Responsible Disclosure

Responsible Disclosure refers to the disclosure of newly discovered security vulnerabilities. It should be done responsibly. This means in such a way that cybercriminals can exploit the discovered vulnerabilities as little as possible.

What exactly does Responsible Disclosure mean?

There are independent ethical hackers who check websites, programs, apps and the like for security vulnerabilities. Not in order to criminally exploit them. But to help close these gaps.

Typically, ethical hackers report the vulnerability to the company whose software, website or app is affected. They give them a reasonable amount of time to close the gap. Only then do they inform the public about it. The aim of this approach is to prevent cybercriminals from exploiting the vulnerabilities.

If a company delays or refuses to close the security gap, this can cause a dilemma for ethical hackers. This is because cybercriminals specifically look for vulnerabilities to exploit for their own purposes. Therefore, it is likely that a vulnerability discovered by ethical hackers is already known to at least some cybercriminals.

With this in mind, ethical hackers may decide to make the vulnerability public even though it has not yet been closed. This usually creates strong pressure on the company to close it quickly.

Where do I face Responsible Disclosure in everyday life?

Responsible Disclosure mainly concerns companies. For example, if ethical hackers discover a security vulnerability in your web presence, they will try to bring it to the attention of the appropriate person or department in your company.

What can I do to improve my safety?

Security breaches can cause serious damage to your company. Therefore, make it easy for ethical hackers to report potential security gaps according to the principle of Responsible Disclosure. Many companies set up a sub-page on their website for this purpose, often under the keyword “Responsible Disclosure”.

• Consider with the relevant professionals or departments how you want to – and can – handle vulnerability reporting.
• Set up a special email address for Responsible Disclosure notices, for example security@beispiel.de
• Even better than an email address: Set up a reporting form that allows you to get detailed information.
• Provide contact details and, if necessary, further information on your website.
• Communicate the expected timeframe for responding to reports and for closing reported vulnerabilities.
• If your preparations are rewarded by a report, respond in a professional, transparent and appreciative manner.