CHAPTER 15 Reporting Security Problems

INTRODUCTION There are two choices that can be made when you find a security problem in some software, hardware or services: 1. Fix the system and move on. 2. Report the findings. When we have decided to report a security problems, we could try contacting: a. the vendor. b. the computer security community. c. the public. d. the press or media.

INTRODUCTION Deciding who to contact normally depends on some factors. There are: 1. The number of people affected by the security problem. 2. Its severity. 3. Either the reporters can supply a workaround themselves or not. 4. Either the vendor who have to produce a patch or not.

FULL DISCLOSURE Full disclosure is a security philosophy that states that all information about a security problem The information including enough details to independently reproduce the problems and should be made available to the public. Advantages: 1. It gave people for the first a glimpse of how insecure product and services really were.

FULL DISCLOSURE 2. It gave people a chance to test their systems for the security problems and to fix them quickly without having to wait for the vendor to react. 3. It pressured vendors to release security fixes quickly and make security a higher priority. 4. It allows people to learn from the mistakes of others and to search for security problems themselves.

FULL DISCLOSURE Disadvantages: 1. It enabling people with less noble intentions to check for the problems in other people’s systems. 2. The bad guys can get benefit from teaching the well-meaning how to find security problems.

PROBLEMS OF REPORTING Reporting security problems may arise some problems. There are: 1. A vendor may sue the person who publishes security problems in their products or services. 2. People may attempt to hold the reporter liable if they get attacked by someone making use of a security problem reported. 3. People will attempt to make use of the information reported in malicious ways. 4. Releasing information about security problems to the public will inform to well-intentioned person.

HOW TO SECURE A system administrator or a vendor can secure from security problems reports by some ways: 1. Monitoring List A system administrator or a vendor should subscribe to vulnerability announcement and discussion mailing lists such as Bugtraq. The mailing lists allow a system administrator keep up with the latest security vulnerabilities and let him know when he should fix his systems.

HOW TO SECURE The mailing lists will give vendors a chance to respond early on the publication of the problem. 2. Vulnerability Databases A system administrator should regularly check publicly available vulnerability databases for problems in products and services deployed or made use of. A vendor should regularly check publicly available vulnerability databases for problems in products and services.

HOW TO SECURE 3. Patches A system administrator should apply patches as top priorities and make sure it is brought to the management for the necessary resources and system downtime. A vendor should make producing security patches the top priority. 4. Response Procedure A system administrator should have a pre- determined written policy of what to do when vulnerability is reported on products or services that he supported.

HOW TO SECURE This should include whether to disable the system temporarily while losing some functionality or put in special monitoring or wait for a vendor or etc. A vendor should have a special contact point, e- mail address and telephone number for security issues. This contact point will follow special security procedures, bypassing the customer service reporting red tape.