Opinion

The Vulnerability Disclosure Game: Are We More Secure?

Marcus Ranum looks at whether the disclosure process has done any good

By Marcus Ranum

January 09, 2007 — CSO — By Marcus J. Ranum

Can we speak frankly about "vulnerability disclosure" now? Can we, please? It’s long past time. More than a decade into the process, can anyone say security has improved?

Back in the mid-1990s, when the vulnerability disclosure economy was starting to take shape, I was one of a small handful of security practitioners who was trying hard to apply the brakes against what we saw as a dangerous trend. Unfortunately, at that time, the security industry was not yet mature enough for customers to understand that they were being sold a dangerous bill of goods. For longer than a decade, we’ve lived under the mob rule, where for some security consultants and companies, "marketing" has been replaced by "splashily announcing holes in commercial products to get 20 seconds of fame on CNN." What’s amazing about the disclosure game is not that it’s been tolerated for so long, but that it worked at all. (See Schneier: Full Disclosure of Security Vulnerabilities a ’Damned Good Idea’.)

Do you remember the original premise of the disclosure game? By publicly announcing vulnerabilities in products we will force the vendors to be more responsive in fixing them, and security will be better. Remember that one? Tell me, dear reader, after 10 years of flash-alerts, rushed patch cycles and zero-day attacks, do you think security has gotten better? (See Microsoft: Responsible Vulnerability Disclosure Protects Users.)

I think there are a few places where we can see signs of improvement. I know that Microsoft, Oracle and others have spent huge amounts of money improving the security of their software. Never mind the fact that 99.99 percent of the computer users in the world would rather they had spent that money making their software cheaper or faster, I suppose it’s a great thing to see that software security is being taken seriously. Security has gotten more expensive. But do you think security has gotten better?

From where I sit, it looks like the vulnerability rate is pretty much a constant. If the proponents of disclosure were right, their stated objective—browbeating the vendors into making their products better—would have been accomplished years ago. But we’re speaking frankly, here, aren’t we? So, as one adult to another, let me tell you why it won’t work: because it was never about making software better. In fact, it was never about making your security better. That’s right. Now that we can look b

• Email
• Print
• Comments
• Digg This
• SlashDot

• Software Vulnerability Disclosure: The Chilling Effect
• Interview with Eric McCarty