3 ms·

What's unrealistic about adding "send an email to this address at ENISA" to todo-list for stuff you plan to do if you're informed of some problem defect in you

What's unrealistic about adding "send an email to this address at ENISA" to todo-list for stuff you plan to do if you're informed of some problem defect in your product? > When do those even start counting? When I think I've found something, or when I'm done investigating and confirming it and have completed a technical writeup? It's explicitly clear, as soon as you're aware of the problem, which means that either you or someone else (potentially outside the company) has found something. They don't require you to fix the problem or even to finish investigating the problem - all this requirement is saying that you send off an email first, instead of waiting until after you've finished your stuff. That's the whole point of this requirement (similar to GDPR requirement to notifications for breaches of private data) - companies aren't allowed to postpone notification for arbitrary amount of time, since even good faith rapid investigation can take weeks, and we've seen companies asserting that they're still investigating after more than a year has passed.

chmod775 3y ago
> What's unrealistic about adding "send an email to this address at ENISA" to todo-list for stuff you plan to do if you're informed of some problem defect in your product? Most people "informing" you about vulnerabilities are some indian dude leading with "I found Security Vulnerability in your web application ..For security purpose can we report vulnerability here,then will i get bounty bounty reward in PayPal or Bitcoin for Security bug ?" (actual mail I received). 99.9% of the time it's absolute nonsense, but it takes time to vet that. The law also says that the notice shall include details of that vulnerability, which you also can't conjure up, for instance because you're only observing symptoms or because Rakesh is being coy about details. > all this requirement is saying that you send off an email first, instead of waiting until after you've finished your stuff. So every time Dinesh messages me in broken English, I just blindly forward the mail to the EU so they can raise a stink about nothing?
- acdha 3y ago
  Sure, but a vulnerability report isn’t an active exploit. The clock would start when you realized that someone was actually taking advantage of it, not when you first read the email alleging that your site is vulnerable because it returned a 301 instead of a 404 for a WordPress path.
  - MichaelZuo 3y ago
    I agree, 24 hours from first receiving solid, credible, recorded, evidence of an active exploit is pretty reasonable. 24 hours from receiving any random ramblings would not be reasonable.
    - chrisandchris 3y ago
      I think wording is getting important here > from first receiving So I'll send my evidence to you Sunday 04:00, because you'll never be able to meet the 24-hour deadline if it starts when the email is delivered to your mailbox. Some comment above: > after becoming aware Sounds more reasonable. I'll get into the office at Monday 06:00 and read the e-mail, now the clock starts ticking. But hey, how about not reading all mails with "security incident" in the subject, so I won't be aware of anything?
      - acdha 3y ago
        One thing to remember is that laws are not code - I think most authorities would be lenient if, for example, you fell ill in the middle of that 24 hour window or hit a technical problem trying to report it but would expect the reverse to be true if you made a point of not reading your email or pulling some Musk-like auto responder move. What’d be interesting would be where mistakes fall in that picture. For example, a number of years back I found a serious SSL problem in one of Apple’s products but they never responded because I had contacted security@apple.com, which at the time went to the people who handle things like badge cards and door locks, and they apparently just ignored anything they didn’t understand. I’d be curious how something like that would unfold under this policy - would a regulator or judge say they should have been better at handling email, say I should have checked more carefully for additional contacts, been lenient once on a promise that they improve training, etc. Given how exposed we increasingly are, it does seem reasonable to force the issue by saying everyone needs to take this seriously.
  - chmod775 3y ago
    > Sure, but a vulnerability report isn’t an active exploit. First off, it can be. Obviously you should check whether the vulnerability is being actively exploited or was in the past. For web applications that keep request-level logs you can ascertain this quite often. Depending on the complexity of the search and the amount of logs/storage you're dealing with, this can take hours of work, and then days of running the actual search though. Secondly, the law doesn't just concern itself with actively exploited vulnerabilities. It continues: > The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any incident having impact on the security of the product with digital elements.

chmod775 3y ago

> What's unrealistic about adding "send an email to this address at ENISA" to todo-list for stuff you plan to do if you're informed of some problem defect in your product? Most people "informing" you about vulnerabilities are some indian dude leading with "I found Security Vulnerability in your web application ..For security purpose can we report vulnerability here,then will i get bounty bounty reward in PayPal or Bitcoin for Security bug ?" (actual mail I received). 99.9% of the time it's absolute nonsense, but it takes time to vet that. The law also says that the notice shall include details of that vulnerability, which you also can't conjure up, for instance because you're only observing symptoms or because Rakesh is being coy about details. > all this requirement is saying that you send off an email first, instead of waiting until after you've finished your stuff. So every time Dinesh messages me in broken English, I just blindly forward the mail to the EU so they can raise a stink about nothing?

acdha 3y ago
Sure, but a vulnerability report isn’t an active exploit. The clock would start when you realized that someone was actually taking advantage of it, not when you first read the email alleging that your site is vulnerable because it returned a 301 instead of a 404 for a WordPress path.
- MichaelZuo 3y ago
  I agree, 24 hours from first receiving solid, credible, recorded, evidence of an active exploit is pretty reasonable. 24 hours from receiving any random ramblings would not be reasonable.
  - chrisandchris 3y ago
    I think wording is getting important here > from first receiving So I'll send my evidence to you Sunday 04:00, because you'll never be able to meet the 24-hour deadline if it starts when the email is delivered to your mailbox. Some comment above: > after becoming aware Sounds more reasonable. I'll get into the office at Monday 06:00 and read the e-mail, now the clock starts ticking. But hey, how about not reading all mails with "security incident" in the subject, so I won't be aware of anything?
    - acdha 3y ago
      One thing to remember is that laws are not code - I think most authorities would be lenient if, for example, you fell ill in the middle of that 24 hour window or hit a technical problem trying to report it but would expect the reverse to be true if you made a point of not reading your email or pulling some Musk-like auto responder move. What’d be interesting would be where mistakes fall in that picture. For example, a number of years back I found a serious SSL problem in one of Apple’s products but they never responded because I had contacted security@apple.com, which at the time went to the people who handle things like badge cards and door locks, and they apparently just ignored anything they didn’t understand. I’d be curious how something like that would unfold under this policy - would a regulator or judge say they should have been better at handling email, say I should have checked more carefully for additional contacts, been lenient once on a promise that they improve training, etc. Given how exposed we increasingly are, it does seem reasonable to force the issue by saying everyone needs to take this seriously.
- chmod775 3y ago
  > Sure, but a vulnerability report isn’t an active exploit. First off, it can be. Obviously you should check whether the vulnerability is being actively exploited or was in the past. For web applications that keep request-level logs you can ascertain this quite often. Depending on the complexity of the search and the amount of logs/storage you're dealing with, this can take hours of work, and then days of running the actual search though. Secondly, the law doesn't just concern itself with actively exploited vulnerabilities. It continues: > The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any incident having impact on the security of the product with digital elements.