a national program of responsible disclosure · • a simple procedure for handling the...

19

A national program of Responsible Disclosure Cybersecurity@CEPS Events - Brussels, 23/06/2017 Gianluca Varisco

Upload: others

Post on 22-Jul-2020

2 views

Category:

Documents

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

A national program of Responsible Disclosure

Cybersecurity@CEPS Events - Brussels, 23/06/2017 Gianluca Varisco

Page 2: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

Digital Transformation Team

Page 3: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

Page 4: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

—

Origin

Italian Government appointed Diego Piacentini as Commissioner for Digital Transformation of the Public Administration

Diego started his new job hiring a team of tech-savvy people

Page 5: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

—

Vision The “operating system” of the country

Page 6: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

—

Manifesto

• Security and privacy• Obsessed by

simplification• Mobile first• Open Source • Data driven, using AI/ML• … and more!

(see teamdigitale.governo.it…)

Page 7: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

—

Skills

• Big Data • Content Design • Cybersecurity • Data Science • Developer Relations • Digital Payments • Metrics & Analytics • Mobile/Apps Developer • Product & UX/UI • Software Architects • Software Developers • Technical Project Managers

Page 8: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

Programs

Page 9: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

• SPID (secure digital identity) • DAF (Data Analytics Framework) • PagoPA (Digital Payments) • Developer Community • ANPR (Centralized registry on national population) • API Marketplace • Responsible Disclosure

Programs

Page 10: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

Current status GoalsWhat’s missing What we are doing How can you help?

—

ResponsibleDisclosure

Page 11: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

• Reports are not being handled (acknowledgement, triaging, resolution) in a timely manner

• Partial feedback (if at all) given to the researcher • There are no standardised guidelines

Current status

Page 12: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

• Simple, but effective procedures to ease the acknowledgement of vulnerability reports

• Quick response in solving the bugs • Useful interaction with the ethical hackers’ community

Goals

Page 13: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

• A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public

administration, promptly shared with our national CERTs • A proper reference (link, page) on corporate websites explaining

the procedures to follow for reporting security bugs• A direct (communication) channel standardised among every

public administration, the private sector, national CERTs and researchers who want to help

What is missing

Page 14: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

• We’ve involved the CERT Nazionale (MISE) and CERT PA (AgID) • A responsible disclosure policy is being drafted • At the same time, we’re investigating the technical and legal

frameworks (including the legal protection of the researcher) to meet our program’s requirements

What are we doing

Page 15: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

• ISO/IEC 30111: Vulnerability handling processes

International standards

Page 16: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

• ISO/IEC 29147 Vulnerability disclosure

International Standards

Page 17: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

• Collaborative revision of such policy • Definition of internal processes to handle security incidents • Subscription and publication of such policy within your

corporate websites • Give us feedback!

How can you help?

Page 18: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

Gianluca Varisco • Email: [email protected] • Twitter: @gvarisco • Medium: @gvarisco

Sito Web: https://teamdigitale.governo.it

—

Contacts

https://teamdigitale.governo.it

Page 19: A national program of Responsible Disclosure · • A simple procedure for handling the vulnerability reports • A complete mapping of every asset within the public administration,

Vulnerability Disclosure - IoT Security Foundation · 2018, Introduction to Vulnerability Disclosure in the Internet of Things, which introduces the concepts and discusses the advantages

Can Security Vulnerability Disclosure Processes Be ...–Formal notice and pre-release code snapshot at least five business days in advance of the release of the public disclosure

Preparing the Village Lessons Learned in Cross-Industry Vulnerability Disclosure · 2018. 6. 27. · Preparing the Village – Lessons Learned in Cross-Industry Vulnerability Disclosure

Vulnerability Disclosure and Management for AI/ML Systems

How To Find 12 kernel Information Disclosure Vulnerabilities In 3 … · Discovering Information Disclosure Vulnerability 1.Poison kernel heap and stack data, and fill padding flag

emagazine.ncdrc.res.in€¦ · Vulnerability and Vulnerability Analysis Vulnerability Vulnerability is weakness or flaw in a system/application. Vulnerability Analysis Vulnerability

An Introduction to Network Vulnerability Testing Vulnerability Test_wp.pdf · An Introduction to Network Vulnerability Testing A ... An Introduction to Network Vulnerability Testing

Common Vulnerability Scoring System (CVSS) & Vulnerability ... · © 2005 by FIRST.Org, Inc. Common Vulnerability Scoring System (CVSS) & Vulnerability Disclosure Framework (VDF)

Measuring Vulnerability: A Multidimensional Vulnerability ... › sites › default › files › publication-resource… · Measuring Vulnerability: A Multidimensional Vulnerability

Coordinated Vulnerability Disclosure... · the Netherlands (Nederlandse Meldplicht datalekken). The main effect of these reporting requirements on Coordinated Vulnerability Disclosure

VULNERABILITY,DISCLOSURE,REPORT - PRWebww1.prweb.com/prfiles/2012/08/13/9797543/Vulnerability-Disclosure... · 1 VULNERABILITY,DISCLOSURE,REPORT! Vulnerabilities,Identified,withinthe,Dirt,Jumper,DDoS,Toolkit,Family,

Local Government Local Leadership Training Municipal Front Office Independent Audit Debt Management Disclosure of Assets Vulnerability Assessment Building

Vulnerability Disclosure

Building a Vulnerability Disclosure Program That Works for ... · ethical hackers for the first time through a program with a number of vendors including Synack. Help America Vote

Consumer IoT Security Quick Guide: MANAGE VULNERABILITY ...€¦ · IoTSF’s service VulnearbleThings.com can help with vulnerability reporting, management, and coordinated disclosure

Vulnerability Disclosure in the Age of Social Media: …tdumitra/papers/USENIX...Vulnerability Disclosure in the Age of Social Media: Exploiting Twitter for Predicting Real-World Exploits

Vulnerability Disclosure in the Age of Social Media ... · USENIX Association 24th USENIX Security Symposium 1041 Vulnerability Disclosure in the Age of Social Media: Exploiting Twitter

**Report Title · Web viewSuch a vulnerability disclosure framework would address disclosure of issues like DDOS attack, Malicious activities, malware and phishing attacks and would

Software vulnerability disclosure and security investment · Speciﬁcally, we examine how the public disclosure of a vulnerability with a heavy media coverage aﬀects the discovery

The Network Vulnerability Tool (NVT) - A System Vulnerability

Vulnerability Disclosure Policies (VDP)...3 Now is the time to act. In 2018, all financial services firms — regardless of location or size — need to draft and publish a clear vulnerability

Controlware Vulnerability Management Service · Security Assessment Vulnerability Management (Proof of Concept) Vulnerability Management (as a Service) Controlware Vulnerability Management

[VULNERABILITY DISCLOSURE PROMOTING RESPONSIBLE€¦ · vulnerability research and discovery SINCE 20071 The Zero Day Initiative (ZDI) was founded in 2005 to encourage the responsible

SOFTWARE VULNERABILITY DISCLOSUREIN EUROPE · 2019. 4. 26. · The Dutch government is leading the way with a Coordinated Vulnerability Disclosure Initiative, ... Marietje Schaake

Impact of Vulnerability Disclosure and Patch … of Vulnerability Disclosure and Patch Availability - An Empirical Analysis Ashish Arora, Ramayya Krishnan, Anand Nandkumar , Rahul

Software Vulnerability Disclosure in Europe...Software Vulnerability Disclosure in Europe This report puts forward the analysis and recommendations for the design and implementation

Coordinated Vulnerability Disclosure Part 5 · Coordinated Vulnerability Disclosure . by Dan Klinedinst. And Dan is a . vulnerability researcher at CMU CERT . Coordination Center

Occasional Paper No.8: Consumer Vulnerability · Consumer Vulnerability Occasional Paper ... Vulnerability disclosure and data protection issues 64 ... Much consumer protection legislation

Vulnerability Disclosure - IoT Security Foundation · · 2017-12-011 Introduction 1.1 Overview Vulnerability disclosure is an increasingly important topic, especially for providers

Vulnerability Disclosure in the Age of Social Media: …Vulnerability Disclosure in the Age of Social Media: Exploiting Twitter for Predicting Real-World Exploits Carl Sabottke Octavian

Vulnerability Disclosure Attitudes and Actions · Vulnerability Disclosure Attitudes and Actions ... such as ISOs, to better understand ... (security researcher), New America’s

Anatomy of a Responsible Disclosure Zero Day Vulnerability in Oracle BI Publisher by Vishal Karlo

…But Now I See—A Vulnerability Disclosure Maturity Model

Coordinated Vulnerability Disclosure: The Guideline...Coordinated Vulnerability Disclosure ˜˚˛˚ 2. Coodr inaet dVulnear bility Disclosure Various methods have been used over the

Can Security Vulnerability Disclosure Processes Be Responsible, Rational and Effective? from LISA 2011