But Now I See - a Vulnerability Disclosure Maturity Model

Transcription

1 SESSION ID: HT-R04F But Now I See - a Vulnerability Disclosure Maturity Model

2 Who the FSCK Are You? What is it you do here? Chief Policy Officer, HackerOne Former Microsoft Security Strategist Former Hacker for Hire ISO Standards Editor New America Foundation Fellow MIT Sloan Visiting Scholar Harvard Belfer Affiliate 2

3 Measuring Our Maturity How would you answer these questions? When someone s who responds? How quickly? Would my company s legal department threaten a well-intentioned hacker who came to us with a valuable bug? 3

4 Measuring Our Maturity Does engineering prioritize the importance of product features alongside security bugs that come in from the wild? If a reporter asked my CEO about a breach reported at our company, would she know what steps were taken to ensure user safety? Is $10,000 is too much, too little, or just right to offer a hacker for a bug? 4

5 The 5 Key Elements of Vulnerability Coordination Maturity

6 Vulnerability Coordination Maturity Model Analytics New model for organizations to assess maturity of their vulnerability coordination process Organizational Incentives Engineering Communications 6 Model guides how to organize and improve efforts inside and outside of an organization 5 Capability Areas: Organizational, Engineering, Communications, Analytics and Incentives 3 Maturity Levels for each Capability: Basic, Advanced or Expert Companies can benchmark their capabilities against the industry

7 Organizational People, process, and resources to handle potential vulnerabilities Level Basic Advanced Capability Executive support to respond to vulnerability reports and a commitment to security and quality as core organizational values. Policy and process for addressing vulnerabilities according to ISO and ISO 30111, or a comparable framework. Expert You have executive support, processes, budget and dedicated personnel for handling vulnerability reports. 7

8 8

9 Engineering Capabilities to evaluate and remediate security holes, and improve software development lifecycle Level Basic Capability Clear way to receive vulnerability reports, and an internal bug database to track them to resolution. See ISO Advanced Dedicated security bug tracking and documentation of security decisions, deferrals, and trade-offs. Expert Use vulnerability trends and root cause analysis to eliminate entire classes of vulnerabilities. See ISOs 29147, 30111,

10 10

11 Communications Ability to communicate to audiences internally and externally about vulnerabilities. Level Basic Capability Ability to receive vulnerability reports and a verifiable channel to distribute advisories to affected parties. See ISO Advanced Tailored, repeatable communications for each audience, including security researchers, partners, customers, and media. Expert Structured information sharing programs with coordinated distribution of remediation. 11

12 12

13 Analytics Data analysis of vulnerabilities to identify trends and improve processes. Level Basic Capability Track the number and severity of vulnerabilities over time to measure improvements in code quality. Advanced Use root causes analysis to feed back into your software development lifecycle. See ISOs 29147, 30111, Expert Track real-time telemetry of active exploitation to drive dynamic pivots of remediation strategy. 13

14 14

15 Incentives Ability to encourage security researchers to report vulnerabilities directly. Level Basic Capability Show thanks or give swag. Clearly state that no legal action will be taken against researchers who report bugs. Advanced Give financial rewards or bug bounties to encourage reporting the most serious vulnerabilities. Expert Understand adversary behavior and vulnerability markets, and structure advanced incentives to disrupt them. 15

16 16

17 Measuring Success in Vulnerability Disclosure A look at 100+ Companies

18 Measuring Success in Vulnerability Disclosure Survey Data N=194 IT/Security Professionals Collected between Sept Jan via online survey 18

19 Measuring Success in Vulnerability Disclosure Analytics Capability Mean Score Analytics 1.52 Communications 1.38 Engineering 1.49 Incentives 1.09 Organizational 1.59 Organizational Incentives Engineering Communications 19

20 Avg. By Industry (min. 10 respondents) Industry Sample Size Analytics Communications Engineering Incentives Organizational Education Finance Government Healthcare Manufacturing Other Technology - B2B Technology - B2C Technology - Mobile Apps Unknown Green = 1 σσ above Red = 1 σσ below Bold = 2σσ above or below 20

21 Measuring Success in Vulnerability Disclosure Rank of Industry by Capability, min. 10 respondents (1 = best, 10 = worst) Analytics Comms Engineering Incentives Organizational Finance Technology Mobile Apps Technology - B2B Healthcare Manufacturing Government Unknown Education Technology - B2C Other

22 Technology B2B vs Overall Average Overall Average Analytics Technology - B2B Organizational Communications Incentives Engineering 22

23 Government vs Overall Average Overall Average Analytics Government Organizational Communications Incentives Engineering 23

24 Finance vs Overall Average Overall Average Analytics Finance Organizational Communications Incentives Engineering 24

25 Sample Company Riot Riot vs. VCMM Average Average Riot Analytics Capability Average Riot Analytics Comms Engineering Incentives Org Organizational Incentives Engineering Comms

26 Sample Company Adobe Adobe vs. VCMM Average Average Adobe Analytics Capability Average Adobe Analytics Comms Engineering Incentives Org Organizational Incentives Engineering Comms

27 Sample Company ToyTalk ToyTalk vs. VCMM Average ToyTalk Average Analytics Capability Average ToyTalk Analytics Comms Engineering Incentives Org Organizational Incentives Engineering Comms

28 Next Steps Continue to gather data Non self-reported Larger sample size Multi-vendor coordination is needed 28

29 Put Your Organization To The Test Where Do You Rank

30 Apply Take the free maturity assessment within minutes at hackerone.com/vulnerability-coordination-maturity-model 30

31 Appendix 31