Contrast Security's Jeff Williams talks about disclosure, bounty programs, and vulnerability marketing, in the first of a series of topical discussions with industry leaders and experts.
Hacked Opinions is an ongoing series of Q&As with industry leaders and experts on a number of topics that impact the security community. The first set of discussions focus on disclosure and how pending regulation could impact it. In addition, we asked about marketed vulnerabilities such as Heartbleed and bounty programs, do they make sense?
Where do you stand: Full Disclosure, Responsible Disclosure, or somewhere in the middle?
Jeff Williams, CTO of Contrast Security (JW): It's a false dichotomy.
I love security research -- particularly on new classes of vulnerability rather than exploitable instances of well understood vulnerabilities. I have responsibly disclosed many vulnerabilities in the past and the process was always painful -- but that's the road I'd take if I happened across a vulnerability.
But the idea that a handful of talented researchers working at risk for little to no financial reward is going to change our cybersecurity situation is insane and dangerous. Disclosure hasn't tilted the market towards more security products in 20 years, and it's not going to in the future.
In fact, disclosure creates the illusion that security research and disclosure is a substitute for security engineering and analysis, which it is not. The companies that create and run our critical infrastructure have impossibly large amounts of code -- many in the billions of lines of code.
Security research and vulnerability disclosure will only ever touch a tiny fraction of the latent vulnerabilities in the mountains of code we've created over the past 20 years.
If a researcher chooses to follow responsible/coordinated disclosure and the vendor goes silent - or CERT stops responding to them - is Full Disclosure proper at this point? If not, why not?
JW: Absolutely. I think the goal is to minimize the overall amount of damage that can be done with a vulnerability.
Full disclosure may cause some harm to folks that can't react quickly enough, but it almost always results in a quick fix. In fact, vendors are essentially training security researchers that if they want a problem fixed, then full disclosure is the easiest way to get it.
Vendors might complain about full disclosure, but they created an environment where it's often the only choice available to researchers.
Bug Bounty programs are becoming more common, but sometimes the reward being offered is far less than the perceived value of the bug/exploit. What do you think can be done to make it worth the researcher's time and effort to work with a vendor directly?
Sign up for CIO Asia eNewsletters.