Automated Responsible Disclosure of Security Vulnerabilities

Andrea Lisi*, Prateeti Mukherjee, Laura De Santis, Lei Wu, Dmitrij Lagutin, Yki Kortesniemi

*Corresponding author for this work

Research output: Contribution to journalArticleScientificpeer-review

8 Downloads (Pure)

Abstract

The disclosure of security vulnerabilities plays an important role in notifying vendors and the public about flaws in digital systems. Among the proposed disclosure approaches, the most utilized is Responsible Disclosure, which still suffers from several disadvantages such as fostering a false sense of security among the end-users, allowing arbitrary delays in the disclosure process, and forcing the party reporting a vulnerability to identify themselves, which has been exploited by vendors through intimidation and malpractice. To address these issues, this paper presents an improved version of the Responsible Disclosure approach called Automated Responsible Disclosure (ARD) - a solution that leverages distributed ledgers and interledger technologies to automate the disclosure process while offering increased security, privacy, and transparency. A prototype implementation has been released as open-source software, and the evaluation of the solution shows that ARD is capable of addressing the key shortcomings in existing solutions and fostering more transparent disclosure practices.

Original languageEnglish
Pages (from-to)10472-10489
Number of pages18
JournalIEEE Access
Volume10
Early online date13 Nov 2021
DOIs
Publication statusPublished - 2022
MoE publication typeA1 Journal article-refereed

Keywords

  • Distributed ledger
  • Privacy
  • Computer bugs
  • Smart contracts
  • Public transportation
  • Prototypes
  • Peer-to-peer computing

Fingerprint

Dive into the research topics of 'Automated Responsible Disclosure of Security Vulnerabilities'. Together they form a unique fingerprint.

Cite this