New answers tagged

4

One of the methods you can use to create a baseline would be to go to sites like PacketStorm find say the last 50 vulnerabilities/exploits disclosed, then find out whether or not they have CVEs issued on Mitre. A baseline will give you just that, a baseline average. There are a few things to take into considerations: Not all exploits/vulnerabilities are ...


1

Honestly it really depends on the company. Every company handles their vulnerabilities differently, even some researchers who follow the process get screwed by it, just like this guy who filed a bug for Instagram. For those entered through the bug bounty program (if they have one), they will generally publish the information on their site or email to the ...


2

Would this attract hackers? Yes, of course, that's the point of it. Good hackers, bad hackers, grey / white / black / multicolor hat hackers. They will come and inspect your server's front-door. Should you be afraid of it? Normally, your security posture should not rely on the absence of any attacker, otherwise you indeed have a big problem to solve. When ...


0

The risks are essentially that you have far less control over a development/test environment, more people will have access to larger portions of the data, and it will be used and thought of in a far different way. Test data often needs to be sent to 3rd parties, across oceans, or other places where you have no control over it. Essentially, count on your ...


0

A good test environment should normally be extremely close (if not identical) to the production system, including all relevant security measures. The best approach to get test data is normally to define test cases that include every single possible case, but that can sometimes represent a huge job, and thus justify the development of something that will ...


5

You are not "obliged" to follow any such practise. Not following them may simply mean that you won't be eligible for some goodies. Or that they can't properly provide a fix. As for the disclosure itself, it would be ethical in my opinion not to wait for the remaining 80 days. There's a notorious case of a security researcher that used its not-a-bug on ...



Top 50 recent answers are included