Feds Consider New Security Reporting Role
Government officials are discussing the possibility of creating a single point of contact within the federal government to help handle vulnerability reporting.As part of a continuing effort to find a way to handle sensitive security vulnerabilities, government security officials have been discussing the possibility of creating a central point of contact within the government for reporting such information. Under the scenario officials have discussed, researchers who find a new vulnerability would be encouraged to send their findings to the government contact at the same time that they notify the affected vendor, according to sources familiar with the discussions. The benefits of such a system are two-fold, experts say. Not only would it ensure that the researcher is given proper credit for his findings, but it would also serve as a fall-back position should the vendors affected by the vulnerability fail to acknowledge the report or take any action to fix it. Many security researchers have been critical of large software vendors such as Microsoft Corp. and others for what the researchers perceive as unreasonably slow reaction times once they are told of a new vulnerability. This, in part, has led some researchers to begin posting their findings on public mailing lists or Web sites in an effort to pressure the vendors into patching the vulnerabilities.
Government security officials, most notably Richard Clarke, chairman of the Presidents Critical Infrastructure Protection Board, have decried this practice as irresponsible and damaging to both users. Clarke on several occasions has called on researchers to notify his office if they are meeting resistance from vendors on vulnerability reports.