Stories
Slash Boxes
Comments

SoylentNews is people

US Federal Systems Must be Covered by Vulnerability-Disclosure Policies by March 2021

posted by martyb on Thursday September 10 2020, @07:02PM   Printer-friendly
from the sudden-outbreak-of-common-sense? dept.

upstart writes in with an IRC submission:

US Federal systems must be covered by vulnerability-disclosure policies by March 2021:

A new Cybersecurity and Infrastructure Security Agency (CISA) mandate requires U.S. agencies to implement vulnerability-disclosure policies by March 2021.

The U.S. government's cybersecurity agency CISA has issued a mandate that requires federal agencies to implement vulnerability-disclosure policies (VDPs) by March 2021.

The main purpose of vulnerability-disclosure policies is to ensure that required information, other than confidential business information, is disclosed to the public and shared with relevant parties in a timely, accurate, complete, understandable, convenient and affordable manner.

The move aims at providing government agencies a formal mechanism to receive from security researchers and white-hat hackers reports of vulnerabilities on their infrastructure.

Vulnerability-disclosure policies allow enhancing the resiliency of the government's infrastructure by encouraging meaningful collaboration between federal agencies and the public.

Link to the Binding Operational Directive 20-01.

Original Submission

 
This discussion has been archived. No new comments can be posted.
US Federal Systems Must be Covered by Vulnerability-Disclosure Policies by March 2021 | Log In/Create an Account | Top | 2 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)

  • (Score: 2) by DannyB on Thursday September 10 2020, @07:45PM

    by DannyB (5839) Subscriber Badge on Thursday September 10 2020, @07:45PM (#1049140) Journal

    The move aims at providing government agencies a formal mechanism to receive from security researchers and white-hat hackers reports of vulnerabilities on their infrastructure.

    So I take it that if you report a vulnerability about a federal computer system, that is not a crime to report such vulnerability?

    Does that extend to other servers [wikipedia.org] holding classified information?

    "Hey, Hillary! Your private email server isn't using encrypted email. Just sayin' Get a digital certificate maybe."

    The main purpose of vulnerability-disclosure policies is to ensure that required information, other than confidential business information, is disclosed to the public and shared with relevant parties in a timely, accurate, complete, understandable, convenient and affordable manner.

    Is it okay to disclose this vulnerability information to the public before the problem is fixed? If so, then replace the word "affordable manner" with "hackable manner". Or maybe they mean lower Total Cost of Pwnership.

    --
    Is there a chemotherapy treatment for excessively low blood alcohol level?

  • (Score: 0) by Anonymous Coward on Thursday September 10 2020, @07:56PM

    by Anonymous Coward on Thursday September 10 2020, @07:56PM (#1049144)

    you frauds could stop buying slaveware with extorted money.

(1)