The European Union has proposed new regulations to strengthen vulnerability disclosure programs (VDPs) for organizations as part of the EU Cyber Resilience Act (CRA). The modernization of cyber policy always offers some hope for progress, as does the inclusion of VDPs and the implied acceptance of those who hack in good-faith as a fundamental component of European cyber-resilience. The CRA, however, isn't without its flaws.
The CRA requires software manufacturers to notify the European Union Agency for Cybersecurity (ENISA) of vulnerabilities being actively exploited in the wild within 24 hours of observing them and for ENISA to distribute this information to all European CSIRTs and market surveillance authorities. In software development, 24 hours is not a lot of time to fix, test, and deploy software fixes, meaning many flaws that find themselves in the scope of the Act would remain unpatched at the time of notification. This would mean that dozens of government agencies could gain access to a real-time database of software with unmitigated vulnerabilities. Rushing the disclosure process in this way could lead to widespread knowledge about unmitigated vulnerabilities and create a tempting target for malicious actors.
To bring attention to this problem, I joined a diverse group of concerned cybersecurity experts who sent an open letter on October 3 to voice our concerns to officials at the EU Commission and European Parliament. The letter urged the commissioners to reconsider the VDP requirements because of several potential risks, including:
Our coalition of security experts has advocated for a responsible and coordinated disclosure process that balances the need for transparency with the need for security. We recommended that the CRA adopt a risk-based approach to vulnerability disclosure, taking into account factors such as the severity of the vulnerability, the availability of mitigations, the potential impact on users, and the likelihood of broader exploitation.
The letter warns that agencies should explicitly be prohibited from using or sharing vulnerabilities disclosed through the CRA for intelligence, surveillance, or offensive purposes. We also advised authorities to extend the reporting of vulnerabilities within 72 hours after mitigating software patches are made available.
Lastly, we said that the CRA “should not require reporting of vulnerabilities that are exploited through good faith security research. In contrast to malicious exploitation of a vulnerability, good faith security research does not pose a security threat.”
Ethical hacking has emerged as a critical component of the overall strategy for vulnerability disclosures worldwide. Putting restrictions on the security community by requiring premature disclosure can only serve to weaken the security posture for businesses, governments, and consumers.
Over the past decade, ethical security researchers have protected us against cybercrimes by offering visibility into the security of software, services, and infrastructure. It would set a dangerous precedent to require premature notifications, and doing so would impose unacceptable risks to our privacy and data security.
Unfortunately, as it’s now written, these new rules could handcuff the security community by reducing access for ethical security researchers to conduct VDP tests while giving rise to nefarious attacks on exposed vulnerabilities.
Casey Ellis, co-founder and CTO, Bugcrowd
