How a Vulnerability Disclosure Policy Reduces Security Risk

A chief information security officer (CISO) answers for the security of an organisation's information and data: lowering the chance of an incident, protecting the brand and its assets, and keeping customers and their data safe. Rena Chua, bug bounty advisor at HackerOne, argues that this work never stops, that the full set of tools it requires can cost more than most can afford, and that CISOs themselves often admit security cannot be scaled on internal resources alone.

When someone finds a security flaw, Chua says, it has to reach the right people fast so it can be fixed safely. Recent years have brought some of the most damaging data breaches ever seen, yet in her view they could have been worse: friendly hackers have so far helped remove nearly 200,000 vulnerabilities.

A hacker who finds a flaw will usually try to tell the organisation's security team. If there is no obvious way to do that, the choice is an unattractive one: stay silent, or make the flaw public. Chua cites HackerOne's Hacker 2020 report, in which 21% of hackers surveyed said they had found a vulnerability and not reported it because the company had no clear channel for receiving it. By her reading, that leaves almost one in four companies with potentially critical flaws that nobody has reported, nobody knows about and nobody has fixed.

Why reporting a flaw is harder than it should be

A vulnerability disclosure policy (VDP), often described as the Internet's version of "see something, say something", sets out clear rules for how anyone who comes across a problem can report it to the person or team responsible.

Chua offers an everyday comparison. Walking past a neighbour's house and spotting the back door wide open, most people would knock, shout or perhaps phone them. With organisations, technology or websites, it is far less straightforward.

Reporting a vulnerability can expose a hacker to serious legal risk, so many keep what they found to themselves or publish it anonymously. If a business gives hackers no way to disclose a flaw, the flaw goes on endangering the business and the public. If hackers have to report anonymously, the company struggles to get the details it may need for a fix, and the hacker gets neither thanks nor confirmation that the problem was solved. Either way, Chua says, flaws are not resolved as safely as they should be, and the Internet ends up less secure than it could be.

What a VDP gives an organisation

A VDP is one of the formal ways an organisation can accept vulnerability reports from outsiders under agreed rules. It tells finders, whether security researchers, ethical or white-hat hackers or bug hunters, exactly how to report a possible flaw. It also gives the internal security team a simple way to receive, assess and discuss what comes in, and it removes the business risk of a finder who does not know how to report something posting it on social media instead.

VDPs are turning into standard good practice and, increasingly, something regulators expect. Guidance on vulnerability disclosure has come from many bodies, among them the United States Department of Justice, the National Institute of Standards and Technology (NIST) and the International Organisation for Standardisation (ISO/IEC 29147:2014). Governments are setting up VDPs themselves. According to Chua, hackers found more than 18,000 valid vulnerabilities for the U.S. Department of Defense solely through HackerOne's VDP over three years. Singapore's government launched a formal VDP with HackerOne in 2019, which she presents as evidence of its continued commitment to working with the security community on a secure and resilient Smart Nation.

Chua's case for a VDP is that it is simple, cheap and fast to set up. Done properly, the policy can become the foundation of a full disclosure programme. That programme covers how the organisation deals with incoming reports in legal and technical terms, how it talks to finders, how internal teams verify, mitigate and publicly disclose a flaw, and how the work and its outcomes are summarised for stakeholders and decision-makers. The policy needs enough detail to help both the organisation and the researchers raise security.

Five elements every policy should have

HackerOne recommends that a VDP include at least these five parts:

1. Promise: set out the purpose of the policy and the organisation's commitment to security, to customers and to others. Explain why the policy exists, why a public policy matters and what it is meant to achieve.
2. Scope: state what may be tested and where attention is wanted or forbidden, which kinds of vulnerabilities should be reported and which are excluded. Limits can also apply to particular products or versions, or protect data or intellectual property.
3. Safe harbour: commit in good faith that people who report will not be punished, in effect saying "we will not take legal action if...". This reassures anyone disclosing a flaw, so the wording should be welcoming, unthreatening and clear.
4. Process: explain how finders should submit reports and what information the organisation wants, and set expectations for later communication. Reports sent by email can arrive incomplete and unstructured. A secure web form, such as HackerOne's Response product, helps make sure nothing is missing.
5. Preferences: give non-binding expectations for how reports will be assessed, such as the time between submission and reply, confirmation of the flaw, follow-up communication, whether finders will be credited, and whether or when they may disclose their findings publicly.

Once the policy is final and the organisation is ready to take reports, it should be published somewhere accessible and easy to find. Most organisations have historically put their policy on their own website, and some added a dedicated email address for security reports. Many such programmes are listed in the HackerOne Directory, a resource maintained by the community for reaching security teams.

Security researchers, friendly hackers, customers, academics, journalists and hobbyists find vulnerabilities every day. No system is completely free of flaws, so Chua argues that outsiders need a clear way to report them. A VDP lowers the risk of an incident or of uncoordinated disclosure, and it lets the organisation steer what would otherwise be a disorderly process. In her account, it also lets a CISO scale security with help from the hacker community: hackers on HackerOne's platform have so far helped find and fix almost 200,000 vulnerabilities across more than 2,000 customer programmes.