Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As a conscientious programmer, I put security as one of the core requirements of every product I develop. To prevent flaws from being introduced, I promote a culture of awareness (e.g. make sure that team members I work with know about common vulnerability types), keep myself updated by regularly reading specialized sites (e.g. The H Security or Dan Kaminsky's blog), watch out for common mistakes (and discuss them if necessary) while performing code reviews.

However, we all know that, by Murphy's Law, a security bug will appear (sooner or later). My (closely related questions) are:

  1. How can I promote responsible disclosure of security vulnerabilities found by researchers? That is, how can I encourage them to collaborate jointly with me, not releasing details until a fix is prepared, while simultaneously ensuring they feel they are respected for their hard work and they get the credit they deserve?
  2. In case someone takes the full disclosure route, how can I react (be alerted of the vulnerability as soon as possible and then take appropriate mitigation measures) in the most timely and effective way?

At the moment, I've thought about:

  • making sure a security contact is clearly listed on my website
  • using CVE Details to get a feed for my products if they get published there
  • following security mailing lists as well (see this IT Security answer)
  • ensuring patches are prepared quickly
  • constantly communicating with the bug reporter(s), updating them as progress is being made
  • publicly crediting the researcher(s) for her/their discovery
  • allowing full disclosure some time after the patches are published (to allow affected clients to install them)

(I'm part of a small team in a sort of startup, therefore my course of action is not limited by managerial issues. Nevertheless, I still think that any advice you'll provide can be applied to other situations as well.)

share|improve this question
2  
The security contact listed on your website should be "security@[your-domain]" or that address should also reach you. –  Mike Samuel Jun 20 '13 at 14:43

1 Answer 1

up vote 4 down vote accepted

How can I promote responsible disclosure of security vulnerabilities found by researchers? That is, how can I encourage them to collaborate jointly with me, not releasing details until a fix is prepared, while simultaneously ensuring they feel they are respected for their hard work and they get the credit they deserve?

I think you are on the right track so far with this point. The most important thing is to have an easy way for security researchers to contact you about security flaws. Keeping them involved in the process of fixing the bug is just being polite. If the bug is serious enough and you are able to afford it (which might not apply to you since you are a startup, offer the researchers a bug bounty for their efforts).

The worst thing you can do is be rude to the researchers and ignore their efforts to work with you on fixing the bugs. See this very hilarious case.

In case someone takes the full disclosure route, how can I react (be alerted of the vulnerability as soon as possible and then take appropriate mitigation measures) in the most timely and effective way?

You are also on the right track for this. I don't think there is a more effective method of discovering full disclosures about your software's vulnerabilities besides monitoring the various vulnerability databases available. You might want to look into subscribing to the feeds that such databases push out and use a regex filter to sort through irrelevant information.

If someone does something like this, I'd say the most important thing you should do is keep your customers informed. You might feel that this would negatively impact your reputation, but trust me, it would be a lot worse if your customers get hacked as a result of your software.

Keep them updated on the progress of the fix. If a timely fix is not possible, suggest alternative methods of mitigating the damage.

share|improve this answer
    
Thanks for the advice - I think I didn't use the right words in my second point. I originally meant to ask: "How can I be alerted quickly in case someone fully discloses a vulnerability?" (I am updating my question accordingly). –  elgaton Jun 20 '13 at 10:05
1  
@elgaton I updated my answer with a short paragraph on it. I think you are on the right track though, just monitor the various vulnerability databases and have some sort of sorting mechanism in place to weed out the irrelevant information. –  Terry Chia Jun 20 '13 at 10:21
    
Alright, thanks! –  elgaton Jun 20 '13 at 12:52
1  
@TerryChia That hilarious case is ongoing ... wow –  schroeder Jun 20 '13 at 18:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.