Defense Dept. expands vulnerability disclosure program to all publicly accessible defense systems

This move allows greater research and reporting of bugs to Pentagon

depatment of defenve buiding

The US Department of Defense (DoD) has expanded its Vulnerability Disclosure Program (VDP) to include all publicly accessible DoD websites and systems.

The VDP is run by the Department of Defense Cyber Crime Center (DC3) to enable security researchers to report vulnerabilities on the DoD Information Network (DoDIN) to improve network defense.

The expansion announced today allows for research and reporting of vulnerabilities related to all DOD publicly accessible networks, frequency-based communication, internet of things (IoT), and industrial control systems, according to Brett Goldstein, the director of the Defense Digital Service. Originally, the program was limited to DoD public-facing websites and applications.

Related Resource

X-Force threat intelligence index

Understand the threat landscape with fresh intelligence

X Force threat intelligence indexDownload now

"This expansion is a testament to transforming the government's approach to security and leapfrogging the current state of technology within DOD," he said.

Before the program’s launch, researchers had no way of reporting bugs they found in publicly accessible DoD systems. 

“Because of this, many vulnerabilities went unreported," said Goldstein. "The DOD Vulnerability Policy launched in 2016 because we demonstrated the efficacy of working with the hacker community and even hiring hackers to find and fix vulnerabilities in systems."

Since the launch of the Vulnerability Disclosure Program, security researchers have submitted over 29,000 vulnerability reports. Officials said that over 70% of them were determined to be valid.

Experts believe the expansion will lead to a massive increase in the number of bugs reported to them.

"The department has always maintained the perspective that DOD websites were only the beginning as they account for a fraction of our overall attack surface," said DOD Cyber Crime Center director Kristopher Johnson.

In April, the DoD Cyber Crime Center unveiled a 12-month Defense Industrial Base Vulnerability Disclosure Program (DIB-VDP) pilot to enable security researchers to report flaws in DoD contractor partner’s information systems, web properties, and other identified scoped assets. The 12-month program aspires to employ the lessons learned from existing reports made through the Pentagon’s Vulnerability Disclosure Program.

“The expansion of vulnerability research to participating DoD contractor networks replicates the DoD’s’ success by making participating DoD contractor networks available for vulnerability research,” said the DoD's Cyber Crime Center on its HackerOne webpage. “No technology is perfect, but DC3 believes that working with skilled security researchers across the globe is crucial to identifying their weaknesses.”

Featured Resources

The definitive guide to warehouse efficiency

Get your free guide to creating efficiencies in the warehouse

Free download

The total economic impact™ of Datto

Cost savings and business benefits of using Datto Integrated Solutions

Download now

Three-step guide to modern customer experience

Support the critical role CX plays in your business

Free download

Ransomware report

The global state of the channel

Download now

Recommended

Researchers disclose top flaws abused by ransomware gangs
ransomware

Researchers disclose top flaws abused by ransomware gangs

20 Sep 2021
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

17 Sep 2021
How do hackers choose their targets?
hacking

How do hackers choose their targets?

17 Sep 2021
Owner of DDoS for hire sites found guilty of hacking offences
distributed denial of service (DDOS)

Owner of DDoS for hire sites found guilty of hacking offences

17 Sep 2021

Most Popular

What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Google takes down map showing homes of 111,000 Guntrader customers
data breaches

Google takes down map showing homes of 111,000 Guntrader customers

2 Sep 2021
Intuit plans end-to-end SMB platform after $12 billion Mailchimp acquisition
mergers and acquisitions

Intuit plans end-to-end SMB platform after $12 billion Mailchimp acquisition

14 Sep 2021