Optimal Policy for Software Vulnerability Disclosure

33 Pages Posted: 20 Feb 2005 Last revised: 20 Feb 2015

See all articles by Ashish Arora

Ashish Arora

Duke University - Fuqua School of Business; National Bureau of Economics Research; Duke Innovation & Entrepreneurship Initiative

Rahul Telang

Carnegie Mellon University - H. John Heinz III School of Public Policy and Management

Hao Xu

Carnegie Mellon University - School of Computer Science

Abstract

Software vulnerabilities represent a serious threat to cyber security: most cyber-attacks exploit known vulnerabilities. Unfortunately, there is no agreed-upon policy for their disclosure. Disclosure policy (protected period given to a vendor to patch the vulnerability) indirectly affects the speed and quality of the patch that a vendor develops. Thus CERT/CC and similar bodies acting in the public interest can use it to influence behavior of vendors and reduce social cost. This paper develops a framework to analyze the optimal timing of disclosure policy. We formulate a game-theoretic model involving a social planner who sets disclosure policy and a vendor who decides on patching. We show that vendors (almost) always patch less expeditiously than is socially optimal. The social planner optimally shrinks the protected period to push vendors to deliver the patch more quickly. We extend the basic model to allow the proportion of users implementing patches to depend upon the quality (chosen by the vendor) of the patch. Another extension allows for some fraction of users to use \work-arounds. While the basic results of our model are robust, these extension provide additional insights into how disclosure policy affects a vendor's decision and, in turn, what should a policy-maker do.

Keywords: software, vulnerability, disclosure, public policy

JEL Classification: L89, L51, H4

Suggested Citation

Arora, Ashish and Telang, Rahul and Xu, Hao, Optimal Policy for Software Vulnerability Disclosure. Available at SSRN: https://ssrn.com/abstract=669023 or http://dx.doi.org/10.2139/ssrn.669023

Ashish Arora

Duke University - Fuqua School of Business ( email )

Box 90120
Durham, NC 27708-0120
United States

National Bureau of Economics Research

1050 Massachusetts Avenue
Cambridge, MA 02138
United States

Duke Innovation & Entrepreneurship Initiative ( email )

215 Morris St., Suite 300
Durham, NC 27701
United States

Rahul Telang (Contact Author)

Carnegie Mellon University - H. John Heinz III School of Public Policy and Management ( email )

4800 Forbes Ave
Pittsburgh, PA 15213-3890
United States
412-268-1155 (Phone)

Hao Xu

Carnegie Mellon University - School of Computer Science ( email )

5000 Forbes Avenue
Pittsburgh, PA 15213
United States

Do you have a job opening that you would like to promote on SSRN?

Paper statistics

Downloads
340
Abstract Views
2,682
rank
115,453
PlumX Metrics