GIAC Foundational Cybersecurity Technologies Practice Test

When is it appropriate to go public with a vulnerability found on a business website?

1. Immediately after discovering it

2. Before a patch, if discussed with the business

3. After the patch has been released

4. Only if it benefits the tester

The correct answer is: After the patch has been released

Going public with a vulnerability found on a business website after a patch has been released is important for several reasons. First and foremost, this approach helps ensure that the business has had adequate time to mitigate the risk associated with the vulnerability. By waiting until a patch is in place, the potential for exploitation is minimized, protecting users and the organization from potential harm. Furthermore, when a patch is released, the business is often prepared with a response plan, which can include public communication strategies. This ensures that accurate information is provided to users and stakeholders about the nature of the vulnerability, its implications, and steps taken to secure the system. This timing also fosters a relationship built on trust between the security community and the organization. Disclosing vulnerabilities responsibly after remediation reinforces the idea that the organization is committed to cybersecurity and is proactive in addressing potential threats. In contrast, public disclosure before the necessary mitigation is in place could lead to malicious actors exploiting the vulnerability, jeopardizing user data and eroding trust in the business. Thus, waiting to go public until after a patch has been released supports both the organization’s interests and the broader cybersecurity ecosystem.