About Us | Contact Us
View Cart

New Chinese Law Highlights Disclosure Debate

By Vigilize | Monday, September 13, 2021 - Leave a Comment

Questions about China’s new disclosure laws only highlight the uncertainty about disclosure in general…


An article review.


yellow bullhorn with chalkboard behind it with lines expressing noise

China recently made waves in the security world by announcing a new set of data security laws, one of which has added new fuel to a long running debate: how and when should security vulnerabilities be disclosed…and to who?

The new law, as described in a recent article on BreakingDefense, would require security vulnerabilities to be disclosed to the Chinese government before anyone else.  The law, which also applies to foreign companies with a footprint in China, also prohibits the distribution of vulnerability information to any foreign entity, aside from the manufacturer of the product in question.

While this new law is drawing controversy due to allegations concerning the role of the Chinese government in cyberattacks, the law also serves as a reminder that the ethics of vulnerability disclosure continue to be debated…and when it comes to disclosure, doing it improperly can result in disaster.

Take for example an incident from 2015, where Google disclosed a serious security vulnerability in Microsoft Windows days before a patch was available to mitigate it.  While Google was following its own vulnerability disclosure policy in making the public notification, Microsoft claimed Google refused to cooperate with them by delaying disclosure until it could release a patch, claiming it put users at risk.

When it comes to the duties of researchers in notifying the public about a vulnerability versus their duty to allow manufacturers a chance to mitigate those vulnerabilities there’s no single set of rules to be followed: both Google and Microsoft believe their policies were in the best interests of users…and both blame each other for putting users at risk.

While there is still no end in sight to the debate regarding ethical disclosure, this new law suggests that it will only become increasingly important as more countries realize the potential offensive value of security vulnerabilities and how they are disclosed…if they’re disclosed at all, that is.


Original article by Brad Williams, writing for BreakingDefense.


Interested in MSOC, Audit, or Other Assessments and Tests? Visit offerings.infotex.com to let us know!


same_strip_012513


 

Latest News
    Reasons why we should be considered! infotex provides a number of services that can be checked out if you click over to offerings.infotex.com! We even made a movie with all the reasons why infotex should be your next MSOC!  
    infotex and GoTo To all infotex managed security service Clients: As recently reported by major news outlets there was a data breach affecting GoTo (formerly LogMeIn) wherein attackers stole encrypted backups containing customer information in November 2022.  Based on the advisory from GoTo the products they offer that are affected include LogMeIn Pro, LogMeIn Central, […]
    An option for increasing security for ALL organizations. . . The threat landscape is evolving daily, and it is becoming increasingly difficult for even large organizations providing cyber defense services to keep up. As Brandao (2021) notes, it is important for organizations to adapt holistic technologies that can correlate all attack events. Therefore, developing XDR […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Check out posters.infotex.com for the whole collection! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape) You are welcome to print out and distribute this around your […]
    A relic of the internet’s less secure past, many small firms struggle to secure their email systems… An article review. With a great deal of cybersecurity related news focused on new threats and similarly new techniques aimed at combating them, it can be easy to forget some of the older threats that have never gone […]
    Seven Trends . . . …that small bank Information Security Officers face in 2023 Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Welcome to the Magnificent Seven, my annual predictive article about the seven trends in technology that will impact the Information Security Officers of […]
    System Security and Cybersecurity are not the same thing. . . Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Regarding “information security,” the last thirty years have seen an evolution of frameworks, laws, and assessment approaches which intimidate the management team with their complexity.  […]
    The cryptographic algorithm is vulnerable to attack and is no longer considered secure… An article review. NIST has announced that it plans to retire the SHA-1 cryptographic algorithm by the end of 2030, citing multiple vulnerabilities in the standard, effectively ending its use after nearly 30 years.  Introduced in 1995, SHA-1 used a 160-bit hash […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Check out posters.infotex.com for the whole collection! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape) You are welcome to print out and distribute this around your […]
    Trending: Awareness Posters Meet Infographics Here are the top seven posters as of the last twelve months! As always, our Awareness Posters were a hit in 2022! So we decided to run some reports to see what our most popular posters were since November 2021. As everybody loves top ten lists and contests, we thought […]