UK NCSC Announces Software Vulnerability Initiative

The U.K. National Cyber Security Centre unveiled its Vulnerability Research Initiative. Under the program, the agency will collaborate with industry experts to expand its vulnerability research.

See Also: Averting the Breach: 5 Scenarios Where a Services Retainer Could Have Changed the Outcome

Currently, vulnerability research within the NCSC is performed by its in-house research team consisting of technical experts, relationship managers and project managers. By collaborating with external sources, the agency said it intends to develop a “deep understanding of security on a wide range of the technologies.”

“This successful way of working increases NCSC’s capacity to do vulnerability research and shares VR expertise across the UK’s VR ecosystem,” the agency said.

Details on the new program are sparse, but the agency plans to work with industry experts to detect vulnerabilities, understand how the industry addresses these flaws, and explore associated tooling and research.

Interested parties are welcome to contact the NCSC, which plans to expand the program to include artificial intelligence vulnerability research in the future.

The announcement from the agency comes after the Common Vulnerabilities and Exposures, a database run by nonprofit MITRE, faced a brief disruption in April when the U.S. Department of Homeland Security failed to renew the program’s funding. This prompted concerns from security experts who fear losing the database that catalogs publicly disclosed cybersecurity vulnerabilities could affect incident response globally (see: Cybersecurity Alarms Sound Over Loss of CVE Program Funding).

The U.S. Cybersecurity and Infrastructure Security Agency later extended the contract for an unspecified period of time.

Funding issues in the United States raised concerns about overreliance on the CVE database, resulting in the European Union in June unveiling its Vulnerability Database, its centralized public database for software vendors and researchers to disclose vulnerabilities.

“We have seen the recent funding concern around the CVE Program, which brought concerns as there wasn’t another single source of vulnerability information, what would happen next?” said Stephen Fewer, principal security researcher at Rapid7 told Information Security Media Group in a June interview (see: Filling the Gap with the European Vulnerability Database).

The EU-led effort will provide enrichment to existing vulnerability research initiatives, while also allowing the trading bloc to prioritize “vulnerabilities that are of more concern to the EU,” he said.

Similar to the EU database, the NCSC-led effort could broaden the vulnerability knowledge base and lead to increased private-public partnerships in the country, security experts told ISMG.

“This is ever more critical as we see time and again how exploited vulnerabilities can have severe repercussions for organizations,” said Sylvain Cortes, vice president of strategy at vulnerability management company Hackuity. He expects the initiative to help the NCSC “better identify and understand vulnerabilities.”

But since the initiative is less likely to compensate researchers – unlike bug bounty programs – it could see limited participation, said Kevin Breen, senior director of cyber threat research at Bristol-based Immersive.

“This may limit the number of individuals willing to participate, as there is little incentive to contribute when they could be compensated for similar work through existing bug bounty schemes,” Breen said.

For the initiative to be successful, it’s vital for the NCSC to ensure its sustainability, said Kevin Robertson, CTO of Acumen Cyber.

“It is essential that this does not become yet another example of wasted potential in a field where independent action often proves more meaningful,” Robertson said.