.png){kind=icon}
返回
Coordinated Vulnerability Disclosure programme effectiveness: Issues and recommendations
.png){kind=icon}
OA
AI
DOI：10.1016/j.cose.2022.102936.png)
.png){kind=icon}
.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Coordinated Vulnerability Disclosure (CVD) programmes leverage a global network of independent secu-rity researchers (hackers) to support pre-and post-deployment security. Organisations are increasingly adopting Bug Bounty Programmes (BBPs) and Vulnerability Disclosure Programmes (VDPs) to outsource work from internal security teams, and are able to utilise the results from a programme to help shape their Software Development Life Cycle (SDLC) processes. Motivated by the question How effectively are organisations utilising CVD programmes? , we aim to address two issues concerning the operation of CVD programmes. First, it is necessary to identify the pre-and post-launch issues faced by programme oper-ators that inhibit effective operation. Second, or ganisations stand to benefit if they are able to use the results of a CVD programme outside of the typical reporting-triaging information flow between a hacker and the operator. As such, it is useful to explore how the results of a CVD programme influence change across the SDLCs of real-world organisations and measure the extent to which this occurs. We report upon the results of a qualitative study based on the outcomes of 39 survey responses and eight semi -structured interviews with individuals involved in the operation of CVD programmes. It is found that the fears and issues faced by organisations are similar to those identified in earlier studies, suggesting that there has been little development in preventing prevalent problems faced by CVD programme op-erators. High volumes of low-quality, low-value reports still burden operators and consume resources. It is also found that organisations use the information contained within vulnerability reports to influence change in a number of security activities, namely testing, communication processes, and the specification of security requirements. Finally, based on the responses from the surveys and interviews, we provide recommendations to those looking to establish a CVD programme.(c) 2022 The Author(s). Published by Elsevier Ltd. This is an open access article under the CC BY license ( http://creativecommons.org/licenses/by/4.0/ )
Keyword:
Coordinated vulnerability discovery
Bug bounty programmes
Responsible disclosure programmes
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
C
IF:
5.4
论文数:
4.6K
被引数:
1.4W
机构
引用论文
分享收藏Modulatory effects of phytol on the antiemetic property of domperidone, possibly through the D2 receptor interaction pathway: in vivo and in silico studies.png)
3 Biotech
OAAI
3 BiotechIF0
OAAI分享收藏The Composition and Diversity of Soil Bacterial and Fungal Communities Along an Urban-To-Rural Gradient in South ChinaForestsOAAI
ForestsIF0
OAAI分享收藏
查看更多内容