Why Government Vulnerability Disclosure Processes Need Private Sector Involvement

Most people are either staunchly for or against the practice of governments finding and concealing zero-day exploits for use in cyber warfare or information gathering campaigns. What’s often overlooked, though, are perspectives that this issue can be a lot more gray than it is black and white. Did you know that the US government actually has a process in place to assess both the benefits and the risks of concealing vulnerabilities on a case-by-case basis?

Ricardo Arroyo, Sr. Technical Product Manager at WatchGuard, recently published a guest article on Dark Reading covering this very subject. In the column, Ricardo explains how America’s Vulnerabilities Equity Process (VEP) works, highlights imperfections in the process and posits that private sector involvement could go a long way toward improving transparency and confidence in VEP decisions to conceal or disclose zero-day exploits. Here’s a brief excerpt from the piece:

“It’s called the Vulnerabilities Equity Process (VEP), defined as “a process used by the U.S. federal government to determine on a case-by-case basis how it should treat zero-day computer security vulnerabilities, whether to disclose them to the public to help improve general computer security, or to keep them secret for offensive use against the government’s adversaries.” The VEP was developed in the late 2000s in response to a public outcry against the stockpiling of zero-day vulnerabilities. It was initially kept secret until the Electronic Frontier Foundation received redacted documentation through a Freedom of Information Act (FOIA) request in 2016. After the disclosure of the ShadowBrokers in mid-2017, the White House released an updated version of the VEP to the public in an attempt to improve transparency around the process.”

For more information on the VEP and Ricardo’s suggestions for improving it, check out the full article here. You can also find other perspectives on this issue and on vulnerability disclosure in general, here on Secplicity.