2

The Dutch National Cyber Security Centre, NCSC* (daughter of the Ministry of Security and Justice) published a news article* regarding a Responsible Disclosure Guideline in the beginning of 2013.

The guideline* (pdf) is called "Policy for arriving at a practice for Responsible Disclosure". A website with an example text, policy template* was also launched. After Googling around using snippets of this policy template, I found that a lot of websites are using this policy already.

Should every website or web-application have a Responsible Disclosure Policy and what are the drawbacks of having such a policy? Won't this have the opposite effect and attract attackers?


* Documents and texts are all written in English, the Dutch versions of above hyperlinks can be found here NCSC, news article, guideline (pdf) and policy template.

  • I don't think it will attract attackers. They are already there. The policy might just make them a little less damaging to your business. – André Borie Jun 23 '16 at 8:37
3

Would this attract hackers? Yes, of course, that's the point of it. Good hackers, bad hackers, grey / white / black / multicolor hat hackers. They will come and inspect your server's front-door.

Should you be afraid of it? Normally, your security posture should not rely on the absence of any attacker, otherwise you indeed have a big problem to solve. When you put such policy in place, it means that:

  • You are sufficiently confident in your server security, you have setup the proper mitigation and monitoring systems,
  • You have people in measure to directly handle potential security incidents,
  • You have the right to take such initiative (you are not renting your server to an external service provider who could take the initiative of suing the discloser),
  • You have established the proper communication around this (a lot of companies rightfully fear about loosing competitiveness when uninformed customers and partners may have to choose between a company publishing information regarding its security issues and a company showing no security issues).

As I understand it, while you engage yourself to not sue people testing your security in the perimeter defined by your policy, you do not have any commitment to open all the doors to make their investigations easier (as it may be done upon contractual assessment to speed up the process and ensure a deeper coverage of the targeted application, for instance by disabling a web application firewall to focus the tests on the application itself).

All you defenses remain nearly the same, all threshold are still active. If a tester is blocked for a few minutes, if he gets Captcha to solve, etc.: all this is to be expected and is part of the game.

The only difference is that, instead of working only from time to time, your first-level defense mechanisms will be triggered on a far more regular basis, with certainly some people trying to maliciously abuse them, but also benevolent hackers analyzing them and ready to contact you in case of any flaw has been found.

So to summarize:

  • Without any responsible disclosure policy:
    • Malicious bots and attackers try from time to time to hack your server,
    • Your defense systems are triggered occasionally.
  • With a responsible disclosure policy:
    • There might be an higher amount of malicious attackers trying to hack the server, but this is not even sure since it is usually the sign of a sane security posture (the fact that you advertise that there actually is a security team may put your server out of the low hanging fruits),
    • Your first-level defense systems will be triggered on a regular basis,
    • In case of failure of these defenses, there is a high probability that you will be contacted by a benevolent hacker informing you about the issue.

So, all-in-all, I have the impression that the latter gives a better security feeling that the former.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.