Vulnerability Disclosure

In this module, you learned about the key techniques and tools surrounding vulnerability discovery. Vulnerability disclosure is an important facet of vulnerability management in terms of publishing information pertaining to a computer security vulnerability and the appropriate guidelines for doing so. However, there has been disagreement in reference to how soon and how much information should be made publicly available about discovered vulnerabilities. In the required readings for the module you examined Bradley’s 2015 article on the Microsoft-Google vulnerability disclosure debate (Links to an external site.).

In the Bradley article, we see that Google adhered to its ninety-day policy and disclosed vulnerability details about a bug in Windows the day before Microsoft was scheduled to publish the patch for the vulnerability. We read that Microsoft publicly criticized Google for their approach. What is your perspective on this issue? Do you support Google’s approach in this situation, or do you support Microsoft’s approach to the problem? Justify your rationale. In your response, specifically, focus on the duration of the disclosure policies (e.g. Google’s ninety-day policy) and the amount of information that you think should be released publicly about vulnerabilities. Draw on the materials you read in this module to justify your perspectives. Research and include supporting materials from credible sources that support your thoughts.

https://www.techrepublic.com/article/security-experts-weigh-in-on-microsoft-google-vulnerability-disclosure-debate/