Abstract
Vendors, security consultants and information security researchers seek guidance on if and when to disclose information about specific software or hardware security vulnerabilities. We apply Kantianism to argue that vendors and third parties (InfoSec researchers, consultants, and other interested parties) have an ethical obligation to inform customers and business partners (such as channel partners or providers of complementary products and services) about specific software vulnerabilities (thus addressing if disclosure should occur). We apply Utilitarianism to address the question of when disclosure should occur. By applying these two philosophical perspectives we conclude that to maximize social welfare, vendors should release software fixes as soon as possible, and third parties should adopt a coordinated disclosure policy to avoid placing customers and business partners at unnecessary risk.
Recommended Citation
McLaughlin, Mark-David and Gogan, Janis, "Why Cooperate? Ethical Analysis of InfoSec Vulnerability Disclosure" (2015). WISP 2015 Proceedings. 10.
https://aisel.aisnet.org/wisp2015/10