Why fair disclosure is so difficult. (November 2015)

• Record Type: Journal Article
• Authors: Bradbury, Danny
• Is Part Of: Computer fraud & security. Number 11(2015)
• Page Start: 5
• Page End: 8
• Publication Date: 2015-11
• Subjects: Computer crimes -- Periodicals; Computers -- Access control -- Periodicals; 364.168
• DOI: 10.1016/S1361-3723(15)30100-7
• Languages: English
• ISSNs: 1361-3723

Abstract

Abstract : It can be difficult for people to keep a secret at the best of times, and this is particularly true in the world of cyber-security. The whole industry rests on secrets, but some of them must be disclosed to make the user community safer. Disclosure of security flaws is a complicated and tense process, both for the researchers that discover them, and for the vendors that must fix them. Approaches range from full disclosure, where everything is made open immediately, through to fair disclosure, where information is made available on an agreed schedule. There are many nuances in between. Danny Bradbury explores the continuum of disclosure, and analyses some strengths and weaknesses along the way.