DHS issues draft order to require vulnerability disclosure policies at civilian agencies

guest · Nov 28, 2019

DHS issues draft order to require vulnerability disclosure policies at civilian agencies
November 27, 2019
https://www.cyberscoop.com/cisa-vulnerability-disclosure-order/

The Department of Homeland Security’s cybersecurity division is trying something new. Instead of simply ordering civilian agencies to take a specific action to shore up their cybersecurity, it is asking the public to weigh in on the order first.

On Wednesday, DHS’ Cybersecurity and Infrastructure Security Agency issued a draft Binding Operational Directive (BOD) that compels civilian agencies to establish programs to work with outside security researchers to find and fix software flaws in agency websites and applications.
The appeal for public input is in the collaborative spirit of vulnerability disclosure policies (VDP), which crowdsource an organization’s security by asking ethical hackers to improve it.

When CyberScoop first reported last month that CISA had prepared the directive, officials estimated that, out of scores of civilian agencies, just 10 had VDPs in place.

“In seeking public comment, we’re also nodding to the fact that, to our knowledge, a requirement for individual enterprises to maintain a vulnerability disclosure policy has never been done before, and certainly not on this scale,” Manfra, who is leaving CISA by the end of the year, wrote in her blog post.
Click to expand...

CISA: Improving Vulnerability Disclosure Together
Binding Operational Directive 20-01 - Develop and Publish a Vulnerability Disclosure Policy

Log in or Sign up

DHS issues draft order to require vulnerability disclosure policies at civilian agencies

guest Guest

Log in or Sign up

DHS issues draft order to require vulnerability disclosure policies at civilian agencies

guest Guest

Useful Searches