IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

CISA launches security bug reporting program

Now white hat hackers have a way to tell the government about bugs

The Cybersecurity and Infrastructure Security Agency (CISA) plans to launch a crowdsourced bug reporting site serving a range of federal government agencies. The Department of Homeland Security's cyber arm will work with Bugcrowd, a crowdsourced bug reporting site, to launch the project. 

CISA will offer the bug reporting platform to federal government agencies. While it won't be a paid bug bounty program, it'll give security researchers a way to report bugs to government organizations through a system that guarantees a response and ensures officials note all bugs. 

The deal follows the announcement of Binding Operational Directive 20-01 last September, in which CISA laid out plans to create a vulnerability disclosure policy (VDP). It directed agencies to publish a VDP policy on their websites within 180 days, describing what systems it covers and how security researchers can report bugs. It also mandates timelines for acknowledging and dealing with each bug. 

Government technology contractor Endyna will support the reporting platform under a one-year software as a service (SaaS) contract. The arrangement includes an optional extension of up to four years. 

The VDP effort has been brewing for a while. CISA originally published the draft of BDO 20-01 in November 2019, inviting public comment on the issue. The final BDO — and the forthcoming program — will carry forward some of CISA's original suggestions, including the mandatory inclusion of all new computing systems in the scope of an agency's VDP. 

The directive also set out a two-year deadline for including all internet-accessible systems in agency VDPs. 

Related Resource

Don’t just educate: Create cyber-safe behaviour

Designing effective security awareness and training programmes

How to define effective security awareness and training programmesDownload now

If nothing else, this should reduce the danger of legal threats against white hat hackers trying to report bugs to federal agencies. It mandates that agencies not issue threatening language as part of their VDP or pursue legal action against researchers trying to report bugs in good faith. 

The directive also states CISA won't send any bugs it collects to the Vulnerabilities Equities Process (VEP). VEP is a government initiative that gives intelligence officials the option to store bugs secretly as potential weapons rather than releasing them to the public. 

The Pentagon has taken its own approach to vulnerability reporting by offering paid bug bounty programs, including a new one launched this week.

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Recommended

Cyber attacks rain on Taiwan during Pelosi visit
cyber warfare

Cyber attacks rain on Taiwan during Pelosi visit

5 Aug 2022
US and Japan double down on joint semiconductor research
Policy & legislation

US and Japan double down on joint semiconductor research

1 Aug 2022
FCC to consider huge update to minimum broadband speed
Infrastructure

FCC to consider huge update to minimum broadband speed

18 Jul 2022
What is zero trust?
network security

What is zero trust?

14 Jul 2022

Most Popular

Cyber attack on software supplier causes "major outage" across the NHS
cyber attacks

Cyber attack on software supplier causes "major outage" across the NHS

8 Aug 2022
Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022