English
Menu

Cyber Attacks and Defense in Practice

An outside security researcher has found an undisclosed vulnerability in a company's product. Which of the following is the most appropriate way to proceed according to the idea of coordinated vulnerability disclosure?

  1. ATo inform users quickly, publish full details on the internet on the day of discovery, including the specific method of attack
  2. BReporting to the developer is enough, so even after a fix is released, users are not told that the vulnerability existed
  3. CReport privately to the developer (or a coordinating body), agree on the time needed to prepare a fix, and publish the vulnerability information together with the fix
Show answer and explanation

Answer: C. Report privately to the developer (or a coordinating body), agree on the time needed to prepare a fix, and publish the vulnerability information together with the fix

Publishing details before a fix is available lets attackers exploit the vulnerability first while users have no means of protecting themselves. In coordinated disclosure, the finder reports privately to the developer, the two agree on the time the developer needs to prepare a fix, and the information is published together with the fix (a deadline such as 90 days is often set). In Japan there is the "Information Security Early Warning Partnership" coordinated by IPA and JPCERT/CC, and information on coordinated vulnerabilities is published on JVN. Bug bounty programs, in which companies pay rewards to reporters, also encourage coordinated disclosure by setting out reporting channels and rules in advance.

  • A. Publishing the method of attack before a fix lets attackers exploit it while users have no means of protection.
  • B. The vulnerability information is published together with the fix so that users can judge whether they need to apply it.
  • C. Correct. Private reporting, agreeing on the time frame and publishing together with the fix are the basic flow.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. Which of the following is the main purpose of creating and maintaining an SBOM (software bill of materials)?
  2. A company uses an internal-only library named acme-utils, kept in its internal package repository (private registry). An attacker registered a package with the same name, acme-utils, and a higher version number in a public package repository, and it turned out that, depending on the build settings, the internal build environment could pull in the attacker's package. Which of the following is the most appropriate countermeasure to this "dependency confusion"?
  3. In the SolarWinds incident discovered in December 2020, attackers got into the build environment of IT management software and malicious code was mixed into legitimate updates. The updates were distributed carrying the developer's legitimate code signature. Which of the following is the most appropriate lesson from this incident?
  4. It was found that files containing customer information in cloud object storage could be read by anyone on the internet. Which of the following is an appropriate combination of a typical cause of this kind of leak and a measure to prevent recurrence?
  5. An access key with administrator privileges allowing all operations (a long-lived credential) was written in a configuration file and given to a batch job running in the cloud. Which of the following is the most appropriate revision to reduce the damage if this key leaks?

Comparisons in this topic