In response to a recent Tripwire study which revealed that 50% of security professionals believe researchers should not be allowed to test the security constraints of an organisations network without upfront approval,IT security experts commented below.
Laurie Mercer, Solutions Engineer at HackerOne:
The US-based National Institute of Standards and Technology recently recommended processes be established to receive, analyse and respond to vulnerabilities disclosed from internal and external sources, including unsolicited reports from security researchers. The European Union is also considering how to standardise responsible disclosure under the new Cybersecurity Act. In fact, some would argue that it is riskier to deny, ignore or discourage responsible disclosure of unsolicited security vulnerabilities. If one sees a suspicious package in a train station, it is one’s responsibility to report it – why should it be different for online services?
In an ideal world, if a responsible researcher finds a security vulnerability, they would be able to securely and responsibly report it to a security team, who would respond, triage and coordinate the remediation activities. Vulnerabilities would only be publicly disclosed if and when both parties were in mutual agreement, normally after vulnerable systems have been patched. This relies on organisations having defined and rehearsed processes for receiving and managing vulnerabilities from the outside.”
Martin Jartelius, CSO at Outpost24:
This disclosure process applies differently to our customers. When we detect defects in off the shelf products during security auditing, we notify them immediately and provide guidance about their best course of action to minimize the possibility of attack.
Generally a public disclosure does NOT need to wait for a vendor fix, as this would constitute delays for a potential fix. Vendors have in many cases delayed publication and use their delays as a way to prevent the disclosure of the vulnerability. However, this works against responsible or coordinated disclosure, and creates tension between security researchers and software vendors with the customers on the sidelines getting frustrated.
With regards to unsolicited security reports, they should be treated as an incident and prioritized with necessary resources to implement fixes for the identified risks. Based on severity, these fixes should be implemented swiftly. However, an unsolicited report, by its nature, indicates an unlawful intrusion. This also warrants an investigation – If a security tester identifies a risk without permission to test, then progresses to exploit it and steal confidential data or personal data from systems, it’s still a criminal offense. It’s more acceptable to observe the risk, or test against their own application data, and not attempt further data extraction or theft of data to prove a point.
In the case of standard software products which can be installed and tested by the analyst and affecting only their own data, the best response from the software vendor is a sincere thank you.”