b'and yours. Researchers do this extremelyTechnology(NIST)andenteredintothevulnerabilities in their hardware, software, RESPONSIBLEwell, but there is no specific format. JustCommonVulnerabilityScoringSystemcode, down to administrative criteria such ensure you remove the emotion from your(CVSS)wheretheycalculateandassignasconfigurationcontrolsandpolicies& report, including mere facts and how youseverityranking.Fromthere,theyareproceduretobettersecurethemselves, VULNERABILITY DISCLOSUREachieved your results. enteredintotheNationalVulnerabilitytheir clients, and industry.Youll need to notify the data or applicationDatabase (NVD) where most end-users endEnsure you are responsible and respectful upreferencingthevulnerabilitiesthrough TO VENDORS & INDUSTRY owners who will be responsible for patchingtheir lookups in the Common Vulnerabilitiesin your particular industries and recognize orremediatingthevulnerabilityandgiveand Exposures (CVE) index maintained byhow difficult it is to develop and maintain them ample time to fix it. This is where theMitreCorporationinconjunctionwithitsarigidlysecureproduct.Whetherits By Tony Rucci lines become blurred for some researcherspartnershipwiththeUS-CERT.Industryphysical or virtual, at some point in time, where they think its much sexier to outannouncements are published, and in somesomeoneisboundtoidentifyaflawin them via social media or in a talk at onecases, public announcements are releasedyourcode;buildaworkaroundtoyour ofthehackerconferences.Thatscalleddepending on the severity. security protocol, if you even have one. If Recently, I was asked by an eventResponsibledisclosurecanhavesecondary ransomware attack as afull disclosure, and it is the wrong way,you are a developer, business owner, or coordinator outside the Informationseveraldissectedinterpretationsresult of the vulnerability? Not veryinmyprofessionalopinion,togoaboutMore and more, you read about companiesdistributor of products, be grateful of the Security industry to present a livedependingontheintendeduseresponsible, is it? But it happens it.Idontcarewhatthecircumstancesoffering what is known as Bug Bountiesresearchers contacting you to notify you of hack on-stage during the openingoftheinformation.Forthesakeevery day.are;thedevelopersneedtobegivento researchers and users who responsiblytheir findings. When you shut them down, day of their multi-day event. Clearly,of this discussion, Ill stick to thetime to remediate. Now, the big questionidentifyandreporttheirfindingsbacktowhich happens quite a bit, you run the risk performing a live-hack on stage hasbasicprinciplesofvulnerabilityThis is particularly applicable tocirculatesaroundHowlongshouldwethem ahead of public disclosure or release.of them taking the Full Disclosure route, a lot of ooh-aah factor. My initialdisclosuresasdefinedbyafewtherecentdevelopmentsandgive them? Some communities will argueIts a lucrative business in fact, and there areimmediatelyairingyourvulnerabilitiesto responsewasCool!LetsbreakoftheprofessionalsocietiesIveforwardprogressoftheever- 30, 60, 90, up to 180 days. I would arguequite a few researchers out there who arethe world, which seldom turns out well for somestuff!Then,mycommongrown to know and respect overadvancing transportation industrythat it depends on the severity of the bugmaking a pretty good living doing just that.anyone except for the criminals.sensekickedinandremindedmy *cough cough* many years ofwith the Artificial Intelligence (AI)and the complexity of the remediation. InBug Crowd maintains a comprehensive list integration, coupled with vehiclemostcases,however,IwouldsuggestofbugbountyanddisclosureprogramsNobodywantstobeblindsidedatan methatlive-hacksseldomgoservice in this industry. As long as60-90 days is generally acceptable. Its afromacrosstheweb,curatedbytheindustryeventorlearnforthefirsttime well.Evenwhenwell-rehearsed,coders,developers,researchers,tovehicle(V2V)andVehicletosubjective number, and it varies.Bugcrowd researcher community. onapublicstagethattheirmulti-million Murphys Law will almost ALWAYSand engineers have been around,Infrastructure(V2I)asitpushes(orbillion)dollarinvestmenthasbeen sneak up and kick your butt oncetherehasalwaysbeenaversiontowardautonomousdeploymentThere may be times when the vulnerabilityHere at GRIDSMART, we take pride in ourcompromised.Taketimetoinspectyour your lecture begins. Its just not a2 of their initial idea. Version 2 ofin at a rate struggling to keep paceisacriticalsecurityvulnerability,anditscore values of remaining Simple. Flexible.product and networks for vulnerabilities and good idea. Dont do it. Nope. Nope.any idea is a result of identifyingwithdemandofinvestorsandso wide-spread that full disclosure mightTransparent. You have the right to know howmisconfigurations to minimize unintended Dont give in but, if you MUSTimprovements which can be mademarketing strategists, much lessbe warranted. Due to pure negligence onwell your products work without spendingexposuresandcompromise.Dontallow Always build a back-up plan whereto the original idea to make it better,theengineersdevelopingthesethepartofthedeveloperorvendor,fullmoremoneyonstudies.GRIDSMARTyourselves to be pressured into taking your yourecordasuccessfulsessionfaster, stronger, more secure, moreover-the-horizontechnologies.disclosuregiveseveryoneimpactedtheproducts play nice with other products andtechnology to market before its ready. nback in your lab. It ALWAYS worksuser-friendly,etc.TheresultsofWiththat,letswalkthroughability to apply critical patches to remediatetechnologiesinyourcommunity.When in the lab, right? So if (when) thingswhichwereidentifiedbyinternalwhataresponsibledisclosurethe immediate threat. Even if its a temporaryyoupurchasetheGRIDSMARTSystem, gosidewayswhileyouareonresearchers, or as they are in mostprocessshouldlooklike,andfix, its important enough to be addressedpoweredbyInteltechnologies,dowhat stage, you can always failover toinstances,externalresearcherspointyoutosomeindustrysooner rather than later. youwantwithitwithorwithoutus. the recorded session and replay theor end-users finding a bug in thereferenceswhichmayproveGRIDSMART lets you see exactly how well attack which results in a successfulcode.Sometimes,itmayinvolvehelpful in your future endeavors. Back to the flow; once the appropriate timeit performs. When we fix a bug, we post it lecture or talk. identifying a workaround to bypassIts a fairly straight-forward processhas expired, the researcher is free to be a bitfor the world to see.a certain security control. Then, itswhen you, as a researcher identify amore open about their research findings and Evendeeperthanthelive-hackontoversionthree,four,orfive.impact. They are usually working with theLikewise,weemulatethesamecore itself,however,aretheapprovalsBut how did the information makevulnerability or weakness in a piecevendor throughout the process to ensurevalueswithinourInformationSecurity andresponsibledisclosuresitbacktothedeveloper?Wasitof hardware, software application,theyve understood their vulnerability report&ThreatIntelligenceDivisionat aheadoftimeassociatedwiththrough a social media post, blogor web presence. Document yourand salient findings. The findings are sentGRIDSMART.Weworkdirectlywithour responsible demos like this. If youpost, or a security talk at a hackerfindings, ensuring the vulnerabilityto the National Institute of Standards andindustry partners to help identify security arearesearcherorjustsomeoneconference?Or,wasitastheor bug is repeatable and validates who discovers a bug or vulnerabilityresult of a series of hacks in theyourinitialassumptions.Logs, in a piece of hardware or softwarewildwherethevulnerabilitywasworkingnotes,andscreenshots allowing unauthenticated bypass, orexploitedandseveralhundred,are always helpful to the process,Antonio A. Rucci is a retired Counterintelligence Special Agent and US Army Warrant Officer, with more than 35 years of it simply breaks their product; youconfirmingyourfindingstothetechnical security experience. Tony is the Director of Information Security and Threat Intelligence at GRIDSMART, A Cubic need to walk yourself through somethousandsormillionsofsystemsrespective data owner. DocumentCompany, in Knoxville, Tennessee. As a CI Agent, Tony ran technical espionage and computer crime investigations for werecompromisedasaresult,your research in a report of findingsa good portion of his operational career. He served as the Counterintelligence Operations Officer at The White House, logical steps in what is often referredholdingcriticalcorporatedataserving two administrations from 1998-2004. He led the technical accreditation for the Multiprogram Research Facility to as Responsible Disclosure. hostage because they launched awhichisnothingmorethana(MRF) at Oak Ridge National Laboratory, then ran Cyber Security Programs for the IC before being recruited to move vulnerabilityreportoftheirworkto Reno, Nevada, to build a data center for one of the beltway bandits. Since then, Tony has started two of his own companies and served as the Chief Security Officer for two others before joining GRIDSMART.29 30'