (3), finders (3), every (3), discovery (3), who (3), real (3), independently (3), effort (3), close (2), menu (2), linux (2), its (2), terms (2), membership (2), operators (2), their (2), commons (2), may (2), resources (2), dues (2), subject (2), program (2), management (2), runs (2), process (2), not (2), any (2), single (2), engineering (2), coordinate (2), groups (2), confidentiality (2), cost (2), priority (2), member (2), reporting (2), used (2), until (2), like (2), assist (2), deduplicates (2), coordinates (2), resolution (2), patching (2), leverages (2), standards (2), cwe (2), cvss (2), epss (2), ssvc (2), vex (2), dedicated (2), limited (2), during (2), triage (2), verification (2), protected (2), fix (2), held (2), red (2), remediate (2), face (2), predictable (2), partner (2), consistent (2), how (2), through (2), integrate (2), first (2), these (2), efforts (2), coordinating (2), gives (2), remediation (2), attackers (2), banks (2), know (2), what (2), hospitals (2), technology (2), pre (2), duplicate (2), exploitable (2), ones (2), organization (2), this (2), alone (2), makes (2), worse (2), scanning (2), which (2), too (2), five (2), frontier (2), depends (2), watch (2), name (2), read (2), letter (2), search (2), copyright, contributors, cookie, settings, policies, privacy, trademarks, stay, informed, inquire, building, defense, rely, offer, kind, compute, licenses, lieu, annual, approval, must, current, sign, agreement, nda, workspace, identity, tamper, evident, audit, neutrally, operated, level, fund, group, invited, discretion, participate, charter, recognized, foundations, associate, named, transparency, briefings, future, forums, organizations, want, help, but, cannot, commit, large, general, eligible, nomination, platforms, premier, collective, resilience, report, issues, github, private, covers, parties, artifacts, gatekeeps, along, phases, engagement, bundles, strong, controls, mfa, monitoring, analyst, workbench, provided, via, virtual, machines, isolated, enclaves, perform, analysis, poc, pov, creation, hardened, information, use, protocol, enter, window, publishes, original, namespace, engineers, prepare, test, material, merges, duplicates, into, severity, assigns, ownership, vendor, surfaces, start, visible, only, synchronized, deduplicate, validate, intake, follows, path, get, embargo, handling, flows, provides, facility, easily, external, such, glasswing, mitre, lightwell, been, focused, focuses, those, accepting, programs, does, relate, other, similar, question, running, standardized, hundred, independent, front, door, stakeholders, structured, place, across, pace, assisted, now, operate, neither, learns, share, dependency, fire, sector, blindness, additional, party, knows, unpatched, raises, odds, leak, tooling, enables, anyone, find, most, should, treated, immediately, public, knowledge, exposure, flood, low, quality, buries, burns, out, people, maintainer, overload, many, users, cloud, providers, researchers, scan, packages, file, scale, solve, acting, why, separately, stronger, risks, racing, overwhelming, exposing, everyone, races, often, waste, time, trying, sift, volumes, identify, confident, noise, some, ignore, generated, entirely, missed, signal, collapses, availability, models, means, popular, library, receive, described, different, ways, reporters, week, outpace, moved, serious, weeks, expert, minutes, automated, defenders, adapt, has, outrun, defence, modern, everything, standing, alongside, long, fittingly, root, word, exactly, exists, defend, comes, akritai, byzantine, empire, guardians, stood, where, threats, arrived, defenses, were, thinnest, origin, launch, world, press, release, skip, main, content,

Text of the page (random words):
akrites patch the commons together skip to main content search close search menu problem solution upstream framework join coordinated confidential vulnerability remediation for the open source software critical infrastructure depends on read press release an open letter from the technology industry and the launch of akrites a coordinated effort to remediate vulnerabilities in the open source software the world runs on read open letter origin the name comes from the akritai the byzantine empire s frontier guardians who stood watch where threats arrived first and defenses were thinnest in modern software that frontier is upstream the open source projects everything depends on akrites is the industry standing that watch together alongside the maintainers who have held it alone for too long fittingly the root of the name is the same word that gives us critical which is exactly the software this effort exists to defend the problem discovery has outrun defence ai security tools have moved the cost of finding serious software vulnerabilities from weeks of expert effort to minutes of automated scanning the defenders of open source software have to adapt reports outpace triage the availability of models means a popular library can receive the same vulnerability described five different ways from five reporters in one week signal collapses maintainers often waste time trying to sift through volumes of reports to identify which is a real exploitable finding from confident ai noise some ignore ai generated reports entirely so real ones may be missed too everyone races to disclosure every organization scanning the same software independently risks racing to disclosure overwhelming maintainers and exposing pre patch findings to attackers stronger together why working separately makes it worse no single organization can solve this alone acting independently makes the problem worse duplicate discovery at scale many end users cloud providers security researchers and security vendors scan the same packages and file the same findings independently maintainer overload a flood of duplicate and low quality reports buries the real exploitable ones and burns out the people we depend on pre patch exposure every additional party who knows about an unpatched vulnerability raises the odds of a leak ai tooling enables anyone to find the same vulnerabilities and most vulnerabilities should be treated as immediately public knowledge sector and technology blindness banks know what banks depend on hospitals know what hospitals depend on neither learns they share a critical dependency until it is on fire the akrites solution a shared security incident response team sirt akrites gives critical infrastructure stakeholders a confidential structured place to coordinate vulnerability discovery remediation and disclosure across the open source projects they depend on at the pace ai assisted attackers now operate one front door upstream maintainers face a coordinated predictable partner running one standardized cvd process not a hundred independent reports a shared dedicated sirt a centralized security incident response team validates and deduplicates findings coordinates resolution and upstream patching leverages industry standards and tools cve tlp cwe cvss epss ssvc vex vince question how does akrites relate to or integrate with other similar industry efforts akrites provides a consistent centralized coordination facility that can easily integrate with external finders such as glasswing mitre cve lightwell first and the like these efforts have been focused on the finding of security vulnerabilities akrites focuses on coordinating the disclosure of those findings and can assist by accepting and coordinating reports from any of these programs upstream how a vulnerability flows through the program every finding follows the same path so upstream maintainers face one predictable partner and members get consistent embargo handling 1 intake 2 deduplicate validate 3 remediate 4 synchronized disclosure a member or its vendor surfaces a finding to the sirt it is tlp red from the start visible only to the case team the sirt merges duplicates into one case validates severity and assigns ownership maintainers and or industry engineers prepare and test the fix held as tlp red case material upstream enter one cvd window the fix publishes to the original namespace at disclosure confidentiality framework critical vulnerability information is protected by use of the tlp 2 0 protocol hardened infrastructure isolated secure enclaves to perform vulnerability analysis poc pov verification and patch creation analyst workbench provided via secure virtual machines protected by strong access controls mfa and monitoring access to vulnerability reports limited to finders during triage verification access to patch bundles limited ot finders and sirt during coordination disclosure tlp gatekeeps access along all phases of engagement a shared dedicated sirt a centralized security incident response team validates and deduplicates findings coordinates resolution and upstream patching leverages industry standards and tools cve tlp cwe cvss epss ssvc vex vince confidential coordination cvd tools like vince used to assist in coordination case management tlp covers all parties and artifacts until pd confidential reporting tools used to report issues upstream e g github private reporting membership coordinated response collective resilience premier critical infrastructure operators and the vendors and platforms they depend on priority sirt coordination eligible for governing board nomination general organizations that want to help but cannot commit large engineering resources participation in future forums and working groups priority access to member briefings named participation in transparency reports associate recognized open source foundations and projects at no cost participate subject to charter and confidentiality terms invited by governing board at their discretion to coordinate with working groups foundation level dues fund coordination not any single group s engineering the neutrally operated sirt that runs the cvd process end to end secure workspace identity and tamper evident audit infrastructure governing board coordination and program management members may offer in kind compute ai resources or licenses in lieu of dues subject to annual governing board approval all members must be current linux foundation members and sign the participation agreement and nda join us patch the commons together join critical infrastructure operators and their vendors in building a confidential coordinated defense for the open source software we all rely on inquire about membership stay informed about akrites copyright the linux foundation and its contributors trademarks privacy terms policies cookie settings close menu problem solution upstream framework join