YESWEHACK PROPHILE ON SONNY

Ethical hackers can make significant contributions to increasing products’ digital security. Still, the situation where a vulnerability is identified by an individual outside the organisation remains uneasy to handle for many organisations. To adequately address the discovery and interaction in such cases, a framework for coordinated vulnerability disclosure is needed.

 series, we take a closer look at the obstacles to coordinated disclosure and discuss a relevant framework for establishing a working process. Oh, and we have a neat infographic to sum all that food for thought—it is in English and 

, for you to peruse when raising awareness.

Obstacles to efficient vulnerability disclosure

Three significant barriers to a hacker’s participation in a coordinated vulnerability disclosure (CVD) process exist:

Lack of awareness about the appropriate existing means for disclosing a vulnerability;

Insufficient or excessively slow communication with the system manager or coordinator.

It is thus essential to creating a legal and organisational environment in which the security researcher feels sufficiently protected and confident enough to report a vulnerability to the manager of the information system concerned, who will then ensure rapid remediation.

One way of solving those challenges is to pass appropriate legislation. To date, only individual EU Member States are considering the creation of such guidance at the national level. A weighty barrier to the implementation of schemes about countervailing duty policies in the EU is the absence of a single interpretation among the Member States of what constitutes “hacking”.

As a result, providing the legal security, necessary to ethical hackers involved in the discovery of vulnerabilities, is slow to materialise. Thankfully, the legislative approach is not the only one facilitating effective CVD. It is, so, essential to put appropriate disclosure processes in place through supplementary advice and better practices.

A framework for disclosure at the core of security governance

Coordinated vulnerability disclosure is a process, not an isolated event. Firstly, it requires stakeholders to understand their respective 

roles and responsibilities around vulnerability disclosure

 enables people to act according to their responsibilities. Thirdly, connecting people to tools happens through processes and actions of (security) governance. Together, these three components create a healthy environment, encouraging collaboration and reducing digital risk over the long-term.

The people-process-tools triptych outlined just now is a robust non-legislative alternative to implementing CVD policies. Doing so involves a holistic approach that takes into account:

, that is the teams in charge of managing the vulnerability escalations (reception, sorting, qualification, cascade towards the managers of assets in need of remediation, etc.);

clear, known and up-to-date procedures for vulnerability disclosure

: contact information, response deadlines, etc. The existence of a vulnerability disclosure policy should be 

 for fitting procedures and actions into place, such as a secure communication channel (public or private 

The private sector has a leadership role to play in promoting appropriate frameworks, thus consolidating actual information sharing.

Summing up: Create a working framework for coordinated vulnerability disclosure

The global and lasting reduction of risk will come from the cooperation of both public and private actors. An international model in this field is essential to avoid all uncoordinated public disclosure. As such, guaranteeing protection for ethical security researchers is paramount.

We have created the infographic below to summarise the take-home messages on how to create a working framework for vulnerability disclosure.

 Below, you can download the high-resolution file in English and 

. It is free to use under the terms of the CC-by-NC-SA licence.

A framework for successful vulnerability disclosure policy

Julien Levrard, Security Operations Manager, OVHcloud:

 DNA. It’s inherent in our business as an infrastructure provider and all of the services that we offer. Our infrastructure security is a permanent focus, as well as a driver of our customers’ trust. That security relies on physical and logical safeguards and oversight activities, scans, internal and external penetration tests, code and configuration reviews, and other security measures. Some of these safeguards are managed non-stop by our teams, while others rely on a partnership with trusted third parties.

 several years ago in order to add a layer of security to our existing systems. Our companies share the same core values and evolve in the same ecosystem; we share the same passion and the same European roots. It’s partly for these reasons that we started with this platform: we were one of 

 clients, and launched our program during a live bug bounty at the Nuit du Hack (Hack Night) event.

Is bug bounty strengthening the trust you have with your customers?

Yes, definitely. OVHcloud works with different types of clients. Some of them manage their infrastructure themselves and are highly sensitive to technical communications. Our communication is therefore based on transparency and reliability. Other customers are more mindful as to our ability to bring in trusted third parties, such as certification auditors or external service providers. 

Bug bounty offers an added degree of trust for some of our customers who demand more than traditional security measures.

 works with large strategic organisations such as OVIs (Operators of Vital Importance) and we also play in that market. 

bug bounty is part of this ecosystem of trust and is becoming a ‘must have’ for organisations like ours

. It’s also a question of reputation vis-à-vis the community of hunters, who are stakeholders in this ecosystem: through YesWeHack, we can interact with people who aren’t always available via other channels.

What does bug bounty offer you in terms of the aforementioned services (audits, scans, penetration tests, etc.)?

Bug bounty puts us in touch with experts with knowledge that complements our teams across the entire spectrum of technologies that we use. This includes OpenStack, Kubernetes, Machine Learning tools, and AI. It’s impossible to find a team of penetration testers with advanced skills in all of these technologies.

YesWeHack gives us easy access to experts in these various technologies who say: 

“I’m a Kubernetes expert, so I’m going to take a look at all of these bug bounty programs with Kubernetes offers and dig deeper

.” This effectively completes our security approach by providing a perspective that complements that of our teams.

Bug bounty also offers a formal framework for vulnerability reporting. It allows us to provide a legally secure point of entry for the hunters. Even if it isn’t the only OVHcloud channel for vulnerability reporting, we recommend to anyone that ‘finds’ vulnerabilities to use our program. This allows us to have one single inflow and a linked process for managing vulnerability reports. It’s therefore a defining part of our 

CVD (Coordinated Vulnerability Disclosure).

Beyond the advantages of bug bounty as a model, I would highlight the YesWeHack platform, which has a very intuitive user interface. The OVHcloud team managing the bug bounty program gives us excellent feedback on the workflow management, report processing, and interactions with the hunters.

The APIs enable us to integrate useful information into our own tools and dashboards automatically. We can also track our bonus budget and the activity of each program. 

At a glance, we understand the status of our programs and can quickly report indicators to our management. Bug bounty is fully integrated into our global security strategy.

What role does bug bounty play in your agile development methodology?

Our team of penetration testers oversees our bug bounty program: two managers are in charge of the program as well as leading the community of hunters. They then work with the various teams affected by the vulnerabilities so that we can integrate them into our management systems and ensure remediation.

Once the vulnerabilities are reported via the platform, we integrate them into our processes: we have an entire organisational structure that we call security management systems, as part of the ISO 27001 certification framework. Documented processes, roles, and responsibilities ensure that each vulnerability, incident, or potential threat is processed and monitored over time by our teams. It is also part of a detailed action plan whose application is verified according to the sensitivity of the product in question, and the associated level of requirement. 

Thanks to the YesWeHack API, we can easily integrate the bug bounty reports into this process. Everything is managed by tickets that are viewable on our dashboards and accessible to our external auditors.

You’re in a public program – how are your exchanges with the community going?

Managing a bug bounty program is a real commitment to all stakeholders involved in making the internet safer. We have a responsibility to be rigorous and transparent in the management and resolution of reported vulnerabilities. This is made easier by the fact the platform provides a framework that facilitates relationships between customers and hunters, with very rich and very direct communication. 

We’re in a relationship where we openly discuss findings on how to analyse a vulnerability. There is no other way to have such productive communication.

We’re working on standardizing the integration of tickets generated by vulnerability reports into our global risk management model. The goal is to unify our risk management regardless of the information source – whether it’s a proven incident or a vulnerability report. It’s about taking advantage of the full potential of APIs to further automate reporting.

We’ve also identified certain hunters who are particularly strong on our public program, with whom we have excellent relationships, or who have very specific skills. We plan to invite these experts onto programs dedicated to specific products. That will probably happen this year.

If you want more informations about Bug Bounty & YesWeHack, drop us a line:

How cloud providers use bug bounty to increase customer trust

 actors, the application aims to ensure reliable contact tracing as France progressively loosens the country-wide lockdown. Following a recommendation from 

, the StopCovid project team has opted for the highest possible transparency and security for the app users. 

’s community of ethical hackers will aim to identify every potential weakness in the app. Those vulnerabilities are reported directly to the StopCOVID project team.

With this innovative security approach, the StopCovid project team underlines the importance of information security and data protection in the fight against COVID-19. France is also the first country to secure its contact tracing app through bug bounty.

The security audit of the StopCovid contact tracing app in France starts today as a 

 with 20 European ethical hackers selected from the YesWeHack community. The app is to be launched in June. By debuting the bug bounty before the app’s official release, the consortium ensures StopCovid will provide the best possible security to its end users. Once the app is released, the 

—the vulnerability hunt will open to all ethical hackers, thus harnessing the combined efforts and insights of YesWeHack’s 15,000-plus strong community.

Every vulnerability will be reported through YesWeHack directly to the StopCovid project team. Each report contains both the specific detail of the vulnerability and suggestions for remediation to speed up fixing.

By mobilising the YesWeHack ethical hacker community, swarm intelligence and continuous security audit strive to ensure an optimal security level for France’s contact tracing app. A proven, turnkey approach befitting all types of organisations in their aspiration to repel brazen cyber criminals, bug bounty continues to revolutionise Information Security.

YesWeHack continues to guarantee the security of essential digital assets

YesWeHack is a long-standing partner of government agencies, including the French Ministry of Defense, the 

Direction interministérielle du numérique

), France’s digital transformation agency, and Cybermalveillance.gouv.fr the French platform for prevention and assistance to victims of cyberattacks (see the 

). Also, Europe’s Bug Bounty leader brings together 

 that seek to improve the security of their digital assets thanks to ethical hackers. Those receive a bounty (a reward) for security flaws they identify.

The development of the StopCovid contact tracing app is carried out free of charge by all parties involved. Thus, YesWeHack will bear the cost of the bounties to be awarded.

“As a critical part of the our country’s toolset against COVID-19, it is vital that our data is safe from cyberthreats. We are proud to be able to contribute to reinforce security in the current exceptional situation,” says Guillaume Vassault-Houlière, CEO and co-founder of YesWeHack.

YesWeHack is the #1 European Bug Bounty & VDP Platform

. YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cyber-security experts (ethical hackers) across 120 countries with organizations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices. YesWeHack runs private (invitation-only) programs, public programs and vulnerability disclosure policies (VDP) for hundreds of organizations worldwide in compliance with the 

Should you require further detail, please get in touch with press@yeswehack.com

YesWeHack ensures the continuous security of France’s COVID-19 contact tracing app

The ‘first contact’ is the establishment of a conversation between the security researcher having discovered a vulnerability and the manager of the information system affected; it is the nerve centre of efficient coordinated vulnerability disclosure. How do we enable ‘first contact’ then? We have listed the tools that make it possible in a nifty infographic (in English and

Security researchers can make significant contributions to increasing products’ digital security. Yet, ‘first contact’ is hard to establish. More broadly, even when a vulnerability is reported, editors may prefer not to acknowledge it. This silence often drives security researchers to resort to public disclosure as a means of pressuring the publishers to correct the vulnerability.

So, how should one address the discovery and interaction intended to correct a vulnerability when this identification is by an individual outside the organisation? Different means exist to promote 

The ‘first contact’ is the establishment of a conversation between the security researcher having discovered a vulnerability and the manager of the information system affected; it is the nerve centre of a CVD. How do we enable ‘first contact’ then?

An organisation hosts a CERT or uses such a service via a managed services company. It is thus possible to direct all vulnerability disclosure reports to the CERT, which will then ensure coordination of the stakeholders, acting as counsel, intermediary and communicator. Likewise, CERTs are in the best position to preserve necessary pre-disclosure discretion. CERTs ensure there is time to fix. They also monitor the assets in question guaranteeing the vulnerability has not been rediscovered or exploited meanwhile.

It is easy to appreciate the need to inform the essential operators, who would be concerned by a given risk, as well as State services crucial to the Nation’s survival. Hence, the management by a CERT ensures such information reaches the third parties concerned in a privileged and fast manner. The communication circle can evolve before the patch reaches all users, thereby avoiding all malicious use. For example, the CERT-EU facilitates such interactions between the various national CERTs.

Given the difficulty in identifying an entry point allowing for the escalation of vulnerabilities, experts from the cybersecurity community have proposed 

: a file named security.txt, located at a known place in the tree structure of each website. That location needs to remain the same across websites; it is the following: www.mywebsite.tld/.well-known/security.txt.

Various organisations, including BlaBlaCar, Facebook and Google have already adopted this communication channel. For now, security.txt is still a draft standard. Indeed, the project has been submitted to the IETF (Internet Engineering Task Force, an international workgroup that participates in the development of Internet standards) for review and eventual adoption as a standard.

 is a non-partisan non-profit platform which enables vulnerability reporting while maintaining anonymity for the discoverer. Thanks to ZeroDisclo, disclosure can also occur 

 the Tor Browser. Regardless of the web browser the report submitter uses, the report is encrypted with the receiving organisation’s public key, then signed and timestamped by a blockchain. The site sends the report (to a private or national CERT), and the researcher receives a certificate as proof of deposit.

. Indeed, it formalises the report through various criteria enabling the calculation of a CVSS severity score. Even more important, thanks to the report’s encryption, ZeroDisclo acts as a secure ‘transmission belt’. At no time does the platform or the individuals administering it access the details of the vulnerability described.

Thus, coordinated vulnerability disclosure is effortless. Also, ZeroDisclo does not accumulate a dangerous knowledge of the bugs affecting third-party information systems.

Bug Bounty: the comprehensive approach to coordinated vulnerability disclosure

, also known as crowdsourced security, is a collective means of testing the security of a product or service. Each vulnerability receives a reward by the manager of the system concerned according to its severity and thus the risk that its subsequent remediation reduces. In its current version, a Bug Bounty platform brings together international ethical researchers. These platforms enable coordination between an organisation that wants to test the security of its systems and a community of ethical hackers who receive recognition and compensation for their discoveries.

A Bug Bounty program submits a digital service (a website, an API, a mobile application) or a product (a connected car) to ethical hackers for them to examine for potential vulnerabilities. In the case of public Bug Bounty programs, any ethical hacker subscribed to the platform can participate. If the program is private, only a group of preselected hackers takes part.

Bug Bounty is a future standard for cybersecurity in that it materialises collective responsibility for the reduction of digital risk. It embodies the transition (somewhat contrary to popular wisdom) from centralised control of information security towards a ‘decentralised’ approach. The latter is possible through the involvement of a community of ethical hackers. Besides, this securing by the community reduces the number of vulnerabilities likely to be sold to intermediaries with unclear, if not dishonest, motives. Indeed, through Bug Bounty, the researcher who reports a vulnerability receives a financial reward and bolsters their social capital.

Summing up: ways to mobilise collective intelligence

The global and lasting reduction of risk will come from the cooperation of both public and private actors. An international model in this field is essential to avoid all uncoordinated public disclosure. As such, guaranteeing protection for ethical security researchers is paramount. The issue of information sharing is thus crucial, and private actors play an essential role at this stage. Thus, 

the VDPFinder plug-in for Chrome and Firefox

 showcases whether a website one browses has an existing CVD policy. The latter can be an email to a CERT, a security.txt or an ongoing Bug Bounty program.

We have created the infographic below to summarise the implementation approaches for vulnerability disclosure.

 Looking for a handy infographic to help you raise awareness about roles and responsibilities in vulnerability disclosure? 

Mobilising collective intelligence for better security

Since 2015, Firebounty has been helping users discover

disclosure policies (VDPs). For policy discovery on steroids, we have partnered with

, the ‘Internet SIEM’. Read on to find what this boost means for coordinated disclosure.

 exists since 2015 with the primary purpose of allowing security researchers to find disclosure policies of any kind, be it ‘Hall of Fame’ or Bug bounty programs paying rewards. So far, FireBounty harbours thousands of Vulnerability Disclosure Policies (VDPs). Thus, Firebounty is already the world’s most complete VDP directory.

—a one-of-a-kind tool making VDP discovery as effortless as web browsing itself. Thanks to the witty combination of FireBounty’s up-to-date and exhaustive database and VDPFinder’s ease of use, everyone knows in a glimpse how to report a vulnerability and where doing so is rewarded through a Bug Bounty program.

We have been ramping up FireBounty’s capabilities. In our quest to identify and index all VDPs out there, we have been testing a range of solutions. That is how we got to play with ONYPHE. A young, like-minded security-oriented endeavour, ONYPHE goes with the leitmotif ‘Your Internet SIEM’.

Sounds cool, eh? Read on–it gets better.

Security.txt <3 FireBounty: VDPs for anyone to use

, security.txt allows each organisation to create its VDP in a breeze. Doing so happens through a text file located in a defined, well-known path of its website. Imagined by 

, security.txt is becoming a de facto standard, adopted by large corporate websites and personal webpages alike.

Since FireBounty harbours VDPs web over, it is natural to add security.txt to it. Sure thing—but do we need to crawl, like, the 

 web to achieve this? Besides, bot-spidering websites regularly can lead to a variety of misinterpretations and side effects we ought to avoid.

We first tried to discover criteria to guess whether a website is likely to expose security.txt. By using certificate transparency to discover and check websites, we tested different criteria (

 country, certificate authority). But the approach was quick yielding no meaningful correlation with any criterium, and a meagre bunch of security.txt scattered therein.

So there we were, facing the whole internet alone with our powerful yet insufficient crawlers. We logically turned to Shodan, and it worked in a specific manner, providing us with more than 1,500 security.txt. We can do better, however.

ONYPHE is a young French company defining itself as 

. Its active scan of the whole internet—and not only the web–is coupled with other useful sources such as threat list, geolocation data, passive DNS, paste sites and even the darkweb. Thus, ONYPHE collects and indexes a tremendous amount of data.

Naturally, harbouring data is only part of the story. ONYPHE then offers the capacity to easily query these troves of information in a single search form or API. Doing so is how one effortlessly identifies the proverbial needle in the different information categories haystack (

 datascan, synscan, pastries, resolver, ctl, onionscan and many others).

And, last but not least, ONYPHE—just like 

—is founded by security enthusiasts with a deep understanding of the technical challenges practitioners face in their everyday work. Through its innovative approach, it aims to improve tools, so contributing to better cybersecurity for all.

Amongst the cool things Onyphe can do is directing its sensors and tailoring its search to find data, located deep down in a protocol structure—or, like security.txt, in a specific, well-defined path. (Shhhhh, it’s thanks to that feature that 

 actual exposures to the latest top 0-days or internet spread of famous botnets.)

ONYPHE adapted its crawlers to extract security.txt and exposed it 

 its comprehensive API. We now have everything we need to continue identifying security.txt. Since 27 April, a new logo features on many policies listed at FireBounty. Indeed Firebounty daily indexes new security.txt retrieved by ONYPHE. And it now exceeds 3,200 policies ?

We are delighted to see that many VDPs are surfacing. The increasing number of organisations devising a clear path to coordinated vulnerability disclosure indicates that a growing number of people works towards better cybersecurity. Similarly, an ever-growing number of ethical hackers makes use of existing VDPs.

While that effort is commendable, it is vital to remind everyone that a VDP is quite often a passive listening mechanism. FireBounty and VDPFinder aim at showcasing the efforts to quell wild vulnerability disclosure. They are in no way an incentive to aggressively hunt or, worse, ask for a financial reward upfront promising to “disclose if you pay me” where no monetary reward is envisioned. We are 

Let’s keep on making the Internet safer—to infinity and beyond!

Founded in 2013, YesWeHack is the #1 European Bug Bounty & VDP Platform.

YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cyber-security experts (ethical hackers) across 120 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

YesWeHack runs private (invitation based only) programs, public programs and vulnerability disclosure policies (VDP) for hundreds of organisations worldwide in compliance with the strictest European regulations.

FireBounty x ONYPHE: Surfacing disclosure policies gets a boost

YESWEHACK PROPHILE ON HISXO

of ours is somewhat special: it tells tales

about the journey from a private bug bounty to a public one.

Olvid, a thriving start-up, made the leap in only four months. Here’s how they did it.

 is an instant messaging (IM) application whose security does not rely on any trusted third party. Unlike other IM applications – such as Signal, WhatsApp, and Telegram which use a central directory to establish secure channels – Olvid does not need a directory. This eliminates:

The risk of a significant hack/leak if an attacker takes control of that directory.

The need for Olvid to collect any personal data, for example, no phone number, name, or email.

Owing to this new security model and the innovative cryptographic protocols implemented, Olvid offers users:

A strong guarantee on the identity of its contacts, without any risk of identity usurpation, fraud, spam, etc.

Total anonymity towards third parties, including our own servers.

At Olvid, we re-implemented everything from scratch. We rely on a minimum of third-party libraries and we have designed the entire application in house.

Having new cryptographic protocols, we needed our implementation to be validated as widely as possible. To achieve that, we worked on three axes:

A ‘theoretical’ ve­­rification of the cryptography, by 

French National Centre for Scientific Research

. This mathematically proves that our protocols delivers the security guarantees that we claim;

 (National Cybersecurity Agency of France requirements);

A bug bounty program mobilising thousands of cybersecurity researchers looking for exploitable vulnerabilities in every corner of our application.

For us, this last verification stage is essential. When you sell a security application, you certainly do not want a hacker to brag about having found a vulnerability in it!

If we want to protect our application from hackers, it must be evaluated by people who use their exact methods and thought process.

We had the opportunity to participate in 

’s Live bug bounty at the International Cybersecurity Forum (FIC). We began our bug bounty experience here being hacked live for two days! We don’t regret it – it was an incredible experience. The event gave us the opportunity to discuss our application with cybersecurity researchers; and it was a very instructive experience, from both technical and business aspects.

You’re now expanding your private program into a public one. What prompted this choice?

, only a few vulnerabilities were reported by the 20 or so participating researchers. None of these were severe.

We deduced from this that our system is robust enough to welcome 

’s entire community. We now want to take advantage of one of bug bounty’s major strengths, crowdsourcing: tens of thousands of researchers bringing different skill sets and methodologies to test the security of our application.

The reason for our move to a public program is simple: we want to offer our users the best possible security guarantee. The more hunters scanning and attacking our app, the better it is for everyone!

Any tip for startups thinking of launching a bug bounty program?

Stop doubting right now! You’ve got to do it! It is indeed a bit scary at first to think that people will actually try to attack your product; but that’s fine, as long as you have the right people doing it.

I guess it’s comfortable to live in denial, thinking that if no-one has succeeded to attack us yet, we’re safe. However, one day, an attack will happen. And the only way to be better prepared for this is to test your application. Penetration testing and certifications are very important as they provide ‘stamps’ that we can show to our clients.

Continuous monitoring by expert hunters validating every new update is critical for every business in today’s world.

Hunters, go ahead. Attack us. We’re waiting! There’s still money to be taken from our wallet 🙂

To learn more about Olvid’s bug bounty program or to start hacking on it, click

Founded in 2015, YesWeHack is the #1 European Bug Bounty & VDP Platform.

Olvid, the ultra-secure messaging app, moves to public bug bounty program

Vulnerability disclosure must be coordinated to be responsible and is an opportunity to empower the various participants. Coordination means that stakeholders understand their roles and responsibilities. Here’s a handy infographic to put confused minds at ease. It is available in English and

The number of connected digital services (Internet, Bluetooth, etc.) grows. And with it, the issue of vulnerability disclosure management is becoming increasingly urgent. Unknown vulnerabilities constitute a risk. System managers, software publishers and their users must be able to identify that risk to fix. Appropriate management and disclosure of all vulnerabilities are essential for reducing digital security risks.

The question of vulnerability disclosure management is gradually becoming more urgent as the number of connected digital services (Internet, Bluetooth, etc.) increases. Yet, this issue is not new: ever since we began creating digital products and services, the subject of vulnerability disclosure has ignited debates within the information security community.

Creating software that meets all security requirements is no small challenge. It is thus crucial to identify and correct vulnerabilities as fast as possible to prevent their mobilisation by malicious individuals. Information systems are better protected when vulnerabilities are discovered and dealt with.

Vulnerability disclosure must be coordinated to be responsible. It is also an opportunity to empower the various stakeholders. All digital service providers, both public and private, are responsible—not only for the development of the best software possible but also for the responsible management of vulnerabilities.

NEW TO COORDINATED VULNERABILITY DISCLOSURE?

WE’VE GOT YOU COVERED: READ OUR WHITE PAPER.

Identifying a bug is within reach of many individuals. There is no need to work inside a company to recognise a malfunction leading to a security risk. Well-intentioned individuals often identify vulnerabilities and then seek to 

Obstacles to coordinated vulnerability disclosure

Besides, it is a far more delicate situation for an individual outside of the organisation to report the vulnerability. It is impossible to address vulnerability disclosure without considering the motivations of the individuals reporting the bugs in an information system. Depending on the answer to this question, legal penalties may apply. Such legal uncertainty is a frequent hurdle to reporting a vulnerability.

Another obstacle to coordinated disclosure is the absence of a clear and secure communication channel enabling the escalation of active vulnerabilities. Indeed, most organisations with an online presence have no means dedicated to receiving reports of information system bugs. This deficiency explains in part why the organisation in question remains silent in response to reports from well-meaning individuals. This silence endangers the users of the vulnerable service.

Last but never the least, disclosure without anticipating the remediation timeline can also lead to negative consequences for the users.

These issues underscore the need for a transparent and smooth decision-making process. It ensures the digital security of individuals as well as public and private stakeholders and protects the rule of law online.

Clear roles and responsibilities are part of the right answer

Hence, the challenge is to get an ethical hacker who had found a vulnerability to report it to a system manager. The latter can then fix it and mitigate the relevant user risks without harming the hacker in the process. It is thus necessary to put in place a vulnerability disclosure system that benefits all stakeholders. You guessed that right: it is coordinated vulnerability disclosure (CVD). The latter is structured cooperation where ethical hackers report vulnerabilities to the manager of the information system in question.

Any company or public organisation can implement CVD and enable a direct report of the vulnerability to the most relevant entity. It can also involve an intermediary. In both cases, the approach is a coordinated vulnerability disclosure. That process allows an organisation to remedy the loophole before any detailed information concerning it goes public, with all of the negative implications that this can cause.

We have created the infographic below to better grasp the roles and responsibilities of the various participants to a CVD.

 Indeed, knowing who does what to reduce digital risk must not be a modern 

. Below, you can download the high-resolution file in English and 

Roles and responsibilities for efficient vulnerability disclosure

Adopt a proactive security posture now

Harness the power of crowdsourced security to supercharge the discovery and remediation of vulnerabilities.

The YesWeHack Blog

YESWEHACK PROPHILE ON SONNY

A framework for successful vulnerability disclosure policy

How cloud providers use bug bounty to increase customer trust

YESWEHACK PROPHILE ON SONNY

YesWeHack ensures the continuous security of France’s COVID-19 contact tracing app

Mobilising collective intelligence for better security

FireBounty x ONYPHE: Surfacing disclosure policies gets a boost

YesWeHack ensures the continuous security of France’s COVID-19 contact tracing app

YESWEHACK PROPHILE ON HISXO

Olvid, the ultra-secure messaging app, moves to public bug bounty program

Roles and responsibilities for efficient vulnerability disclosure

YESWEHACK PROPHILE ON HISXO

Don't wait for threats to strike

Products

Researchers

Resources

Company

Follow us