Menu
US agency to seek consensus on divisive, volatile topic of security vulnerability disclosures

US agency to seek consensus on divisive, volatile topic of security vulnerability disclosures

NTIA hopes to foster more trust and collaboration among security researchers and vendors

A U.S. agency hopes to gather security researchers, software vendors and other interested people to reach consensus on the sticky topic of how to disclose cybersecurity vulnerabilities.

Beginning in September, the U.S. National Telecommunications and Information Administration (NTIA) will host a series of meetings intended to improve collaboration among security researchers, software vendors and IT system operators on the disclosure of, and response to, vulnerabilities.

The first NTIA-hosted meeting will be Sept. 29 at the University of California, Berkeley, School of Law. Registration is open to all who want to participate, and the meeting will also be webcast, NTIA said.

Some researchers' public disclosure of previously unknown vulnerabilities has been controversial, with some software vendors complaining the information can help hackers compromise systems before they can be patched. Many researchers believe that public disclosure gives software vendors an incentive to issue patches.

But the NTIA sees potential for a consensus to develop, with strong security as the goal, said Deputy Assistant Secretary Angela Simpson. When a researcher discovers a vulnerability, "we'd like to promote collaboration, rather than antipathy, between the researcher and the vendor," she said.

While the debate over vulnerability disclosure isn't new, it is growing in importance as many industries find themselves selling products with software at their cores, Simpson said.

NTIA hopes the participants can develop a set of "high-level principles for successful collaboration," she added. Participants in the process, not the NTIA, will determine the outcome, she added. "The community holds the pen."

In recent years, the agency has hosted a series of so-called multistakeholder meetings related to developing privacy standards for mobile apps, drones and facial recognition technology. Those processes have produced mixed results, with some privacy advocates complaining the meetings were too focused on business, and not consumer, needs.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments