Learn in the textbookReporting Systems and Public Support Organizations
DefinitionThe Vulnerability-Related Information Reporting System (脆弱性関連情報届出制度) lets anyone who discovers a vulnerability (a security weakness) in a software product or website report it to IPA.
ExplanationJPCERT/CC (JPCERT Coordination Center) handles incident response and the coordination of vulnerability information in Japan, and acts as the go-between with the developer for software product reports. When coordination on a product is finished, the weakness and its fix are published on JVN, a vulnerability countermeasure portal run jointly by JPCERT/CC and IPA. For a weakness in a website, IPA notifies the site operator and urges them to fix it.
AnalogyIt is like someone who spots a defect in a household appliance telling a contact point before spreading rumors, with users informed only once the maker has arranged a fix.