CISA Orders Agencies To Set Up Vulnerability Disclosure Programs (cyberscoop.com) 4
Out of scores of federal civilian agencies, only a handful of them have official programs to work with outside security researchers to find and fix software bugs -- a process that is commonplace in the private sector. From a report: Now, to put an end to the feet-dragging, the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency is giving agencies six months to set up the programs, known as vulnerability disclosure policies (VDPs). CISA on Wednesday issued a directive requiring agencies to establish VDPs that foreswear legal action against researchers who act in good faith, allow participants to submit vulnerability reports anonymously and cover at least one internet-accessible system or service. It's the latest sign that federal officials are warming to white-hat hackers from various walks of life. "We believe that better security of government computer systems can only be realized when the people are given the opportunity to help," CISA Assistant Director Bryan S. Ware said in announcing the directive. The White House echoed that language in a memo to agencies backing the VDP initiative and setting deadlines for agencies to act.
Or What? (Score:2)
What are the consequences if an agency fails to comply? Can or will the DHS haul decision makers into court or jail or fine them personally?