Sharing of vulnerability information among companies - a survey of Swedish companies

Research output: Chapter in Book/Report/Conference proceedingPaper in conference proceeding

Abstract

Software products are rarely developed from scratch and vulnerabilities in such products might reside in parts that are either open source software or provided by another organization. Hence, the total cybersecurity of a product often depends on cooperation, explicit or implicit, between several organizations.
We study the attitudes and practices of companies in software ecosystems towards sharing vulnerability information. Furthermore, we compare these practices to contemporary cybersecurity recommendations. This is performed through a questionnaire-based qualitative survey. The questionnaire is divided into two parts: the providers' perspective and the acquirers' perspective. The results show that companies are willing to share information with each other regarding vulnerabilities. Sharing is not considered to be harmful neither to the cybersecurity nor their business, even though a majority of the respondents consider vulnerability information sensitive. However, the companies, despite being open to sharing, are less inclined to proactively sharing vulnerability information. Furthermore, the providers do not perceive that there is a large interest in vulnerability information from their customers. Hence, the companies' overall attitude to sharing vulnerability information is passive but open. In contrast, contemporary cybersecurity guidelines recommend active disclosure and sharing among actors in an ecosystem.

Details

Authors
Organisations
External organisations
  • Research Institutes of Sweden (RISE)
Research areas and keywords

Subject classification (UKÄ) – MANDATORY

  • Software Engineering
Original languageSwedish
Title of host publicationEuromicro Conference on Software Engineering and Advanced Applications (SEAA)
Pages284
Number of pages291
Publication statusAccepted/In press - 2019 Aug 27
Publication categoryResearch
Peer-reviewedYes
EventEuromicro Conference on Software Engineering and Advanced Applications (SEAA) - Kallithea-Chalkidik, Greece
Duration: 2019 Aug 282019 Aug 30

Conference

ConferenceEuromicro Conference on Software Engineering and Advanced Applications (SEAA)
CountryGreece
CityKallithea-Chalkidik
Period2019/08/282019/08/30