Software security consultant Next Generation Security Software (NGSS) has severed ties with the federally funded CERT Coordination Center, accusing the non-profit organization of selling early access to vulnerability warnings long before vendor fixes are made available.

NGSS co-founder Mark Litchfield told internetnews.com it was "annoying" that CERT/CC gave early warning on six vulnerabilities to its paid sponsors before vendor patches were created and made available.

"The problem became apparent when the vendor we're working with on these vulnerabilities said they were contacted by government departments. CERT notified them ahead of patches being made available. We did not know about this policy to share this information with people who pay for that privilege," Litchfield argued.

He vowed NGSS would cut off the vulnerability warning clearinghouse from all future bug warnings until CERT/CC signs a binding non-disclosure agreement that it would not share early access with its paid sponsors.

At the center of the brouhaha is the Internet Security Alliance, a group that sponsors the operations of the CERT/CC. The alliance, a collaborative effort between Carnegie Mellon University's Software Engineering Institute (SEI), CERT/CC) and the Electronic Industries Alliance (EIA), provides paid members a portal for up-to-the-minute threat reports.

CERT/CC manager Jeff Carpenter confirmed the IS Alliance relationship but contends this is nothing new, noting that it's public knowledge that the Center shares information prior to public disclosure with trusted partners.

In fact, CERT/CC's disclosure policy, available on its Web site, makes it clear the Center would provide early warnings "to anyone who can contribute to the solution and with whom we have a trusted relationship". Those include vendors, community experts, CERT/CC sponsors, members of the Internet Security Alliance (including private sector organizations), and sites that are part of a national critical infrastructure.

"We're surprised NGSS would have a problem now. We released that disclosure policy more than two years ago and, before we released it, we spoke to all the vendors and gave the security community an opportunity to discuss it at length," CERT/CC's Carpenter said in an interview with internetnews.com.

Litchfield said NGSS did not know the IS Alliance pays as much as $70,000 to the CERT/CC to be a sponsor and charges $25,000 for full membership and $3,000 for associate membership. "This amounts to them profiting from our hard work. The fact that they're selling pre-disclosed vulnerability information to third parties is annoying. We don't profit from our own vulnerability discoveries. We're a small firm and we don't make money from it so why should they?"

Litchfield has been in touch with the Center in recent days to negotiate a non-disclosure agreement but he said CERT/CC was refusing to sign an NDA "because they claim their sponsors won't allow them to."

Carpenter confirmed the talks but declined to discuss specifics of his negotiations with Litchfield. However, he insists the Center isn't profiting from the IS Alliance relationship. "We feel strongly about our relationship with the Alliance. This is one of our ways to provide information on critical vulnerabilities ahead of the intruder community. We're not out to make money. We're using sponsorship funds from government and industry partners to help our mission."

"It's not wrong for system infrastructure administrators to be made aware of critical issues. They are exposed and the Internet community depends on them to maintain security. In some cases, it is correct that they get it (warnings) ahead of others," Carpenter said.

He said the purpose of keeping vulnerability information confidential was to give software vendors a chance to develop patches and give administrators a chance to defend their systems before intruder community becomes aware of it. "The alliance is one of our ways of trying to go in that direction. It's a non-profit organization with working groups doing a lot of lobbying on security-related issues," the CERT/CC manager said.

The IS Alliance's full membership includes big-name firms like Boeing , FedEx, Automatic Data Processing, Corio, Equant and the Harris Corporation.

For NGSS, an 11-employee firm that published 49 security alerts in 2002, Litchfield maintains the information should "never be shared" ahead of a vendor fix being made available. "We don't know who is getting these early warnings and, in most cases, they get these alerts before a patch is even available. We can't be a party to that," he argued.

He said NGSS had 28 advisories on hold, six of which CERT/CC was aware of. "We're waiting for fixes to be made available and now that we've cut ties with them, it means we will release the information ourselves through the normal channels," Litchfield said.The advantages of using the CERT/CC to issue security alerts is to get a wider distribution base. CERT/CC's mailing lists and vulnerability archives are acknowledged as the most comprehensive in the industry and Litchfield says the "door remains open" for NGSS to repair the relationship.

The quarrel between NGSS and CERT/CC again brings the issue of vulnerability disclosure to the front burner. The Internet security sector is polarized on how and when security alerts should be made available and CERT/CC's Carpenter said the industry continues to struggle with finding a comprehensive policy on how disclosures should be made.

"The problem is that you can't find any policy where there is consensus agreement. That's the biggest problem for the industry and I don't know there is an answer," he said.

Even if there is a government mandate, it won't stop the issue of people disagreeing with it. I don't see a short term solution to this polarization," Carpenter said, noting that the public discussion about vulnerability disclosure is a "diversion" to the real issue of vendors creating stable, reliable software products.

"It would help if we were able to get the vendor community to build secure software to avoid vulnerabilities in the first place. We should concentrate on working with the vendors to create better software. That's where the real issue is," Carpenter said.