Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

12/2/2019
05:15 PM
100%
0%

DHS to Require Federal Agencies to Set Vulnerability Disclosure Policies

The Cybersecurity and Infrastructure Security Agency (CISA) publishes a draft document mandating a vulnerability disclosure policy and a strategy for handling reports of security weaknesses.

The US government will require each civilian agency to create a public policy for software-vulnerability disclosure, as well as a strategy for handling any potential security weaknesses reported by researchers. 

In the statement posted online, the US Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) raised concerns that most civilian agencies' lack of disclosure policies will lead to confusion, a lack of faith that issues are getting fixed, and the fear of potential legal action. The requirement of a vulnerability disclosure policy (VDP) will mean that every vulnerability reporter will know what to expect when they find and report a software flaw.

"A VDP allows people who have 'seen something' to 'say something' to those who can fix it," CISA said in its announcement. "It makes clear that an agency welcomes and authorizes good faith security research on specific, internet-accessible systems."

The move is the latest by the US government to work with security researchers and hackers to find — and plug — the weaknesses in its Internet-connected systems. In 2016, for example, the US Department of Defense announced its digital disclosure policy and launched the Hack the Pentagon challenge, the first-ever bug bounty for the federal government. Since then, every branch of the military has had a bug bounty challenge.

Without a vulnerability disclosure policy, good-faith researchers will not come forward with information on a security weakness outside of such programs, says Chris Wysopal, chief technology officer for software-security provider Veracode.

"[Having] no VDP is definitely a chilling effect of receiving good information from cooperative researchers," Wysopal says. "They don’t know if an organization will be friendly to researchers contacting with vulnerability information."

Game Change

The effort is a significant change in how government agencies treat vulnerability reporting. Not even a decade ago, the feds pursued charges against many vulnerability reporters. In 2005, for example, federal prosecutors charged information-technology specialist Eric McCarty with hacking after he used a Web-application vulnerability to access a handful of records on the application website of the University of California. McCarty reported the issue to the press.

Private industry also has targeted researchers. In 2017, one e-mail marketing firm pursued security research Chris Vickery, now at Upguard, for discovering that the company had left 1.4 billion email accounts users accounts in a publicly accessible cloud server — records that pointed to the company as a significant spam operation.

Federal agencies do not, in general, have a formal way of allowing security researchers or other third parties to submit information about vulnerabilities to them. And if an outside researcher or group did submit an issue, there is no process for handling that report and acting on it, the CISA stated in draft document, Binding Operational Directive 20-01, Develop and Publish a Vulnerability Disclosure Policy. 

"These circumstances create an environment that delays or discourages the public from reporting potential information security problems to the government, which can prevent these issues from being discovered and fixed before they are exploited or publicly disclosed," the agency said.

The Binding Operational Directive requires that civilian agencies create a security contact with 15 days and publish a vulnerability disclosure policy within 6 months. The BOD also mandates that agencies collect data on reported vulnerabilities and how quickly they are remediated. DHS is soliciting comments on the proposed rule until Dec. 27.

"If structured properly, VDPs can provide a secure channel for disclosures that do not prematurely inform adversaries of flaws in websites or applications," says Brian Fox, chief technology officer and co-founder of software-management firm Sonatype. "Clear documentation would be needed by the VDP program on what is allowed in regards to finding versus exploiting a vulnerability. Paired with a strong communication protocol, researchers and VDP program teams can safely work through remediation efforts without political or national security implications."

While the proposed rule is a good first step, do not expect to see a rise in attempts to find vulnerabilities in production sites, says Veracode's Wysopal. 

"I don't think researchers are going to test government sites without an explicit VDP," he says. "There is perceived risk that the government will be more sensitive to having security issues exposed than corporations are."

A public comment can be submitted through GitHub.

Related Content

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "A Cause You Care About Needs Your Cybersecurity Help."

 

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15208
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can ...
CVE-2020-15209
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one....
CVE-2020-15210
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and ...
CVE-2020-15211
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices f...
CVE-2020-15212
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `outpu...