the dutch responsible disclosure policy tarik el yassem€¦ · the dutch responsible disclosure...
TRANSCRIPT
![Page 1: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/1.jpg)
![Page 2: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/2.jpg)
The Dutch Responsible Disclosure Policy
Tarik El Yassem
![Page 3: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/3.jpg)
Agenda
Introduction Responsible disclosure: what and why The Dutch RD guideline Intermediary results Lessons learned The road ahead Questions
![Page 4: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/4.jpg)
Introduction
Tarik El Yassem 8 years at GOVCERT.NL/ NCSC.NL Msc from University of Amsterdam Incident response Co-author of Responsible Disclosure guideline Implemented it at NCSC, helped others Senior security intel analyst at Rabobank Global SOC
![Page 5: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/5.jpg)
Does this look familiar?
Incidents due to “leaks” in the media Inconvenient timing Researchers frustrated Organization panics Business as usual after damage control
Org still not listening to security people Not learning No transparency
Ignore, be vulnerable, fix, repeat
![Page 6: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/6.jpg)
Can't we all just get along?
Be reachable Get time to fix Track and follow up Appreciate white-hat community Don't arrest clumsy teenagers Learn from vulnerabilities
![Page 7: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/7.jpg)
- = - RD: what and why
![Page 8: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/8.jpg)
The Dutch RD guideline
Looked at others (Microsoft, Facebook, Google) Looked at standards ISO Mostly focused on products Needed broader approach Had talks with:
Hackers, researchers, journalists Banks, telco's, vital infrastructure Law enforcement, lawyers, policy makers Political pressure
![Page 9: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/9.jpg)
Reporter experience
Reporter = researcher, hacker, you, your mom
![Page 10: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/10.jpg)
Reporters: we bring gifts!
![Page 11: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/11.jpg)
Reporters: helpdesk
![Page 12: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/12.jpg)
Reporters: security department?
![Page 13: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/13.jpg)
Reporters: police
![Page 14: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/14.jpg)
Reporters: credits
![Page 15: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/15.jpg)
Reporters: want small reward
![Page 16: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/16.jpg)
Reporters: protect customers
![Page 17: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/17.jpg)
Reporters: they don't give
![Page 18: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/18.jpg)
Reporters: no transparency
![Page 19: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/19.jpg)
Organizations' experience
Banks, telco's, governments, small businesses, vital infrastructure
![Page 20: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/20.jpg)
Organizations: NoOooOOoo!!!!
![Page 21: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/21.jpg)
Organizations: all criminals!
![Page 22: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/22.jpg)
Organizations: blackmail!
![Page 23: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/23.jpg)
Organizations: cost effective
![Page 24: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/24.jpg)
Organizations: limited sight
![Page 25: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/25.jpg)
Organizations: no budget
![Page 26: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/26.jpg)
Organizations: no policy
![Page 27: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/27.jpg)
Organizations: vague reports
62.100.52.106
![Page 28: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/28.jpg)
Result: policy guidelines
https://www.ncsc.nl/english/current-topics/news/responsible-disclosure-guideline.html
![Page 29: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/29.jpg)
Result: guidelines; not law
• But Ministry of Security and Justice and Public Prosecution Service support and advocate guidelines
Public Prosecution Service ultimately still has the discretion to prosecute, for instance when a reporter goes ‘too far’ despite of agreed terms, of course this also holds true for organisations
• Policy is an agreement between organisation and reporter
Reporter and organisation agree to adhere to published policy, organisation promises not to file a complaint with the Police
• More detailed terms on disclosure, proposed fix and credits are made upon further contact
![Page 30: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/30.jpg)
Intermediate results
![Page 31: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/31.jpg)
Intermediate results
Almost zero incidents due to media Working with media to disclose Better relations with hacker community People getting jobs instead of arrests Organizations waking up More mature, aware and secure society
![Page 32: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/32.jpg)
Reports to the NCSC
38
47
28
NCSC Government Other
* From start till June 2014
![Page 33: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/33.jpg)
Intermediate results
T-shirts, tropys, halls of fame, money, diners, tickets to or presenting at conferences, site visits, etc
![Page 34: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/34.jpg)
Lessons learned
Responsible Disclosure policy since January 2013 Lots of quality disclosures Website vulnerabilities Internet Explorer zero day Also false-positives from scanning tools Fixed quickly but organizations not looking beyond Worth wile and useful
![Page 35: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/35.jpg)
Lessons learned
![Page 36: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/36.jpg)
Lessons learned
Creating policies
Involve hackers & researchers Get backup from politicians Get backup from public prosecutors Develop your own policy
![Page 37: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/37.jpg)
Lessons learned
Implementing policies Find a boardroom sponsor Discuss responsibilities Think about credits and rewards Develop a process Assign a coordinator Learn from disclosures and share
![Page 38: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/38.jpg)
The road ahead
Evaluation in early 2015 by NCSC Revised edition International organizations We hope others will follow
![Page 39: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/39.jpg)
Conclusion
Responsible disclosure works! Very useful for organizations The Netherlands is, who's with us?
![Page 40: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/40.jpg)
Questions?
More questions? Questions for me: [email protected] Questions for ncsc.nl: [email protected]
More information: http://responsibledisclosure.nl/en/ http://www.ncsc.nl/
![Page 41: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/41.jpg)
Thanks
Thanks Rabobank, NCSC.NL and you!
![Page 42: The Dutch Responsible Disclosure Policy Tarik El Yassem€¦ · The Dutch Responsible Disclosure Policy Tarik El Yassem. Agenda Introduction Responsible disclosure: what and why The](https://reader034.vdocuments.mx/reader034/viewer/2022052423/5f0723b57e708231d41b8064/html5/thumbnails/42.jpg)