• E4J University Module Series: Cybercrime

• Module 9: Cybersecurity and Cybercrime Prevention - Practical Applications and Measures

• Introduction and learning outcomes

• Key issues

  • Assets, vulnerabilities and threats
  • Risk
  • Vulnerability disclosure
  • Cybersecurity measures and usability
  • Situational crime prevention
  • Incident detection, response, recovery and preparedness
  • Conclusion
  • References

• Exercises

• Possible class structure

• Core reading

• Advanced reading

• Student assessment

• Additional teaching tools

•  

• First published in April 2019, updated in February 2020 
  

•  

 

  This module is a resource for lecturers  

 

Vulnerability disclosure

 

Information security and cybersecurity have been used interchangeably - albeit incorrectly (von Solms and van Niekerk, 2013). While there is no agreed upon definition of information security, the definition included in ISO/IEC 27002 has been widely used. ISO/IEC 27002 defines information security as the "preservation of [the] confidentiality, integrity and availability of information." Like information security, there is no universal definition of cybersecurity. According to the International Telecommunications Union (ITU), "[c]ybersecurity strives to ensure the attainment and maintenance of the security properties of the organization and user's assets against relevant security risks in the cyber environment" (ITU-T X.1205). Cybersecurity thus not only protects cyberspace, "but also … protect[s]... those … [who] function in cyberspace and any of their assets that can be reached via cyberspace" (von Solms and van Niekerk, 2013, p. 101).

Information security and cybersecurity are shaped by vulnerability disclosures. When vulnerabilities are discovered by researchers and professionals in the field, they can either be fully disclosed or responsibly disclosed (Trull, 2015). Full disclosure involves publishing the software or hardware vulnerabilities online (e.g., on a website) before a fix is available (Trull, 2015). In contrast, responsible disclosure refers to the practice of not disclosing the vulnerability until the organization responsible for the hardware or software deals fixes the vulnerability (Trull, 2015). For responsible disclosure, the researcher or professional contacts the affected organization, and waits until the organization releases a fix for the identified vulnerability. After a fix is released, the researcher or professional can officially disclose information about the vulnerability and receive credit for this identification. Utilizing this method of disclosure, the researcher or professional may ask for what is known as a Common Vulnerabilities and Exposure ( CVE) identifier. The CVE, a list of common identifiers for publicly known cybersecurity vulnerabilities" (CVE, n.d.), is used to track vulnerabilities across major pieces of software, as well as those who find such vulnerabilities. In addition to full and responsible disclosure, the researcher or professional may choose not to disclose the vulnerability (Cencini, Yu, & Chan, 2005). A further method of disclosure is coordinated vulnerability disclosure (CVD), which refers to "the process of gathering information from vulnerability finders, coordinating the sharing of that information between relevant stakeholders, and disclosing the existence of software vulnerabilities and their mitigation to various stakeholders, including the public" (Householder, Wassermann, Manion, and King, 2017).

Best practice guidelines are available for vulnerability disclosures and the handling of vulnerabilities. Cases in point are the best practice guidelines developed and published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) (for more information about these organizations, see Cybercrime Module 4 on Introduction to Digital Forensics) on vulnerability disclosure ( ISO/IEC 29147) and vulnerability handling processes ( ISO/IEC 30111).

 

Next: Cybersecurity measures and usability

Back to top