Sharing of vulnerability information among companies -- a survey of Swedish companies
This research addresses the problem of improving cybersecurity through information sharing among companies in software ecosystems, but it is incremental as it surveys existing practices without proposing new methods.
The study surveyed Swedish companies to understand their attitudes and practices regarding sharing vulnerability information within software ecosystems, finding that while companies are open to sharing and do not see it as harmful, they are passive and less inclined to proactively share, contrasting with cybersecurity guidelines that recommend active disclosure.
Software products are rarely developed from scratch and vulnerabilities in such products might reside in parts that are either open source software or provided by another organization. Hence, the total cybersecurity of a product often depends on cooperation, explicit or implicit, between several organizations. We study the attitudes and practices of companies in software ecosystems towards sharing vulnerability information. Furthermore, we compare these practices to contemporary cybersecurity recommendations. This is performed through a questionnaire-based qualitative survey. The questionnaire is divided into two parts: the providers' perspective and the acquirers' perspective. The results show that companies are willing to share information with each other regarding vulnerabilities. Sharing is not considered to be harmful neither to the cybersecurity nor their business, even though a majority of the respondents consider vulnerability information sensitive. However, the companies, despite being open to sharing, are less inclined to proactively sharing vulnerability information. Furthermore, the providers do not perceive that there is a large interest in vulnerability information from their customers. Hence, the companies' overall attitude to sharing vulnerability information is passive but open. In contrast, contemporary cybersecurity guidelines recommend active disclosure and sharing among actors in an ecosystem.