Optimal Policy for Software Vulnerability Disclosure

Abstract

Software vulnerabilities represent a serious threat to cyber security: most cyber-attacks exploit known vulnerabilities. Unfortunately, there is no agreed-upon policy for their disclosure. Disclosure policy (protected period given to a vendor to patch the vulnerability) indirectly affects the speed and quality of the patch that a vendor develops. Thus CERT/CC and similar bodies acting in the public interest can use it to influence behavior of vendors and reduce social cost. This paper develops a framework to analyze the optimal timing of disclosure policy. We formulate a game-theoretic model involving a social planner who sets disclosure policy and a vendor who decides on patching. We show that vendors (almost) always patch less expeditiously than is socially optimal. The social planner optimally shrinks the protected period to push vendors to deliver the patch more quickly. We extend the basic model to allow the proportion of users implementing patches to depend upon the quality (chosen by the vendor) of the patch. Another extension allows for some fraction of users to use \work-arounds. While the basic results of our model are robust, these extension provide additional insights into how disclosure policy affects a vendor's decision and, in turn, what should a policy-maker do.