Kymberlee Price
Bugcrowd
Over the last 15 years there have been vulnerability disclosure policies written by individuals, companies, and cross-industry working groups. They are all well thought out by intelligent people who were trying to make things better for everyone. Each of these policies has failed. Why are they failures? Can we do anything to make any of them successful? And frankly does it matter if we just give up and stick with the status quo?
In this presentation, I will discuss the human culture problem associated with vulnerability disclosure policies and some of the associated controversies and problems. I will discuss how we can proceed with fixing these issues by bringing everyone to the table to unearth the areas where stakeholders violently disagree and we must commit to working through those disagreements together.
We’ve got to understand that everyone is going to have to compromise. And we have got to stop just handing out policy from on high and start providing usable tools that help every vendor to implement a healthy incident response processes as well as real alternatives to Full Disclosure to help researchers when vendors aren’t playing nice.

свернуть