Embrace full disclosure to curb IT breaches

By Muthoka Kioni

Many local companies experience IT security breaches and keep quiet about it. A breach is a rupture, break or gap whose cause has not been determined. It can be more vividly defined as an opening. Digital walls protect valuable data systems and when they are breached the repercussions are extremely costly to both individuals and companies.

When a tree falls in a forest, it certainly makes a sound the same way as when a perimeter wall collapses. If no one hears the tree crashing down or the wall falling, then the event is not immediately discovered.

What if a computer network is vulnerable or breached and no one knows? Is it insecure? A collapsed section of a wall makes it insecure to those who know about the vulnerability. This also applies to a computer network with a security hole. If no one knows about it, then the computer network or digital wall is secure.

However, if someone knows about it, then the IT system is insecure to the discoverer but secure to everyone else. If part of your perimeter wall is vulnerable and you do not know about it, then to you it is secure. But it presents an opportunity to a robber who knows about it.

Avoiding secrecy

What if you knew that your network was vulnerable? What if you knew if part of that wall round your home was vulnerable? Would you publicise this fact?

The vulnerability exists, whether or not anyone knows. Keeping computer breaches and vulnerabilities secret does not guarantee security. An attacker can’t exploit a vulnerability he does not know about. A defender, also, cannot protect a vulnerability he does not know about.

In Information Technology, security that is based on publishing breaches and vulnerabilities is more robust. Those companies that suffer hacking attacks and keep them secret undermine the natural flow of information. Instead of fighting this flow, companies should embrace full disclosure, which ensures they end up with more security.

The Internet is still insecure, but it would have been much worse if its software vulnerabilities had been kept secret. Disclosure about its vulnerabilities has resulted in many of them being fixed.

Companies should stop sweeping their vulnerabilities and problems under the rug. They should instead embrace the full disclosure security policy. This will not only enhance their system security but also prevent those holes in their walls being announced in blogs and newspapers.

The writer is an ICT Security and Forensic Specialist. Email: [email protected]