GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | ||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | ||
GeezerVison is showing en.wikipedia.org — Vulnerability disclosure - Wikipedia (Redirected from Full disclosure (computer security))
In information security, vulnerability disclosure is a process where independent researchers discover flaws in software that can be abused to cause unintended behaviour; these flaws are called vulnerabilities. The process by which the analysis of these vulnerabilities is shared with third parties is the subject of much debate, and is referred to as the researcher's disclosure policy. TypesCoordinated vulnerability disclosureCoordinated vulnerability disclosure (CVD), previously known as responsible disclosure, is a policy under which researchers agree to report vulnerabilities to a coordinating authority, which then reports it to the vendor, tracks fixes and mitigations, and coordinates the disclosure of information with stakeholders including the public.[1][2][3][4] In some cases the coordinating authority is the vendor. The premise of coordinated disclosure is typically that nobody should be informed about a vulnerability until the software vendor says it is time.[5][6] While there are often exceptions or variations of this policy, distribution must initially be limited and vendors are given privileged access to nonpublic research.[7] Developers of hardware and software often require time and resources to repair their mistakes. Often, it is ethical hackers who find these vulnerabilities.[4] Hackers and computer security scientists have the opinion that it is their social responsibility to make the public aware of vulnerabilities. Hiding problems could cause a feeling of false security. To avoid this, the involved parties coordinate and negotiate a reasonable period of time for repairing the vulnerability. Depending on the potential impact of the vulnerability, the expected time needed for an emergency fix or workaround to be developed and applied and other factors, this period may vary between a few days and several months. The original name for this approach was "responsible disclosure", based on the essay by Microsoft Security Manager Scott Culp “It's Time to End Information Anarchy”[8] (referring to full disclosure). Microsoft later called for the term to be phased out in favor of “Coordinated Vulnerability Disclosure” (CVD).[9][10] Although the reasoning varies, many practitioners argue that end-users cannot benefit from access to vulnerability information without guidance or patches from the vendor, so the risks of sharing research with malicious actors is too great for too little benefit. As Microsoft explain, "[Coordinated disclosure] serves everyone's best interests by ensuring that customers receive comprehensive, high-quality updates for security vulnerabilities but are not exposed to malicious attacks while the update is being developed."[10] In September 2020 the US Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive 20-01. It required each federal executive branch agency to develop and publish a vulnerability disclosure policy within 180 days. Each policy had to set out which systems were in scope and how reports should be submitted. It also had to commit the agency not to recommend or pursue legal action over security research that the agency considered a good-faith effort to follow the policy.[11] Coordinated vulnerability disclosure may fail to satisfy security researchers who expect to be financially compensated. At the same time, reporting vulnerabilities with the expectation of compensation is viewed by some as extortion.[12][13] Some organizations like Google have set up a bug bounty program to reward reporting vulnerabilities through proper channels.[14] Under the Cyber Resilience Act, manufacturers of products with digital elements have been required since 11 September 2026 to report actively exploited vulnerabilities and severe security incidents affecting their products. They must give an early warning no later than 24 hours after becoming aware of the problem, a full notification within 72 hours and a final report on an exploited vulnerability within 14 days of a fix becoming available. Notifications are submitted through a single reporting platform set up by ENISA.[15] With deadlinesTo prevent vendors to indefinitely delaying the disclosure, a common practice in the security industry, pioneered by Google,[16] is to publish all the details of vulnerabilities after a deadline, usually 90 or 120 days,[17] reduced to 7 days if the vulnerability is under active exploitation.[18] Google Project Zero has a 90-day disclosure deadline which starts after notifying vendors of vulnerability, with details shared in public with the defensive community after 90 days, or sooner if the vendor releases a fix.[19] ZDI has a 120-day disclosure deadline which starts after receiving a response from the vendor.[20] Full disclosureFull disclosure is the practice of publishing analysis of software vulnerabilities as early as possible, making the data accessible to everyone without restriction. The primary purpose of widely disseminating information about vulnerabilities is so that potential victims are as knowledgeable as those who attack them.[21] In his 2007 essay on the topic, Bruce Schneier stated "Full disclosure – the practice of making the details of security vulnerabilities public – is a damned good idea. Public scrutiny is the only reliable way to improve security, while secrecy only makes us less secure."[22] Leonard Rose, co-creator of an electronic mailing list that has superseded bugtraq to become the de facto forum for disseminating advisories, explains "We don't believe in security by obscurity, and as far as we know, full disclosure is the only way to ensure that everyone, not just the insiders, have access to the information we need."[23] The free availability of vulnerability information allows users and administrators to understand and react to vulnerabilities in their systems, and allows customers to pressure vendors to fix vulnerabilities that vendors may otherwise feel no incentive to solve. There are some fundamental problems with coordinated disclosure that full disclosure can resolve.
Discovery of a specific flaw or vulnerability is not a mutually exclusive event, multiple researchers with differing motivations can and do discover the same flaws independently. There is no standard way to make vulnerability information available to the public, researchers often use mailing lists dedicated to the topic, academic papers or industry conferences. Non disclosureFurther information: market for zero-day exploits and cyber-arms industry
Non disclosure is the policy that vulnerability information should not be shared, or should only be shared under a non-disclosure agreement (NDA) or informal agreement. Common proponents of non-disclosure include commercial exploit vendors, researchers who intend to exploit the flaws they find,[24] and proponents of security through obscurity. Managed vulnerability disclosureIn addition to internally operated vulnerability disclosure programs, some organizations rely on managed vulnerability disclosure services provided by third-party security vendors. In this model, an external provider operates and maintains the vulnerability reporting channel on behalf of the organization, performs initial triage and validation of incoming reports, and coordinates communication between reporters and the affected organization. Managed approaches are typically used by organizations that lack dedicated internal security resources or that receive a high volume of vulnerability submissions. Managed vulnerability disclosure services generally align with established coordinated disclosure frameworks, such as those published by the U.S. Cybersecurity and Infrastructure Security Agency (CISA)[25] and the European Union Agency for Cybersecurity (ENISA),[26] and are commonly designed to support standards including ISO/IEC 29147 and ISO/IEC 30111. Industry guidance describes these services as a way to improve responsiveness, reduce legal risk for researchers through safe-harbor language, and ensure consistent handling of vulnerability reports, while maintaining the organization’s responsibility for remediation and final disclosure decisions. Several commercial vulnerability management and bug bounty platforms offer managed disclosure as part of broader security testing or vulnerability coordination services, like Hackrate, who also participate directly in vulnerability identification by acting as CVE Numbering Authorities (CNAs), enabling them to assign CVE identifiers as part of the coordinated disclosure process.[27] ExamplesSelected security vulnerabilities resolved by applying coordinated disclosure:
DiscussionThe controversy around the public disclosure of sensitive information is not new. The issue of full disclosure was first raised in the context of locksmithing, in a 19th-century controversy regarding whether weaknesses in lock systems should be kept secret in the locksmithing community, or revealed to the public.[35] Today, there are three major disclosure policies under which most others can be categorized:[24] Non Disclosure, Coordinated Disclosure, and Full Disclosure. The major stakeholders in vulnerability research have their disclosure policies shaped by various motivations, it is not uncommon to observe campaigning, marketing or lobbying for their preferred policy to be adopted and chastising those who dissent. Many prominent security researchers favor full disclosure, whereas most vendors prefer coordinated disclosure. Non disclosure is generally favored by commercial exploit vendors and blackhat hackers.[36] In 2009, Charlie Miller, Dino Dai Zovi and Alexander Sotirov announced at the CanSecWest conference the "No More Free Bugs" campaign, arguing that companies are profiting and taking advantage of security researchers by not paying them for disclosing bugs.[37] This announcement made it to the news and opened a broader debate about the problem and its associated incentives.[38][39] The U.S. Department of Justice has revised its charging policy for the Computer Fraud and Abuse Act (CFAA). For the first time, the policy stated that good-faith security research should not be charged. The department described such research as accessing a computer only to test, investigate or correct a security flaw or vulnerability while limiting harm to individuals or the public. It also said that presenting an activity as research would not protect those acting in bad faith. Its example was people who uncover flaws in devices to extort their owners.[40] Arguments against coordinated disclosureResearchers in favor of coordinated disclosure believe that users cannot make use of advanced knowledge of vulnerabilities without guidance from the vendor, and that the majority is best served by limiting distribution of vulnerability information. Advocates argue that low-skilled attackers can use this information to perform sophisticated attacks that would otherwise be beyond their ability, and the potential benefit does not outweigh the potential harm caused by malevolent actors. Only when the vendor has prepared guidance that even the most unsophisticated users can digest should the information be made public. This argument presupposes that vulnerability discovery is a mutually exclusive event, that only one person can discover a vulnerability. There are many examples of vulnerabilities being discovered simultaneously, often being exploited in secrecy before discovery by other researchers.[41] While there may exist users who cannot benefit from vulnerability information, full disclosure advocates believe this demonstrates a contempt for the intelligence of end users. While it's true that some users cannot benefit from vulnerability information, if they're concerned with the security of their networks they are in a position to hire an expert to assist them as you would hire a mechanic to help with a car. Arguments against non disclosureNon disclosure is typically used when a researcher intends to use knowledge of a vulnerability to attack computer systems operated by their enemies, or to trade knowledge of a vulnerability to a third party for profit, who will typically use it to attack their enemies. Researchers practicing non disclosure are generally not concerned with improving security or protecting networks. However, some proponents argue that they simply do not want to assist vendors, and claim no intent to harm others. While full and coordinated disclosure advocates declare similar goals and motivations, simply disagreeing on how best to achieve them, non disclosure is entirely incompatible. See alsoReferences
External links
Hidden categories:
| ||
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |
