PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A framework for successful vulnerability disclosure policy

yeswehack.com | vulnerability | #vulnerability-disclosure | #policy | #framework | #governance | #cvd | #infographic
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A YesWeHack framework for coordinated vulnerability disclosure tackling legal, awareness and communication barriers, with infographics to help organizations build a workable reporting process.
Published
Collected

Related coverage

vulnerability · yeswehack.com
Coordinated Vulnerability Disclosure policy for a safer cyberspace
Argues coordinated vulnerability disclosure needs clear legal guidelines to thrive, noting fragmented EU interpretations of hacking and outlining how policy can make researcher reporting safer.
vulnerability · yeswehack.com
Roles and responsibilities for efficient vulnerability disclosure
YesWeHack breaks down the roles and responsibilities — system managers, publishers, researchers — needed for coordinated vulnerability disclosure, with an infographic in English and French.
vulnerability · yeswehack.com
Incentive Policy for Coordinated Vulnerability Disclosure
An explainer contrasting Coordinated Vulnerability Disclosure with 'responsible disclosure', arguing CVD keeps vendors and researchers cooperating, and outlining what an incentive policy should cover.
blog · hackerone.com
Report Smarter, Not Harder: HackerOne's Case for Better CIRCIA Rules
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · netspi.com
Challenges and Keys to Success for Today’s CISO from the Former CISO at the CIA
Former CIA CISO Robert Bigman recounts building the agency's CISO role from scratch, why governance and policy work were core duties, and how to recover from mistakes in high-stakes environments.
blog · netspi.com
Building an Application Security Program from Scratch: Part 1
Kicks off a series on building an application security program, emphasizing policies, standards, and procedures as the foundation before tooling, with placement guidance in existing portfolios.
Back