Title:

Ethics in Security Vulnerability Research

Author(s):

Matwyshyn, Andrea M.
Cui, Ang
Keromytis, Angelos D.
Stolfo, Salvatore

Date:

2010

Type:

Articles

Department:

Computer Science

Volume:

8

Permanent URL:

http://hdl.handle.net/10022/AC:P:10581

Book/Journal Title:

IEEE Security & Privacy

Abstract:

Debate has arisen in the scholarly community, as well as among policymakers and business entities, regarding the role of vulnerability researchers and security practitioners as sentinels of information security adequacy. The exact definition of vulnerability research and who counts as a "vulnerability researcher" is a subject of debate in the academic and business communities. For purposes of this article, we presume that vulnerability researchers are driven by a desire to prevent information security harms and engage in responsible disclosure upon discovery of a security vulnerability. Yet provided that these researchers and practitioners do not themselves engage in conduct that causes harm, their conduct doesn't necessarily run afoul of ethical and legal considerations. We advocate crafting a code of conduct for vulnerability researchers and practitioners, including the implementation of procedural safeguards to ensure minimization of harm.

Subject(s):

Computer science

DOI:

http://dx.doi.org/10.1109/MSP.2010.67

Item views:

127

Metadata:

description

View | Download