A bipartisan pair of US Senators introduced a bill that would require the US Department of Homeland Security to create an ongoing program to allow security experts to report bugs on agency websites.
“This bill encourages ethical hackers to come forward with information they find about vulnerabilities in our government networks by assuring them that if they do, they’ll have protection under the law,” Hassan said in a statement.
If enacted, Homeland Security would develop a remediation process to address any reported bugs and present annual reports tracking how many are reported, how many are fixed and how long it’s taking between a flaw being reported and being fixed. Congress also wants to know how many people or organizations participate.
“As a long time former member of the MITRE CVE (OVAL) advisory board in the support of the National Vulnerability Database, housed at NIST, I believe this is an important step in helping to better harden our many exploitable government networks,” said Gary S. Miliefsky, Publisher of Cyber Defense Magazine.
The bill is a companion piece to House version sponsored by Majority Leader Kevin McCarthy, R-Calif, which passed in late September.
The Senate already passed another cybersecurity bill from Portman and Hassan called the Hack the Department of Homeland Security Act. That bill would also encourage outside security researchers to report vulnerabilities to the agency, but in scheduled bug bounty competitions.
The Hack DHS Act is still waiting on House action.
Sources: NextGov and Senate.gov
