Our AI strategy for preemptive security
A vulnerability disclosure policy (VDP) is a published set of rules telling security researchers how to test your systems and report what they find. Every VDP does five things: it states your commitment, promises safe harbor from legal action, sets testing guidelines, defines what is in scope, and explains how to submit a report.
Ethical hackers or security researchers can help organizations improve the security of their networks, systems, and applications. In order to do this, ethical hackers are retained on contracts for outsourced traditional penetration testing, or, the new and more rapidly growing model for crowdsourced security penetration testing. In many instances ethical hackers will identify discovered vulnerabilities based upon goodwill and without the expectation of remuneration for their services.
To be effective, ethical hackers have to think like the attackers they are standing in for — probing defences the way a real adversary would, then stopping at the point where a limited proof of concept establishes the finding without putting production systems at risk. Ethical hackers must take active measures to probe cyberdefenses for vulnerabilities which would allow them to position a successful cyber attack. The success of ethical hackers in identifying vulnerabilities reduces or eliminates the potential opportunity for the next real malicious threat actor.
Interaction with ethical hackers must be subject to important ground rules agreed upon between the ethical hacker and the organization. The most important ground rules for engagement are set out in a vulnerability disclosure policy.
The introductory section provides background information on the organization and its commitment to security and more. This section explains why the policy was created and the goals of the policy. It is a statement of good will and encouragement – reporting vulnerabilities is of potentially high value. A vulnerability report can reduce risk and potentially eliminate the expense and damage to reputation caused by a successful cyberattack. Keep in mind that creating and publishing a VDP is a binding operational directive as outlined by the Cybersecurity & Infrastructure Security Agency (CISA).
This section explicitly declares the organization’s commitment not to take legal action for security research activities that follow a “a good faith” effort to follow the policy. The authorization and safe harbor clearly states that good faith efforts will not result in the initiation of legal action. The language recommended by CISA for government agency vulnerability disclosure policy authorization and safe harbor is:
“If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized. We will work with you to understand and resolve the security issue quickly, and AGENCY NAME will not recommend or pursue legal action related to your research. Should legal action be initiated by a third party against you for activities that were conducted in accordance with this policy, we will make this authorization known.”
Guidelines further set the boundaries of the rules of engagement for ethical hackers and potential sensitive information found. Guidelines may include an explicit request to provide notification as soon as possible after the discovery of a potential security vulnerability. It is common that exploits should only be used to confirm a vulnerability. Researchers should limit testing to the minimum proof of concept required to demonstrate impact and should not exfiltrate data, establish command line access, or otherwise expand access beyond what is necessary to report the issue. Many vulnerability disclosure policies request that discovered exploits or vulnerability discovery activities not be used to further compromise data, establish persistence in other areas, or move to other systems. These guidelines help ensure security issues are reported responsibly without creating additional exposure for the organization, its users, or connected systems and services.
Scope provides a very explicit view of the properties and internet connected systems which are covered by the policy, this should include whether testing is permitted on production systems, staging environments, APIs, cloud assets, third-party integrations, or other systems and services, the products to which it may apply, and the potential vulnerability types that are applicable. Scope should also include any testing methodologies which are not authorized. For example, it is most typical that VDPs don’t allow Network denial of service, Denial of Service (DoS or DDoS), Resource Exhaustion, attacks or attacks of a more physical nature such as attempting to access the facility. It is often the case that social engineering, perhaps through phishing, is also not authorized. Situations vary and it is important to spell out exactly what is permissible and what is not.
Process includes the mechanisms used by ethical hackers to correctly report vulnerabilities. This section includes instructions on where the reports should be sent with proprietary information. It also includes the information that the organization requires to find and analyze the vulnerability. This may include the location of the vulnerability, the potential impact and other technical information required to identify and reproduce the vulnerability. When appropriate, reports may also include a safe proof of concept, affected systems and services, evidence of potential access to sensitive data, and clear steps to reproduce the finding without exposing personal data. It also should include information about the timeframe for the acknowledgement of receipt for the report.
Best practice is to allow ethical hackers the option of submitting vulnerability reports anonymously without disclosing contact information. In this case the vulnerability disclosure policy would not require the submission of identifying information.
The Cybersecurity and Infrastructure Security Agency (CISA) publishes a vulnerability disclosure policy template https://cyber.dhs.gov/bod/20-01/vdp-template/. The template spells out sections in a policy template for introduction, authorization, guidelines, test methods, scope, reporting a vulnerability, and the expectations and deliverables from both parties.
Other examples of active vulnerability disclosure policies from both government and commercial enterprise referenced as examples are included on their official websites:
U.S. Department of the Interior
U.S. Department of the Treasury
U.S. Department of Health and Human Services
U.S. Department of Education
U.S. Department of Transportation
U.S. Department of Justice
Bank of England
Deutsche Bank
Saxo Bank
Starling Bank
The two are often confused, and organisations frequently need both. A vulnerability disclosure policy is the open door: anyone who finds a flaw learns how to report it safely, and there is no payment. A bug bounty program is the incentive layer on top: a defined scope, a reward schedule tied to severity, and often a vetted or invited group of researchers rather than the whole internet.
A VDP is the sensible first step. It costs nothing to publish, it gives you a legitimate channel for reports that would otherwise arrive by cold email or not at all, and it establishes the intake process you will need before rewards make sense. Add a bounty once you can reliably triage and remediate what comes in — paying for findings you cannot act on creates frustration on both sides.
Responsible disclosure allows for the disclosure of a vulnerability only in a timeframe subsequent to the elimination of the vulnerability. Developers and vendors may need a considerable amount of time to patch the vulnerability. By limiting the information flow it can be argued that risk will be lower since less threat actors may be aware of the vulnerability. This is especially important when the vulnerability could allow an attacker to exfiltrate data, disrupt production systems, or trigger privacy violations. However all it takes is one motivated threat actor to discover the vulnerability on their own. In this scenario responsible disclosure may give knowledgeable threat actors more time to exploit the weaknesses and complete a successful breach. Vulnerability disclosure policies generally specify the need for responsible disclosure. Responsible disclosure is by far preferred by the impacted organizations.
Full disclosure is the other side of the spectrum. If an ethical hacker has done everything possible to alert an organization of a vulnerability, and has been unsuccessful, then full public disclosure could emerge as an option of last resort. Publicly disclosing vulnerabilities pivots the playing field towards an assumption that there is always a threat actor that is aware of any vulnerability. Therefore the newly discovered vulnerability presents significant risk, and must be disclosed as early as possible. In this scenario the disclosure puts pressure on the affected parties to move rapidly to take necessary precautions. On balance, the use of full disclosure trades the risk of exploitation and wider investment in the reported vulnerability for wider vulnerability research support and advanced preparation by cyber defenders. Decisions for full disclosure are usually made by the ethical hacker, but are not encouraged by the organization impacted.
ISO/IEC 29147:2018 covers how vulnerabilities in products and services should be disclosed, and ISO/IEC 30111:2019 sets out how an organisation should process and remediate the reports it receives.
ISO also provides guideline https://www.iso.org/standard/69725.html which shares requirements and recommendations for how to process and remediate potential vulnerabilities.
Bugcrowd connects companies and their applications to a Crowd of highly specialized security researchers. The Crowd can identify critical vulnerabilities and security issues faster than traditional methods. Powered by the Bugcrowd crowdsourced security platform, organizations of all sizes can run a Bugcrowd program to efficiently test their applications, validate findings through safe proof of concept reporting, and remediate vulnerabilities before they are exploited.
Now that we’ve covered vulnerability disclosure policy, dive deeper into vulnerability disclosure programs in The Ultimate Guide to Vulnerability Disclosure. If you’re interested in setting up your own program, get started today.
What should a vulnerability disclosure policy include?
Five sections: a commitment statement explaining why the policy exists; a safe harbor clause authorising good-faith research; guidelines setting the limits of testing; a scope defining which systems and vulnerability types are covered and which testing methods are prohibited; and a process describing where and how to submit a report, and how quickly you will acknowledge it.
Is a vulnerability disclosure policy legally required?
For US federal civilian agencies, yes — CISA Binding Operational Directive 20-01 requires one. Private-sector organisations are not covered by that directive, though sector regulations and customer security reviews increasingly expect a published policy.
What is the difference between responsible disclosure and full disclosure?
Responsible disclosure withholds details of a vulnerability until it has been fixed, limiting how many people know about an unpatched flaw. Full disclosure publishes immediately, on the assumption that attackers may already know and defenders need to act. Most vulnerability disclosure policies ask for responsible disclosure.
Can researchers report a vulnerability anonymously?
Best practice is yes. A policy should let researchers submit without providing contact details, and should not require personally identifiable information as a condition of reporting.