The Price of Restricting Vulnerability Publications - Revision history

WikiSysop: /* Additional Notes and Highlights */

2010-08-19T20:13:55Z

Additional Notes and Highlights

← Older revision		Revision as of 20:13, 19 August 2010
Line 38:		Line 38:

	==Additional Notes and Highlights==		==Additional Notes and Highlights==
			Expertise required: Law - Low/Moderate

	Outline:		Outline:
	INTRODUCTION		INTRODUCTION

Felix: /* Categorization */

2010-06-29T21:41:58Z

Categorization

← Older revision		Revision as of 21:41, 29 June 2010
Line 11:		Line 11:
	==Categorization==		==Categorization==

	* Issues: [[Information Sharing/Disclosure]]		* Issues: [[Economics of Cybersecurity]]; [[Information Sharing/Disclosure]]
	* Approaches: [[Regulation/Liability]]		* Approaches: [[Regulation/Liability]]

WikiSysop: /* Key Words */

2010-06-28T18:54:59Z

Key Words

← Older revision		Revision as of 18:54, 28 June 2010
Line 17:		Line 17:

	[[Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy \| Disclosure Policy]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy \| Disclosure Policy]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#~~Information_Asymetries~~ \| Information ~~Asymetries~~]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymmetries \| Information Asymmetries]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Outreach_and_Collaboration \| Outreach and Collaboration]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Outreach_and_Collaboration \| Outreach and Collaboration]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Software_Vulnerability \| Software Vulnerability]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Software_Vulnerability \| Software Vulnerability]],

WikiSysop at 21:01, 25 June 2010

2010-06-25T21:01:47Z

← Older revision		Revision as of 21:01, 25 June 2010
Line 16:		Line 16:
	==Key Words==		==Key Words==

	[~~http://cyber.law.harvard.edu/cybersecurity/~~Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy Disclosure Policy],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy \| Disclosure Policy]],
	[~~http://cyber.law.harvard.edu/cybersecurity/~~Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymetries Information Asymetries],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymetries \| Information Asymetries]],
	[~~http://cyber.law.harvard.edu/cybersecurity/~~Keyword_Index_and_Glossary_of_Core_Ideas#Outreach_and_Collaboration Outreach and Collaboration],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Outreach_and_Collaboration \| Outreach and Collaboration]],
	[~~http://cyber.law.harvard.edu/cybersecurity/~~Keyword_Index_and_Glossary_of_Core_Ideas#Software_Vulnerability Software Vulnerability],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Software_Vulnerability \| Software Vulnerability]],
	[~~http://cyber.law.harvard.edu/cybersecurity/~~Keyword_Index_and_Glossary_of_Core_Ideas#Zero-Day_Exploit Zero-Day Exploit]		[[Keyword_Index_and_Glossary_of_Core_Ideas#Zero-Day_Exploit \| Zero-Day Exploit]]

	==Synopsis==		==Synopsis==

Felix: /* Categorization */

2010-06-24T22:46:41Z

Categorization

← Older revision		Revision as of 22:46, 24 June 2010
Line 11:		Line 11:
	==Categorization==		==Categorization==

	* Issues: [[Information Sharing/Disclosure]],		* Issues: [[Information Sharing/Disclosure]]
	* Approaches: [[Regulation/Liability]]		* Approaches: [[Regulation/Liability]]

WikiSysop: /* The Benefits of Openness in Computer Security */

2010-06-22T21:49:26Z

The Benefits of Openness in Computer Security

← Older revision		Revision as of 21:49, 22 June 2010
Line 35:		Line 35:

	===The Benefits of Openness in Computer Security===		===The Benefits of Openness in Computer Security===
	Part Three asks how computer security is different from other fields of science and whether these differences warrant a more or less restrictive approach to regulating vulnerability publications. According to the authors, in addition to the usual scientific reasons to protect sharing and openness in computer science research, there are special reasons why openness, including the availability of exploit code, promotes security and benefits the public. ~~Yhe~~ paper concludes that while the functionality of code superficially appears to be a strong factor in favor of limiting computer security publications, security is not improved by secrecy in the computer context. Additionally, code restrictions undesirably favor anti-competitive practices on the part of market actors in a networked economy. They conclude that there are better ways to thwart computer crimes that do not impinge on scientific progress, or scare legitimate researchers and companies, or limit customer choice. Policy makers should promote the exchange of security information, peer review and field-testing; encourage users to protect computer systems by installing secure software, using encryption, and exercising sound judgment about the disclosure of sensitive information; and use market factors, insurance and liability allocation to encourage vendors to make security a priority.		Part Three asks how computer security is different from other fields of science and whether these differences warrant a more or less restrictive approach to regulating vulnerability publications. According to the authors, in addition to the usual scientific reasons to protect sharing and openness in computer science research, there are special reasons why openness, including the availability of exploit code, promotes security and benefits the public. The paper concludes that while the functionality of code superficially appears to be a strong factor in favor of limiting computer security publications, security is not improved by secrecy in the computer context. Additionally, code restrictions undesirably favor anti-competitive practices on the part of market actors in a networked economy. They conclude that there are better ways to thwart computer crimes that do not impinge on scientific progress, or scare legitimate researchers and companies, or limit customer choice. Policy makers should promote the exchange of security information, peer review and field-testing; encourage users to protect computer systems by installing secure software, using encryption, and exercising sound judgment about the disclosure of sensitive information; and use market factors, insurance and liability allocation to encourage vendors to make security a priority.

	==Additional Notes and Highlights==		==Additional Notes and Highlights==

Felix: /* Key Words */

2010-06-22T21:28:07Z

Key Words

← Older revision		Revision as of 21:28, 22 June 2010
Line 18:		Line 18:
	[http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy Disclosure Policy],		[http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy Disclosure Policy],
	[http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymetries Information Asymetries],		[http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymetries Information Asymetries],
	[Outreach and Collaboration],		[http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Outreach_and_Collaboration Outreach and Collaboration],
	[http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#~~Outreach_and_Collaboration~~ Software Vulnerability],		[http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Software_Vulnerability Software Vulnerability],
	[http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Zero-Day_Exploit Zero-Day Exploit]		[http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Zero-Day_Exploit Zero-Day Exploit]

Felix: /* Key Words */

2010-06-22T21:27:38Z

Key Words

← Older revision		Revision as of 21:27, 22 June 2010
Line 16:		Line 16:
	==Key Words==		==Key Words==

	[Disclosure Policy],		[http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy Disclosure Policy],
	[Information ~~Security~~],		[http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymetries Information Asymetries],
	[Outreach and Collaboration],		[Outreach and Collaboration],
	[Software Vulnerability],		[http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Outreach_and_Collaboration Software Vulnerability],
	[Zero-Day Exploit]		[http://cyber.law.harvard.edu/cybersecurity/Keyword_Index_and_Glossary_of_Core_Ideas#Zero-Day_Exploit Zero-Day Exploit]

	==Synopsis==		==Synopsis==

Felix at 21:25, 22 June 2010

2010-06-22T21:25:22Z

← Older revision		Revision as of 21:25, 22 June 2010
Line 11:		Line 11:
	==Categorization==		==Categorization==

	* Issues: [[Information Sharing/Disclosure]]		* Issues: [[Information Sharing/Disclosure]],
	* Approaches: [[Regulation/Liability]]		* Approaches: [[Regulation/Liability]]

Line 17:		Line 17:

	[Disclosure Policy],		[Disclosure Policy],
	[Information Security],		[Information Security],
			[Outreach and Collaboration],
	[Software Vulnerability],		[Software Vulnerability],
	[Zero-Day Exploit]		[Zero-Day Exploit]

Felix: /* Synopsis */

2010-06-22T21:23:01Z

Synopsis

← Older revision		Revision as of 21:23, 22 June 2010
Line 29:		Line 29:
	on the device of their choosing, as well as companies selling after-market garage door openers and toner cartridges. The U.S. Critical Infrastructure Information Act encourages companies to tell the government about infrastructure vulnerabilities, but then prohibits		on the device of their choosing, as well as companies selling after-market garage door openers and toner cartridges. The U.S. Critical Infrastructure Information Act encourages companies to tell the government about infrastructure vulnerabilities, but then prohibits
	disclosure under the Freedom of Information Act, state sunshine laws, the Federal Advisory Committee Act or to Congress. The European Cybercrime Treaty requires signatories to treat security tools like burglary tools and outlaw them unless they are possessed for a legitimate security or research purpose.		disclosure under the Freedom of Information Act, state sunshine laws, the Federal Advisory Committee Act or to Congress. The European Cybercrime Treaty requires signatories to treat security tools like burglary tools and outlaw them unless they are possessed for a legitimate security or research purpose.


	===Publication Restrictions in Other Scientific Fields===		===Publication Restrictions in Other Scientific Fields===
Line 37:		Line 36:
	Part Three asks how computer security is different from other fields of science and whether these differences warrant a more or less restrictive approach to regulating vulnerability publications. According to the authors, in addition to the usual scientific reasons to protect sharing and openness in computer science research, there are special reasons why openness, including the availability of exploit code, promotes security and benefits the public. Yhe paper concludes that while the functionality of code superficially appears to be a strong factor in favor of limiting computer security publications, security is not improved by secrecy in the computer context. Additionally, code restrictions undesirably favor anti-competitive practices on the part of market actors in a networked economy. They conclude that there are better ways to thwart computer crimes that do not impinge on scientific progress, or scare legitimate researchers and companies, or limit customer choice. Policy makers should promote the exchange of security information, peer review and field-testing; encourage users to protect computer systems by installing secure software, using encryption, and exercising sound judgment about the disclosure of sensitive information; and use market factors, insurance and liability allocation to encourage vendors to make security a priority.		Part Three asks how computer security is different from other fields of science and whether these differences warrant a more or less restrictive approach to regulating vulnerability publications. According to the authors, in addition to the usual scientific reasons to protect sharing and openness in computer science research, there are special reasons why openness, including the availability of exploit code, promotes security and benefits the public. Yhe paper concludes that while the functionality of code superficially appears to be a strong factor in favor of limiting computer security publications, security is not improved by secrecy in the computer context. Additionally, code restrictions undesirably favor anti-competitive practices on the part of market actors in a networked economy. They conclude that there are better ways to thwart computer crimes that do not impinge on scientific progress, or scare legitimate researchers and companies, or limit customer choice. Policy makers should promote the exchange of security information, peer review and field-testing; encourage users to protect computer systems by installing secure software, using encryption, and exercising sound judgment about the disclosure of sensitive information; and use market factors, insurance and liability allocation to encourage vendors to make security a priority.

	==Additional Notes and Highlights==~~Researchers, civil libertarians and policy makers have long agreed that~~		==Additional Notes and Highlights==
	~~uncensored publication and thorough peer review is essential to developing accurate~~
	~~scientific knowledge. Based on this consensus, U.S. law generally restricts publication~~
	~~only of information owned by or produced for the U.S. Government, when disclosure~~
	~~could reasonably be expected to result in damage to the national security, if the~~
	~~classifying authority can describe the damage from disclosure, and in specific areas of~~
	~~study that pose special problems for national security like weapons of mass destruction,~~
	~~nuclear facility or materials security, and military operations.~~


	Outline:		Outline:
	INTRODUCTION		INTRODUCTION

← Older revision		Revision as of 18:54, 28 June 2010
Line 17:		Line 17:

	[[Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy \| Disclosure Policy]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy \| Disclosure Policy]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#~~Information_Asymetries~~ \| Information ~~Asymetries~~]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Information_Asymmetries \| Information Asymmetries]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Outreach_and_Collaboration \| Outreach and Collaboration]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Outreach_and_Collaboration \| Outreach and Collaboration]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Software_Vulnerability \| Software Vulnerability]],		[[Keyword_Index_and_Glossary_of_Core_Ideas#Software_Vulnerability \| Software Vulnerability]],