Where do you stand: Full Disclosure, Responsible Disclosure, or somewhere in the middle
Dave Aitel, CEO of Immunity Inc. (DA): Responsible disclosure was a codeword for vendors wanting researchers to be required to give them the results of their research, so they could control the PR fallout. Vulnerabilities are very complicated things, both technically and politically, and what the community has decided is that there really is no one-rule-fits-all solution.
The fact that the issues around this are so long-standing and so complex is one reason I personally think this is an area best left without regulation or the force of law. For example, it is hard to even get two researchers to agree on what a particular vulnerability is, let alone the severity of it, or how it should be handled.
If a researcher chooses to follow responsible / coordinated disclosure and the vendor goes silent -- or CERT stops responding to them -- is Full Disclosure proper at this point If not, why not
DA: Responsible disclosure is often more complicated than it first seems. It's important to note that for many complex systems there really is no "one vendor."
For example, many vulnerabilities are in libraries, or in parts of code shared by many different systems. In other cases, the giving a vulnerability to a vendor who has their security team overseas has national security implications. You are essentially giving it to a foreign intelligence service, to use against your own citizens!
We have seen many other options in the past of vendors failing to fully patch a vulnerability, of researchers being more timely with patches than any vendor could be, or of vendors failing to acknowledge the severity of a particular security weakness. Of course on the other side we've seen researchers who failed to understand how severe a weakness was, or how widely other software was affected.
Each and every case is different. So in some cases, full disclosure is the way to go. It's worth noting this is often a thankless task either way for researchers, who are faced with legal ambiguity, threats, and reciprocation for what in the end is helping everyone.
Bug Bounty programs are becoming more common, but sometimes the reward being offered is far less than the perceived value of the bug / exploit. What do you think can be done to make it worth the researcher's time and effort to work with a vendor directly
DA: Perhaps the next generation of bug bounty programs will also include a crowd-funding component. Microsoft has often used fame as a substitute for fortune and this seems to work well. In the end, it's obvious that it is cheaper to know about vulnerabilities than not to know about them - this may mean smarter companies pay more.
Do you think vulnerability disclosures with a clear marketing campaign and PR process, such as Heartbleed, POODLE, or Shellshock, have value
DA: Bringing security to the forefront of the minds of corporate boards may just be a branding exercise worth doing! While it's easy to eye-roll over a slick marketing campaign, the reality is if you don't do this the vulnerability may not get the attention it deserves or it may be characterized in the wrong way by the press. Offensive security researchers should take more ownership over their discoveries. As long as they don't bring the FUD, go for it.
If the proposed changes pass, how do you think Wassenaar will impact the disclosure process Will it kill full disclosure with proof-of-concept code, or move researchers away from the public entirely preventing serious issues from seeing the light of day Or, perhaps, could it see a boom in responsible disclosure out of fear of being on the wrong side of the law
DA: The proposed changes to the Wassenaar Arrangement will cause significant harm to the US penetration testing industry and vulnerability developers. It will make it extremely difficult and costly to be able to conduct normal business operations in these fields and it will create walls between countries, preventing the real time sharing of critical information.
Because the proposed regulation is so vague, no company will ever really be able to say they are compliant and the US Government will be able to selectively prosecute any company that has international ties of any kind. This is why Google and other large companies are so against the regulations - they are a net loss for both privacy and security!