Slashdot Mirror

← Back to Stories (view on slashdot.org)

Dutch Gov't Offers Guidance For Responsible Disclosure Practices

Posted by Soulskill on from the here-is-how-to-do-your-job dept.

An anonymous reader sends this quote from an IDG News report: "The Dutch government's cyber security center has published guidelines (in Dutch) that it hopes will encourage ethical hackers to disclose security vulnerabilities in a responsible way. The person who discovers the vulnerability should report it directly and as soon as possible to the owner of the system in a confidential manner, so the leak cannot be abused by others. Furthermore, the ethical hacker will not use social engineering techniques, nor install a backdoor or copy, modify or delete data from the system, the NCSC specified. Alternatively a hacker could make a directory listing in the system, the guidelines said. Hackers should also refrain from altering the system and not repeatedly access the system. Using brute-force techniques to access a system is also discouraged, the NCSC said. The ethical hacker further has to agree that vulnerabilities will only be disclosed after they are fixed and only with consent of the involved organization. The parties can also decide to inform the broader IT community if the vulnerability is new or it is suspected that more systems have the same vulnerability, the NCSC said."

11 of 37 comments (clear)

  1. speaking of responsibility... by terec · · Score: 5, Interesting

    "Responsible disclosure" is nice. But what about holding banks and businesses responsible for the harm they are causing when their security practices fail? What about the worry and wasted time they cause to customers? What about compensating the victims of identity theft due to sloppy security practices? Businesses seem to be able to screw up arbitrarily without a lot of consequences right now.

  2. Been Done by shawnhcorey · · Score: 5, Insightful

    "Responsible disclosure" means "We don't want to bother fixing it." If the vulnerability is not make public, it is never fixed. This has been done many times before. The only way to get them fixed is to make them public.

    --
    Don't stop where the ink does.
    1. Re:Been Done by sofar · · Score: 5, Informative

      Being a native dutch speaker, I read the entire guidelines in Dutch, and they include disclosure terms to encourage companies to rapidly fix (60 days) issues, and make agreements with the discloser about the disclosure.

      This is common practice and rather well accepted practice already. So, in essence, the document encourages the public disclosure. Any company that wishes to ignore the vulnerability will have their asses handed to them anyway, so this guideline actually helps - security researchers can use it to show to companies that they are acting in good faith as long as companies play by the same rules.

      So personally, I highly encourage governments to do something like this.

      This Dutch variant is interesting in the sense that it creates a possible middle man that can mediate and monitor the disclosure. This protects disclosers, and puts more pressure on companies to abide by these standards. Not the other way around.

  3. There are only two things I hate by Tator+Tot · · Score: 3, Funny

    There are only two things I hate in this world:

    People who are intolerant of other people's cultures... and the Dutch.

    --
    To all you virgins: Thanks for nothing.
  4. Disclosure only with consent? by the_B0fh · · Score: 3, Insightful

    Seriously? Who's going to consent?

    Also, where's the responsibility on the part of the organization to show that they *HAVE* a secure coding practice, they don't simply outsource $2 coders, and they have a program in place to review security issues?

    1. Re:Disclosure only with consent? by sofar · · Score: 2

      The documents create a neutral middle-man organization that can mediate between companies refusing to cooperate and disclosers. It effectively puts irresponsible companies directly in the line of sight of the government and thus legal action. What's not to like?

  5. Re:Sounds fairly reasonable. by sofar · · Score: 4, Interesting

    The guidelines (dutch PDF) have a whole chapter outlining the responsibilities of the organization receiving a disclosure. They include guidelines for solving the issues (60 days for software, 6 months for hardware), reporting back progress to the discloser, allowing a discloser to report the vulnerability to a larger audience as part of the NCSC (government). Combined, these guidelines are an effective tool for security researchers to play by the rules and put pressure on companies together with others.

    Researchers are encouraged to disclose to the NCSC as well, which means many security experts will be able to put pressure on companies not fixing vulnerabilities according to these rules.

  6. Time limit by Todd+Knarr · · Score: 2

    The only way I'd accept the "only disclose to the owner" condition is if it included a time limit within which the owner must either fix the vulnerability or disclose the vulnerability to the public, and if the owner fails to meet the limit the confidentiality is lifted and the hacker is free to disclose the vulnerability himself. If software makers want their mistakes kept confidential then the cost is a binding commitment to fixing those mistakes, and the penalty for failing to meet their commitment is that the hackers are freed from theirs.

    1. Re:Time limit by sofar · · Score: 3, Informative

      As I posted before, the guidelines mention explicit timelines that should be followed. 60 days for software, 6 months for hardware.

  7. Re:but... by sofar · · Score: 2

    Most likely scenario for Security, Dick:

    1) Criminality. Failure to ensure funding from reputable companies forces these folks into blackmail or abuse of disclosure process. Eventually, they end up behind bars.

    2) Corrective collective: Companies never give out freebies, but well-behaved security researchers have far more fun not being chased by police and get all the chicks. This creates a role model. You should see Bruce Schneier at rave parties.

  8. Directive ethical hacking solves nothing by wabrandsma · · Score: 4, Informative

    The problem is that the definition for hacking is overly broad. If you enter an URL in the address bar, and change just a serial number in the URL, it is considered hacking. Like finding Queen Beatrix's Christmas speech before it was officially published http://www.nrc.nl/nieuws/2012/12/25/hacker-kersttoespraak-van-geen-kwaad-bewust-tijdens-strafbare-actie/ (in Dutch). Or proving access to medical files by MP Henk Krol http://nos.nl/artikel/447718-krol-vervolgd-om-hacken-dossiers.html (in Dutch).
    IT journalist Brenno de Winter calls the guidance useless. "If hackers first have to report the vulnerability, they lose their anonymity without having a guarantee that they will not be prosecuted. And even if a company promises that it will not press charges, the Public Prosecutions Department can start a case." Link here: http://www.trouw.nl/tr/nl/5133/Media-technologie/article/detail/3372108/2013/01/04/Richtlijn-ethisch-hacken-lost-niets-op.dhtml (in Dutch).