Menu
US agency to seek consensus on divisive, volatile topic of security vulnerability disclosures

US agency to seek consensus on divisive, volatile topic of security vulnerability disclosures

NTIA hopes to foster more trust and collaboration among security researchers and vendors

A U.S. agency hopes to gather security researchers, software vendors and other interested people to reach consensus on the sticky topic of how to disclose cybersecurity vulnerabilities.

Beginning in September, the U.S. National Telecommunications and Information Administration (NTIA) will host a series of meetings intended to improve collaboration among security researchers, software vendors and IT system operators on the disclosure of, and response to, vulnerabilities.

The first NTIA-hosted meeting will be Sept. 29 at the University of California, Berkeley, School of Law. Registration is open to all who want to participate, and the meeting will also be webcast, NTIA said.

Some researchers' public disclosure of previously unknown vulnerabilities has been controversial, with some software vendors complaining the information can help hackers compromise systems before they can be patched. Many researchers believe that public disclosure gives software vendors an incentive to issue patches.

But the NTIA sees potential for a consensus to develop, with strong security as the goal, said Deputy Assistant Secretary Angela Simpson. When a researcher discovers a vulnerability, "we'd like to promote collaboration, rather than antipathy, between the researcher and the vendor," she said.

While the debate over vulnerability disclosure isn't new, it is growing in importance as many industries find themselves selling products with software at their cores, Simpson said.

NTIA hopes the participants can develop a set of "high-level principles for successful collaboration," she added. Participants in the process, not the NTIA, will determine the outcome, she added. "The community holds the pen."

In recent years, the agency has hosted a series of so-called multistakeholder meetings related to developing privacy standards for mobile apps, drones and facial recognition technology. Those processes have produced mixed results, with some privacy advocates complaining the meetings were too focused on business, and not consumer, needs.


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

​Ingram Micro’s Hooked on Lenovo incentive programme recently rewarded 28 of New Zealand's top performing resellers with a full-on fishing trip at Great Barrier Island for the third year​ in a row.

Tight lines as Hooked on Lenovo catches up at Great Barrier Island
Inside the AWS Summit in Sydney

Inside the AWS Summit in Sydney

As the dust settles on the 2017 AWS Summit in Sydney, ARN looks back an action packed two-day event, covering global keynote presentations, 80 breakout sessions on the latest technology solutions, and channel focused tracks involving local cloud stories and insights.

Inside the AWS Summit in Sydney
Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Ingram Micro hosted its third annual Cure Kids Charity Golf Tournament at the North Shore Golf Club in Auckland. In total, 131 resellers, vendors and Ingram Micro suppliers enjoyed a round of golf consisting of challenges on each of the 18 sponsored holes, with Team Philips taking out the top honours.

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day
Show Comments