Baiba Kaskina from CERT.LV will talk about “Responsible Disclosure Policy”. This talk will explain the main principles of responsible or coordinated response, who are the actors of this game, what colour are their hats and what could be the possible implementation. Known cases of responsible disclosure policy Latvia as well as international experience will be discussed and future steps considered. (Language — Latvian) Baiba Kaskina is the head of CERT.LV – Latvian national and governmental CSIRT team.

1. Responsible
disclosure
Baiba Kaškina
16.07.2015., Rīga, Devclub.lv

2. National partners
General public
Web resources
• cert.lv
• esidross.lv
• twitter.com/certlv
CERT/CSIRT community
International partners
Media
• TV
• Radio
• Press
Critical infrastructure
Internet service providers
State institutions
Local municipalities
Private sector

4. What is Responsible Disclosure?
• Responsible
– Coordinated disclosure
– Rules of engagement & principle of doing the least possible harm
just to provide POC
– ISO/IEC 29147, ISO/IEC 30111
– Intention
• Full disclosure
– Good
– Bad
– Ugly

5. Responsible Disclosure
leading actors
• Researcher / Hacker
• Target
– System
– Software
– Hardware
• Vendor
• Owner
• Society
TIME

6. Responsible Disclosure
Black hat or White hat ?

7. Responsible Disclosure
implementation
• Responsible disclosure
• Bug Bounty
• Motivators
• CERT as coordinator
• Timeframe
• Transparency & Responsibility on both sides

8. Responsible Disclosure Goals
• A common RD framework that can be applicable
country / EU wide
• Protect the researcher?
• Comply with existing legal framework?
• Reaching a certain level of Cybersecurity maturity

9. Responsible Disclosure
Experience in Latvia
• Implemented: Swedbank
• Not implemented but has use cases
– Valmiera municipality
– Bank authentication
– Several government web sites & information systems
– Mobile apps
– Public transport RFID

10. Paldies!
Thank you!
https://www.cert.lv
baiba@cert.lv