The Disclosing of Vulnerable Information - Essay Example

Keeping in mind the situation described above publication of a patch and providing technical information about vulnerability during disclosure can enable users to take protective and preventive action. CERT, a federally funded quasi-government organization, is a key player in the domain of vulnerability disclosure and prioritizes in the publication of preventive measures, such as a patch, in their disclosures.

Certain issues revolve around the disclosing of vulnerable information. These are regarding the timing of the release of patches which is made critical once a vulnerability is disclosed. However, the development of these patches takes time. This component clashes with that of the instant disclosure, which leaves users defenseless against attackers who can exploit the disclosed vulnerability in the time that it takes for a patch to be released. These are the two critical dimensions that an optimal disclosure policy addresses.

For the development of an optimal patch notification policy, it is important to estimate the attacker’s and vendor’s behavior. If the vendors do not act quickly to instant disclosure then the formulation of a policy that incorporates this behavior will be strongly discouraged and socially unfavorable. But even if vendors develop a patch quickly there lays a need to know how the attacker’s probability of attack changes with the disclosure, and with the patching. Other critical elements that the policy incorporates are a thorough investigation of vulnerabilities that are more likely to be exploited by attackers and hence require immediate attention. These are the ones that the vendors need to concentrate on developing patches for.

Keeping in mind all these areas of concern we develop an optimal patch notification policy that balances the issues mentioned above. Simply because a vendor releases a patch more quickly due to an early disclosure does not necessarily make this action optimal. Using a game theoretic model Arora, Telang, and Xu (2003) show that neither instantaneous disclosure nor secrecy policy is optimal. An optimal patch publication policy depends upon underlying factors like how quickly a vendor’s response is in releasing patches, and how likely attackers are to find and exploit unpatched vulnerabilities.

Q2: Here we consider the incentives of the attackers as well as the parties listed previously. What are the incentives of attackers?

When we look at the internet we see how it has developed into a global system of interlinked computer networks which have made possible the exchange of information between millions of organizations. It has made possible new forms of social interactions as well as means to probe them. The internet is a unique tool for studying the development and organization of a complex system. This is why numerous attackers are attracted to the use of methods to hack into and manipulate various online systems.

There are many classifications of hackers based on the incentives behind their attacks. There are the early gentle hackers, who break into systems to demonstrate their skills. Then there are the ‘black hats’, which might have been gentle hackers at some point but then are motivated to make money as part of an explosively booming business based on ever-present internet insecurity. Moving towards a much larger scale, most electronic attackers nowadays extract valuable data and still manage to remain anonymous much like an electronic form of massive parasitism.

If looking through a monetary value and volume perspective a key target by attackers is personal identity information (ID). This can be credit card numbers, social security numbers, banking accounts, and medical files. Since each ID theft falls in the category of a ‘loss of control’ of an individual's private data and it can be considered as a damaging event that leads to potential realized financial losses, which is the main aim behind the attack. The incentive behind ID theft is a non-destructive internet attack that focuses on profit from botnets to highly specific attacks. Furthermore, these attacks can be uncontrolled as attackers can impersonate their victims and hence raise an important social issue of people’s identity resilience in the technology era. Due to the implications and the gain in terms of monetary value ID theft is one of the main incentives for attackers today. Read More