NETWORK SECURITY: VULNERABILITIES AND DISCLOSURE POLICY

✍ Scribed by JAY PIL CHOI; CHAIM FERSHTMAN; NEIL GANDAL

• Book ID: 110943246
• Publisher: John Wiley and Sons
• Year: 2010
• Tongue: English
• Weight: 290 KB
• Volume: 58
• Category: Article
• ISSN: 0022-1821
• DOI: 10.1111/j.1467-6451.2010.00435.x

✦ Synopsis

Software security is a major concern for vendors, consumers and regulators. When vulnerabilities are discovered after the software has been sold to consumers, the firms face a dilemma. A policy of disclosing vulnerabilities and issuing updates protects only consumers who install updates, while the disclosure itself facilitates reverse engineering of the vulnerability by hackers. The paper considers a firm that sells software which is subject to potential security breaches and derives the conditions under which a firm would disclose vulnerabilities. It examines the effect of a regulatory policy that requires mandatory disclosure of vulnerabilities and a ‘bug bounty’ program.