3 ms·
Companies internally find and fix security bugs all the time and dont talk about it if no known breach occured. Is there a requirement to do this? Maybe there s
by kerng 8y ago
Companies internally find and fix security bugs all the time and dont talk about it if no known breach occured. Is there a requirement to do this? Maybe there should be a requirement to document that due diligence occurred to understand if it was exploited?
- nitwit005 8y agoI don't see the benefit. We'd all just end up with a barrage of emails we don't really care about.
- 394549 8y agoThe notification don't need to be email. If there's no evidence of a breach, I think it would be reasonable for them to disclose into some kind of vulnerability database. Maybe someone could later determine if the vulnerability was exploited based on some data dump found on the dark web or something.
- stochastic_monk 8y agoI would think it should be required to report. Just because you don’t know if a vulnerability was exploited does not mean it was not.
- kerng 8y agoI assume cloud providers have hundreds of security issues that are found internally over the course of a year. Requiring reporting would certainly be a step forward and testing in production for software would maybe be seen as what it is, an engineering anomaly and failure to perform due diligence.
- UncleMeat 8y agoYou are going to be off by at least an of magnitude. You'd see multiple reports per day for a diligent company.
- stochastic_monk 8y agoThat’s fair. I suppose I would aim for a distinction between minor and major flaws. What would be a reasonable threshold?
- zmmmmm 8y agoHow do you even differentiate this from routine server maintenance that installs kernel patches etc. Theoretically those are all vulnerabilities that exposed data and every single company which is learning of them through CVE etc., should be reporting potential breaches if you hold companies to that bar.
- throwaway829 8y agoThey only kept 2 weeks worth of logs. So the correct statement is: in 2 of 156 weeks since the bug was accessible no known breach occurred.