CISA Issues Final Vulnerability Disclosure Policy Directive for Federal Agencies

guest · Sep 3, 2020

CISA Issues Final Vulnerability Disclosure Policy Directive for Federal Agencies
September 2, 2020
https://www.cisa.gov/news/2020/09/0...-disclosure-policy-directive-federal-agencies

WASHINGTON – Today, the Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive 20-01, which requires individual federal civilian executive branch (FCEB) agencies to develop and publish a vulnerability disclosure policy (VDP) for their internet-accessible systems and services, and maintain processes to support their VDP.

This BOD is part of CISA’s agency-wide priority to make 2020 the “year of vulnerability management,” with a particular focus on making vulnerability disclosure to the civilian executive branch easier for the public.

“Cybersecurity is strongest when the public is given the ability to contribute, and a key component to receiving cybersecurity help from the public is to establish a formal policy that describes how to find and report vulnerabilities legally,” said Bryan Ware, Assistant Director for Cybersecurity, CISA.
Click to expand...

Vulnerability disclosure policies enhance the resiliency of the government’s online services by encouraging meaningful collaboration between federal agencies and the public. They make it easier for the public to know where to send a report, what types of testing are authorized for which systems, and what communication to expect.

To read more details about BOD 20-01, see our blog, Improving Vulnerability Disclosure Together (officially). It also discusses how the final directive is different from others we have issued and how CISA reviewed and implemented the public comments on the draft directive issued in November.
Click to expand...

guest · Sep 5, 2020

Homeland Security demands a 911 for reporting security holes in federal networks: 'Vulns in internet systems cause real-world impacts'
September 3, 2020
https://www.theregister.com/2020/09/03/us_bug_bounty/

In an online memo, Bryan Ware, Assistant Director for Cybersecurity at CISA, described a scenario of walking in one's neighborhood and calling emergency services upon seeing a house engulfed in flames.
The government, he suggested, would benefit if people could take similar action upon finding a security flaw in a federal website.

But many government websites don't advertise how to raise the alarm or offer any assurance that vulnerability reports are welcome.
Click to expand...

CISA's Binding Operational Directive 20-01 aspires to simplify the reporting process. It requires federal agencies to provide the .gov registrar with a security contact and a responding organization for each .gov domain controlled by the agency within 30 days.

Katie Moussouris, CEO of Luta Security, welcomed the move but suggested the feds are putting the cart before the horse.

"You can’t just throw a point of contact up to solicit vulnerability reports from the public with no process behind it and expect good security as a result," she wrote in a blog post.
Moussouris pointed to comments she and her colleagues made as the directive was being drafted [...]
"Failure to set aside adequate resources for these efforts will undermine the utility of the [directive] and erode the positive benefits associated with the [vulnerability disclosure policies]," the comment says.
Click to expand...

In other words, it's not enough for each agency to set up the equivalent of a 911 call center to field vulnerability reports. The Feds also need to invest in first responders and equipment to put out the fire.
Click to expand...

Log in or Sign up

CISA Issues Final Vulnerability Disclosure Policy Directive for Federal Agencies

guest Guest

guest Guest

Log in or Sign up

CISA Issues Final Vulnerability Disclosure Policy Directive for Federal Agencies

guest Guest

guest Guest

Useful Searches