Risk & Repeat: Vulnerabilities Equities Process gets an update

The White House published new documents on the U.S. government's Vulnerabilities Equities Process that offer new insight and transparency into a previously murky and cryptic strategy for handling security flaws.

Last week, Rob Joyce, special assistant to the president and cybersecurity coordinator for the National Security Council, said the documents were designed to improve the Vulnerabilities Equities Process, which has been a source of debate this year following the release of hacking tools and malware used by the NSA and CIA.

Many in the infosec and vendor communities expressed concern the government was hoarding undisclosed software flaws to be used in various exploits or cyberweapons, and that failure to disclose the flaws puts millions of users at risk. Technology leaders like Brad Smith, Microsoft's president and chief legal officer, have criticized such practices, while some lawmakers called for an overhaul of the Vulnerabilities Equities Process (VEP).

"Vulnerability management requires sophisticated engagement to ensure protection of our people, the safeguarding of critical infrastructure, and the defense of important commercial and national security interests," Joyce wrote in a White House blog post. "I believe our newly endorsed VEP Charter helps us balance those interests in a way that is repeatable and defensible."

How does the new VEP Charter improve the government's approach to handling vulnerabilities? What are some of the drawbacks and concerns about the Charter? How much do zero-day vulnerabilities and exploits matter in today's infosec environment? SearchSecurity Editors Rob Wright and Peter Loshin are joined by Senior Reporter Michael Heller to discuss those questions and more in this episode of the Risk & Repeat podcast.