What Makes a Successful VDP?

When it comes to data security, Vulnerability Disclosure Programs (VDPs) are an important tool for companies committed to safeguarding customer data. These programs serve as an established means of communication between security researchers and companies to promptly discover and rectify potential vulnerabilities. 

But what makes a VDP important? And what makes them truly successful? 

Let's dive into the top 5 markers of a successful Vulnerability Disclosure Program. A VDP is a tool that not only bolsters security but also builds solid relationships with the research community and earns respect from customers and industry peers. Read on to see how.

A Vulnerability Disclosure Program (also sometimes referred to as Responsible Disclosure) is a way for companies to provide a clear and secure channel for anyone to report vulnerabilities they discover in our products, systems, and services. 

A VDP allows for a secure and transparent avenue for the public to report any vulnerabilities they may uncover in a company's products or services.

Disclosure programs are important because they can help keep your products, systems, and services more secure. By providing a clear and secure channel for security researchers (or any member of the public) to report vulnerabilities, companies gain the ability to quickly identify and fix potential issues that could lead to a breach or worse. 

But, there are other benefits that make VDPs useful. For instance, VDPs provide an incentive for researchers to disclose findings responsibly. Engaging with the greater security community enables you to leverage the collective knowledge and expertise of security researchers to identify and address potential vulnerabilities, or misconfigurations, in your software. 

Providing a clear and secure channel for security researchers to report vulnerabilities they discover in collaboration with the security community through a VDP helps ensure issues are identified, communicated, and addressed in a timely fashion. That way customer data is protected from potential exploitation and the security of our products, systems, and services remains tight.

Having a VDP can also help strengthen your organization’s brand reputation because it’s one way to demonstrate your commitment to secure software development. By having an avenue for responsible disclosure, the organization sends a clear message that it takes security seriously. This can help you build trust with customers and maintain your relationships for the long haul.

Ultimately, a disclosure program creates an environment where researchers feel comfortable reporting vulnerabilities and provides the business with another set of eyes which is always a good thing. But how can you tell if a VDP is efficient?

Having a streamlined disclosure process will work not just in your favor but also in the researcher’s favor. From initial disclosure, triage, remediation, and post-remediation, the next steps for a particular report at any given point in the process should be clear. This will also help reduce headaches for everyone involved.

There’s nothing more frustrating than spending hours – or days – on a potential security issue only to find it’s not actually in scope. Whether it’s due to a subdomain or particular vulnerability type being omitted from the disclosure policy’s out-of-scope section, it still means someone lost time that could have been spent on more strategic initiatives. Having a clear scope is important to prevent researchers from wasting their time. 

If you require certain conditions to be met for participation, those should be prominently displayed and easy to understand as such:

• Program rules. What are the rules of engagement? What is strictly prohibited?

• Expectations. What can I expect from the company that I’m disclosing to?

• In-scope and out-of-scope targets. What can I focus my attention on?

• Non-qualifying vulnerability types. 

• Reporting requirements and/or guidelines. What exactly do I need to include in my report?

• Incentives: Does your program offer any participation incentives?

When disclosing a vulnerability, it’s important to make your program policy clear about what you expect from researchers and what they can expect from you. Communicate expectations clearly and define expected outcomes of remediation. 

For example, there are several questions a security researcher might ask when participating in your program:

• How do I know my report was received and triaged? 

• Was my report accepted? 

• When will someone reach out to me about my disclosure? 

• What are the estimated response times based on severity? 

• Why was my report downgraded to a lower severity? 

Although resolving the vulnerability may require some time, it’s crucial companies maintain clear and consistent communication regarding expectations around mitigation timelines and status updates. This ensures effective handling of the situation and proves to the security researcher their discovery is taken seriously.

At a minimum, the policy should clearly outline when to expect communications from the security team.

A majority of the anti-hacking laws were created before people “hacked for good”. This makes building and maintaining trust with the security research community of utmost importance. Offering protection from liability in the context of security research and responsible disclosure goes a long way for individual researchers and the greater community. Without this, security researchers may be deterred from disclosing their discoveries due to fear of retribution.

The language of your policy should not be threatening, but instead you should aim to be affirmative, unambiguous and reassuring.

Tracking reports and their outcomes, especially remediation times, is a great way to measure the success and effectiveness of your program. Certain trends can also help you understand where your program needs work or where your VDP is crushing it. These will be unique to the goals of your program and greater organization.