Free cyber toolkit helps charities secure vulnerabilities

Good Communication

 

Setting up a dedicated email address (such as security@example.com) or contact web form ensures that the vulnerability information gets to the person who can fix the issue.

 

The NCSC recommend vulnerability information is protected. One of the easiest ways to achieve this is to use a secure web form. You should make sure this contact route is easy to find. You can add it to your ‘Contact Us’ web page (or privacy or security pages) and publish a security.txt.

 

If you don’t want to highlight it on a web page, then you should publish the contact route in a security.txt.

 

 

Clear Policy

 

By providing a clear policy, you define what to expect from someone reporting a vulnerability (as well as what you will do in response). This means you can work with them in an agreed framework.

 

The ISO standard defines the minimum requirements for a vulnerability disclosure policy.

 

In its basic form, a vulnerability disclosure policy should contain the following information:

• How you want to be contacted
• Secure communication options (for example, a secure web form)
• What information to include in the report
• What the finder should expect to happen
• Guidance on what is in and out of scope for the finder to do in finding vulnerabilities

 

Ease of Use

 

There is no point to a vulnerability disclosure process if no one knows it exists, or it is difficult to use.

 

So, the process should be easy for the organisation to set up, and easy for individuals to report vulnerabilities.

 

The proposed IETF standard Security.txt is a great way for an individual to easily find all the information required.

 

It describes a text file that webmasters can host in the “/.well-known” directory of the domain root. It advertises the organisation’s vulnerability disclosure process so that someone can quickly find all of the information needed to report a vulnerability.

 

The file contains two key fields:

• Contact: How finders should report vulnerabilities. For example, the email address of a link to the secure web form
• Policy: A link to the organisation’s vulnerability disclosure policy

Whilst is not intended to be a comprehensive guide to creating and implementing a vulnerability disclosure process, the toolkit will help you focus on the essential components needed to make a start.

 

Even if your organisation already has a process in place, please download the toolkit as it may help you to develop what you already have in place.