Sharing of vulnerability information among companies - a survey of Swedish companies
(2019) Euromicro Conference on Software Engineering and Advanced Applications (SEAA) p.284-291- Abstract
- Software products are rarely developed from scratch and vulnerabilities in such products might reside in parts that are either open source software or provided by another organization. Hence, the total cybersecurity of a product often depends on cooperation, explicit or implicit, between several organizations.
We study the attitudes and practices of companies in software ecosystems towards sharing vulnerability information. Furthermore, we compare these practices to contemporary cybersecurity recommendations. This is performed through a questionnaire-based qualitative survey. The questionnaire is divided into two parts: the providers' perspective and the acquirers' perspective. The results show that companies are willing to share... (More) - Software products are rarely developed from scratch and vulnerabilities in such products might reside in parts that are either open source software or provided by another organization. Hence, the total cybersecurity of a product often depends on cooperation, explicit or implicit, between several organizations.
We study the attitudes and practices of companies in software ecosystems towards sharing vulnerability information. Furthermore, we compare these practices to contemporary cybersecurity recommendations. This is performed through a questionnaire-based qualitative survey. The questionnaire is divided into two parts: the providers' perspective and the acquirers' perspective. The results show that companies are willing to share information with each other regarding vulnerabilities. Sharing is not considered to be harmful neither to the cybersecurity nor their business, even though a majority of the respondents consider vulnerability information sensitive. However, the companies, despite being open to sharing, are less inclined to proactively sharing vulnerability information. Furthermore, the providers do not perceive that there is a large interest in vulnerability information from their customers. Hence, the companies' overall attitude to sharing vulnerability information is passive but open. In contrast, contemporary cybersecurity guidelines recommend active disclosure and sharing among actors in an ecosystem. (Less) - Abstract (Swedish)
- Software products are rarely developed from scratch and vulnerabilities in such products might reside in parts that are either open source software or provided by another organization. Hence, the total cybersecurity of a product often depends on cooperation, explicit or implicit, between several organizations.
We study the attitudes and practices of companies in software ecosystems towards sharing vulnerability information. Furthermore, we compare these practices to contemporary cybersecurity recommendations. This is performed through a questionnaire-based qualitative survey. The questionnaire is divided into two parts: the providers' perspective and the acquirers' perspective. The results show that companies are willing to share... (More) - Software products are rarely developed from scratch and vulnerabilities in such products might reside in parts that are either open source software or provided by another organization. Hence, the total cybersecurity of a product often depends on cooperation, explicit or implicit, between several organizations.
We study the attitudes and practices of companies in software ecosystems towards sharing vulnerability information. Furthermore, we compare these practices to contemporary cybersecurity recommendations. This is performed through a questionnaire-based qualitative survey. The questionnaire is divided into two parts: the providers' perspective and the acquirers' perspective. The results show that companies are willing to share information with each other regarding vulnerabilities. Sharing is not considered to be harmful neither to the cybersecurity nor their business, even though a majority of the respondents consider vulnerability information sensitive. However, the companies, despite being open to sharing, are less inclined to proactively sharing vulnerability information. Furthermore, the providers do not perceive that there is a large interest in vulnerability information from their customers. Hence, the companies' overall attitude to sharing vulnerability information is passive but open. In contrast, contemporary cybersecurity guidelines recommend active disclosure and sharing among actors in an ecosystem. (Less)
Please use this url to cite or link to this publication:
https://lup.lub.lu.se/record/0fa7e4ff-5f78-4654-95fc-805e9571319c
- author
- Olsson, Thomas ; Hell, Martin LU ; Höst, Martin LU ; Franke, Ulrik and Borg, Markus
- organization
- publishing date
- 2019-11-21
- type
- Chapter in Book/Report/Conference proceeding
- publication status
- published
- subject
- host publication
- Euromicro Conference on Software Engineering and Advanced Applications (SEAA)
- pages
- 8 pages
- publisher
- IEEE - Institute of Electrical and Electronics Engineers Inc.
- conference name
- Euromicro Conference on Software Engineering and Advanced Applications (SEAA)
- conference location
- Kallithea-Chalkidik, Greece
- conference dates
- 2019-08-28 - 2019-08-30
- external identifiers
-
- scopus:85076009923
- ISBN
- 978-1-7281-3421-5
- 978-1-7281-3285-3
- 978-1-7281-3422-2
- DOI
- 10.1109/SEAA.2019.00051
- project
- HATCH: Handling Vulnerabilities in the Value Chain
- language
- English
- LU publication?
- yes
- id
- 0fa7e4ff-5f78-4654-95fc-805e9571319c
- date added to LUP
- 2019-09-02 15:53:40
- date last changed
- 2024-05-28 22:48:09
@inproceedings{0fa7e4ff-5f78-4654-95fc-805e9571319c,
abstract = {{Software products are rarely developed from scratch and vulnerabilities in such products might reside in parts that are either open source software or provided by another organization. Hence, the total cybersecurity of a product often depends on cooperation, explicit or implicit, between several organizations.<br/>We study the attitudes and practices of companies in software ecosystems towards sharing vulnerability information. Furthermore, we compare these practices to contemporary cybersecurity recommendations. This is performed through a questionnaire-based qualitative survey. The questionnaire is divided into two parts: the providers' perspective and the acquirers' perspective. The results show that companies are willing to share information with each other regarding vulnerabilities. Sharing is not considered to be harmful neither to the cybersecurity nor their business, even though a majority of the respondents consider vulnerability information sensitive. However, the companies, despite being open to sharing, are less inclined to proactively sharing vulnerability information. Furthermore, the providers do not perceive that there is a large interest in vulnerability information from their customers. Hence, the companies' overall attitude to sharing vulnerability information is passive but open. In contrast, contemporary cybersecurity guidelines recommend active disclosure and sharing among actors in an ecosystem.}},
author = {{Olsson, Thomas and Hell, Martin and Höst, Martin and Franke, Ulrik and Borg, Markus}},
booktitle = {{Euromicro Conference on Software Engineering and Advanced Applications (SEAA)}},
isbn = {{978-1-7281-3421-5}},
language = {{eng}},
month = {{11}},
pages = {{284--291}},
publisher = {{IEEE - Institute of Electrical and Electronics Engineers Inc.}},
title = {{Sharing of vulnerability information among companies - a survey of Swedish companies}},
url = {{http://dx.doi.org/10.1109/SEAA.2019.00051}},
doi = {{10.1109/SEAA.2019.00051}},
year = {{2019}},
}