Does anyone have experience in setting up a responsible disclosure procedure for a company?
I'm interested in taking up a university assignment involving this.
I have read up on my governments guidelines to responsibilities of both the discloser and the organisation in charge of the information system, but I still have some questions about the actual implementation. For my university to accept this assignment, there have to be some technical challenges to overcome for this project to be found acceptable. Basically, if the project is found to be too easy, it gets rejected. So far, the only things I can come up with are:
- Using an secure connection to make sure no attackers can intercept reports of vulnerabilities.
- Encrypting the stored reports so that there is no easily available/readable list of vulnerabilities in the website for outsiders.
- Authorization for viewing the data
- Setting up an automated procedure for handling reports (a trusted person within the organisation receives the report and tries to replicate the vulnerability, and passes it on to the responsible party for fixing it).
If anyone has set up a responsible disclosure system already, and is willing to share: what other challenges did you face when setting up your RD system?
