Should people should be allowed to test cyber-security constraints of a company’s products or services without upfront approval from that company? Views were split when the cyber security product company Tripwire asked attenders of the RSA Conference in San Francisco last month. Half, 50 percent believed they should not be allowed and 49 percent said they should be.
When asked what’s a reasonable amount of time for allowing a vendor to fix a vulnerability before full public disclosure, 32 percent selected the shortest option of 60 days, followed by 25 percent who said public disclosure does not need to wait on a vendor fix. The survey of 147 at the RSA event asked about experiences in receiving vulnerability reports. Some 36 per cent said that their organisation has received an unsolicited vulnerability report, while about half (53 per cent) said their organisations have an official channel where external security researchers can easily submit vulnerabilities found in their products or services. A quarter (24 per cent) said their organisation has been the target of an extortion scheme related to the release of vulnerability details.
For details on the findings visit: https://www.slideshare.net/Tripwire/most-rsac-attendees-favor-shorter-vulnerability-disclosure-timelines.
Comment
Laurie Mercer, solutions engineer at HackerOne, said: “Most companies (94 per cent of the Forbes Global 2000) do not have a published vulnerability disclosure policy. Of the 28 states of the European Union, only three have a policy on responsible disclosure. This has led to a situation where nearly one in four security researchers have not reported a vulnerability that they found because the vulnerable organisation didn’t have a channel to disclose it (HackerReport). Many more researchers have reported vulnerabilities and heard nothing back, often because the reports are lost for weeks and months in a helpdesk system or in a sales and marketing queue. Receiving and responding to unsolicited security reports does not need to be painful. In fact, responsible disclosure can help make the internet safer for everyone.
“The US-based National Institute of Standards and Technology recently recommended processes be established to receive, analyse and respond to vulnerabilities disclosed from internal and external sources, including unsolicited reports from security researchers. The European Union is also considering how to standardise responsible disclosure under the new Cybersecurity Act. In fact, some would argue that it is riskier to deny, ignore or discourage responsible disclosure of unsolicited security vulnerabilities. If one sees a suspicious package in a train station, it is one’s responsibility to report it – why should it be different for online services?
“In an ideal world, if a responsible researcher finds a security vulnerability, they would be able to securely and responsibly report it to a security team, who would respond, triage and coordinate the remediation activities. Vulnerabilities would only be publicly disclosed if and when both parties were in mutual agreement, normally after vulnerable systems have been patched. This relies on organisations having defined and rehearsed processes for receiving and managing vulnerabilities from the outside.”
