 
  See your link here
|
For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Vendor group publishes vulnerability disclosure guidelines
|
|
|
|
July 31, 2003 (Computerworld) --
LAS VEGAS -- A group of 11 security companies and software developers, known collectively as the Organization for Internet Safety (OIS), this week released the first version of a consensus document governing the reporting and release of security vulnerability information (download PDF).
The OIS, a voluntary group of 11 high-profile vendors formed last September, on July 29 released Version 1.0 of its long-awaited "Guidelines for Security Vulnerability Reporting and Response." The 25-page document is the result of a yearlong effort to standardize how security researchers and software vendors work together to find, fix and release information about software vulnerabilities to the public. A draft version of the document had been released in early June for public comment.
The current industry model of full disclosure has been a contentious and often politically charged issue. It has divided the security community into two camps, one consisting mainly of independent researchers, who feel that vendors are only out to protect themselves and their customers. The other camp includes vendors, which feel that researchers don't always adhere to the accepted practice of first notifying a vendor before making vulnerability and exploit data public.
"The environment has changed during the past seven to 10 years," said Chris Wysopal, director of research and development at @stake Inc. and co-author of the infamous Windows password-cracking program, L0phtCrack. "[In the past], vendors weren't communicating with anybody who wasn't a big customer. And they had no process at all."
The OIS guidelines are an effort to create a process acceptable to both researchers and vendors, one that keeps the security interests of users at the forefront, said Scott Blake, vice president of information security at BindView Corp. in Houston. "The process relies on good faith by both parties, and users' interests are the primary consideration."
According to Blake, the OIS incorporated substantial feedback from the security community in its final guidelines and devised a five-step process. Key to that process is a standardized and established point of contact that must be provided by the vendor so researchers know exactly who to notify, said Blake. In addition, a vendor has seven days to acknowledge receipt of the vulnerability report, or the researcher is free to make a public announcement. Finally, the OIS will rely on a 30-day grace period after a fix has been issued by the vendor to hold back the release of what he called "supplementary data" related to exploit code.
That should afford everybody affected by the vulnerability enough time to install patches before exploits begin to appear in the hacker community, said the OIS.
However, security experts attending the Black Hat security conference here questioned the motivations of the OIS, saying that it appears to be an effort to increase the value of for-profit early-notification lists that some security companies offer. "It sounds like a wonderful way to notify customers who pay for advance notification," said one audience member.
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
 |
| All Zones Application Performance Zone Business Continuity Zone The File Data Management Zone Security Management Zone The SAS Zone Business Intelligence and Analytics Zone Windows Protection Zone The Enterprise Search Zone Software as a Service Zone The Security Zone |
|
See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Moving to Windows Vista: The Promise, The Reality
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs. 
Download this white paper today!
Read up on the latest ideas and technologies from companies that sell hardware, software and services. 
- Microsoft: 'Vista Capable' lawyers trying to hijack Windows Update
- Remote Control: NASA works to repair Hubble's failed computer
- Update: McCain protests YouTube's removal of his campaign videos
- More top stories
 The Security Zone
Securing your network begins at the gateway, also called the perimeter, to keep unauthorized users, viruses and malicious code from entering your systems. Deploying multilayer technologies is your first line of defense. With the mobility of employees and the ease with which external devices can be brought in and out of a network, continuing to build your security plan for network servers and clients is a must. Fortunately, there is much that organizations can do to protect themselves from attacks - internal and external. One of the key facets of a successful security strategy is protecting the servers that run critical applications and house so much of your essential data. Having the right policies, procedures and server configurations is critical. Learn more in The Security Zone See All Zones
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.New baits 
|
|
|
Seth Weintraub:
Liveblog: Apple Macbook Event Let me just say this: I told you so. [more] |
