Re: [Full-disclosure] To disclose or not to disclose

Elazar,
I suppose that could be a good action, but doing that would potentially
put the security companies customer at risk. Granted, in the argument
they were already notified of the risk. So the question is, is that the
ethical choice? Is that a good business choice?


Elazar Broad wrote:
I would opt for #1, additionally, contacting CERT and other quasi-
government security organizations would be a plus, they might have
better luck lighting a fire under the theoretical vendors ass...

elazar

On Sat, 27 Sep 2008 03:39:34 +0000 Simon Smith <simon@xxxxxxxxxxx>
wrote:
Greetings,
I have a theoretical question of ethics for other security
professionals that participate in this list. This is not an actual
situation, but it is a potentially realistic situation that I'm
interested in exploring and finding an acceptable solution to.

Supposed a penetration testing company delivers a service to a
customer. That customer uses a technology that was created by a
third
party to host a critical component of their infrastructure. The
penetration testing company identifies several critical flaws in
the
technology and notifies the customer, and the vendor.

One year passes and the vendor had done nothing to fix the issue.
The
customer is still vulnerable and they have done nothing to change
their
level of risk and exposure. In fact, lets say that the vendor flat
out
refuses to do anything about the issue even though they have been
notified of the problem. Lets also assume that this issue affects
thousands of customers in the financial and medical industry and
puts
them at dire risk.

What should the security company do?

1-) Create a formal advisory, contact the vendor and notify them
of the
intent to release the advisory in a period of "n" days? If the
vendor
refuses to fix the issue does the security company still release
the
advisory in "n" days? Is that protecting the customer or putting
the
customer at risk? Or does it even change the risk level as their
risk
still exists.

2-) Does the security company collect a list of users of the
technology
and notify those users one by one? The process might be very time
consuming but by doing that the security company might not
increase the
risk faced by the users of the technology, will they?

3-) Does the security company release a low level advisory that
notifies
users of the technology to contact the vendor in order to gain
access to
the technical details about the issue?

4-) Does the security company do something else? If so, what is
the
appropriate course of action?

5-) Does the security company do nothing?

I'm very interested to hear what people thin the "responsible"
action
would be here. It appears that this is a challenge that will at
some
level create risk for the customer. Is it impossible to do this
without
creating an unacceptable level of risk?

Looking forward to real responses (and troll responses too...
especially
n3td3v).

--

- simon

----------------------
http://www.snosoft.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

--
Self Storage Options - Click Here.
http://tagline.hushmail.com/fc/Ioyw6h4eNgR1BRhFB3CXCR61VEtfAqJ45ZV34qDMKcjsXBCGM0kWG5/



--

- simon

----------------------
http://www.snosoft.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: Use Case Point Estimation
    ... the risk management plan and customer change control system. ... Software development is pretty much like management - its both an art ... Apply the metrics techniques to that, ...
    (comp.object)
  • [Full-disclosure] To disclose or not to disclose
    ... That customer uses a technology that was created by a third ... One year passes and the vendor had done nothing to fix the issue. ... level of risk and exposure. ... refuses to fix the issue does the security company still release the ...
    (Full-Disclosure)
  • Re: Use Case Point Estimation
    ... I've combined it with an estimation for a minimum and maximum effort to get an idea of possible risk. ... Even historical data might prove to be false for the next project. ... The estimates are then refined taking into account the results of risk analysis - which is a subset of the requirements analysis phase initially - but an ongoing process throughout the project - which is why estimates are always refined. ... and in order to do some analysis you've probably already given the customer an estimate - which cant actually be done accurately until you have the Use Case. ...
    (comp.object)
  • Re: script for processing donations
    ... Risk cannot be avoided, you simply have to do some risk ... services or product the customer receives is ... Shared Hosting, Reseller Hosting, Dedicated & Semi-Dedicated servers ...
    (alt.html)
  • Re: script for processing donations
    ... if a customer srews you, ... Risk cannot be avoided, you simply have to do some risk ... Shared Hosting, Reseller Hosting, Dedicated & Semi-Dedicated servers ...
    (alt.html)