Home » Data Protection » Application Security

Opinion

The Vulnerability Disclosure Game: Are We More Secure?

Marcus Ranum asks: Can we speak frankly about "vulnerability disclosure" now? More than a decade into the process, can anyone say security has improved?

By Marcus J. Ranum

March 01, 2008 — Can we speak frankly about "vulnerability disclosure" now? Can we, please? It's long past time. More than a decade into the process, can anyone say security has improved?

Back in the mid-1990s, when the vulnerability disclosure economy was starting to take shape, I was one of a small handful of security practitioners who was trying hard to apply the brakes against what we saw as a dangerous trend. Unfortunately, at that time, the security industry was not yet mature enough for customers to understand that they were being sold a dangerous bill of goods. For longer than a decade, we've lived under the mob rule, where for some security consultants and companies, "marketing" has been replaced by "splashily announcing holes in commercial products to get 20 seconds of fame on CNN." What's amazing about the disclosure game is not that it's been tolerated for so long, but that it worked at all. (See Schneier: Full Disclosure of Security Vulnerabilities a 'Damned Good Idea'.)

Do you remember the original premise of the disclosure game? By publicly announcing vulnerabilities in products we will force the vendors to be more responsive in fixing them, and security will be better. Remember that one? Tell me, dear reader, after 10 years of flash-alerts, rushed patch cycles and zero-day attacks, do you think security has gotten better?

I think there are a few places where we can see signs of improvement. I know that Microsoft, Oracle and others have spent huge amounts of money improving the security of their software. Never mind the fact that 99.99 percent of the computer users in the world would rather they had spent that money making their software cheaper or faster, I suppose it's a great thing to see that software security is being taken seriously. Security has gotten more expensive. But do you think security has gotten better?

From where I sit, it looks like the vulnerability rate is pretty much a constant. If the proponents of disclosure were right, their stated objective—browbeating the vendors into making their products better—would have been accomplished years ago. But we're speaking frankly, here, aren't we? So, as one adult to another, let me tell you why it won't work: because it was never about making software better. In fact, it was never about making your security better. That's right. Now that we can look back at 10 years of what disclosure has brought us, it's brought us—well, nothing much. Nothing much, that is, except a grey-market economy in exploits, where independent "vulnerability researchers" attempt to cash in by finding new attacks that they can sell to security companies or spyware manufacturers—whichever bids higher. Nothing much unless you count the massive amounts of "free" marketing exposure for companies that trade in exploits. The sad part about it all is that they've managed to convince you they're doing you a favor. It looks like a pretty expensive-looking "favor" to me!