3 ms·
Material threat to be identified within 96 hours? How would receiving an encrypted email detailing a vulnerability of your flagship product fit with the 96 ho
by egberts1 3y ago
Material threat to be identified within 96 hours?
How would receiving an encrypted email detailing a vulnerability of your flagship product fit with the 96 hours, given that 90 days are often needed to fix said vulnerability (s) before informing the public?
In short, wouldn't that company's vulnerability make for excellent zero-days while they are trying to repair and retest the problematic product?
- pketh 3y agomy interpretation of this is that the existence/disclosure of a vulnerability is entirely distinct from a data breach event (the SEC is mainly concerned with the latter)
- egberts1 3y agoUmmm, ChatGPT is a vulnerability or a data breech if new stock tips can be had this way?
- cyanydeez 3y agoslow down there fellow: >Under the incoming cybersecurity disclosure requirements, first approved by the SEC in July, organizations must report cybersecurity incidents, such as data breaches, to the SEC in a specific line item on a Form 8-K report within four business days first line. It's going to a speicif org, not russian hackers in siberia. I agree, that better be one damn secure batphone they're using.
- malshe 3y ago8-K filings are public filings. You can see them on SEC's EDGAR database