Two years ago, the Securities and Exchange Commission (SEC), at the urging of individual investors, adopted a “fair disclosure” rule barring insider stock
transactions based on company news that has not yet been made public.
Current market turmoil notwithstanding, the regulation has given non-institutional shareholders a more complete picture of a company’s fiscal health and prospects.
Now, IT security managers want openness too. Specifcally, they want to know what vulnerabilities exist among the millions of lines of code that run their databases,
billing applications and servers — and they want to know now.
A new survey of more than 300 users strongly supports prompt notification of potential problems: 39 percent said immediately, another 29 percent said within a
week. The industry standard in reporting problems, if at all, is about a month.
“It was very surprising to me to see that people are so fed up that they are willing to take the risk (of broadcasting the flaw),” said Pete Lindstrom, a security analyst
with Hurwitz Group, the Framingham, Mass., research firm, that conducted the survey.
One respondent fumed: “(Full disclosure) gives the competition an opportunity to really beat up the offending party. Now that can be an incentive to fix your
software!”
Another acknowledged that software makers cannot be held 100 percent accountable for exploits, “but complete negligence” is evident from some
companies and “should not be accepted.”
Specific vendors were not named in the survey. Microsoft and Oracle
recently disclosed problems and tend to attract the most publicity because of their size and the pervasivness of their products.
Vendors face the pressures of producing very complex applications, as well as needing to get those products to market before the competition, Lindstrom said.
The issue is complex and pits software vendors against consultants and hackers, with enterprises caught in the middle, Lindstrom said. Vendors are constantly
probed by consultants and hackers seeking the slightest flaw, then must respond with patches. And the press pounces on every new glitch.
While IT managers agree that bugs are a serious and costly problem, they are unsure what the proper disclosure mechanism is. Many get information via an e-mail
list, but such updates almost always leak to the press, who many feel overplay them.
More importantly, there is the question whether full disclosure will really make companies tighten their code and testing procedures. Some in the industry think the
courts might have to be involved.
Heretofore, software makers have generally been shielded by product liability law. In boilerplate license agreements, buyers accept that they are buying the product
“as is.”
“I think we will soon see test cases in the courts to try to develop some requirements and standards for vendors,” Lindstrom said. “It will be interesting to see
whether those cases will be successful, and whether standards will ultimately solve the problem for end users.”
But for the software industry, there is really no SEC-like authority to issue guidelines, and no way to know if mandatory reporting would accomplish the goal of
making systems safer and software more polished.
So, until a standards road map for a standard is drawn, full disclosure will remain an intriguing, yet unproved idea. Until then, the current system will prevail, which
one IT manager, speaking for the minority, summed up the debate like this:
“People are going to disclose what they disclose on a schedule that meets there needs. Get over it.”
Editor’s note: The complete Hurwitz Group report is sold through the company’s Web site.
Huawei’s AI Update: Things Are Moving Faster Than We Think
FEATURE | By Rob Enderle,
December 04, 2020
Keeping Machine Learning Algorithms Honest in the ‘Ethics-First’ Era
ARTIFICIAL INTELLIGENCE | By Guest Author,
November 18, 2020
Key Trends in Chatbots and RPA
FEATURE | By Guest Author,
November 10, 2020
FEATURE | By Samuel Greengard,
November 05, 2020
ARTIFICIAL INTELLIGENCE | By Guest Author,
November 02, 2020
How Intel’s Work With Autonomous Cars Could Redefine General Purpose AI
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
October 29, 2020
Dell Technologies World: Weaving Together Human And Machine Interaction For AI And Robotics
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
October 23, 2020
The Super Moderator, or How IBM Project Debater Could Save Social Media
FEATURE | By Rob Enderle,
October 16, 2020
FEATURE | By Cynthia Harvey,
October 07, 2020
ARTIFICIAL INTELLIGENCE | By Guest Author,
October 05, 2020
CIOs Discuss the Promise of AI and Data Science
FEATURE | By Guest Author,
September 25, 2020
Microsoft Is Building An AI Product That Could Predict The Future
FEATURE | By Rob Enderle,
September 25, 2020
Top 10 Machine Learning Companies 2020
FEATURE | By Cynthia Harvey,
September 22, 2020
NVIDIA and ARM: Massively Changing The AI Landscape
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
September 18, 2020
Continuous Intelligence: Expert Discussion [Video and Podcast]
ARTIFICIAL INTELLIGENCE | By James Maguire,
September 14, 2020
Artificial Intelligence: Governance and Ethics [Video]
ARTIFICIAL INTELLIGENCE | By James Maguire,
September 13, 2020
IBM Watson At The US Open: Showcasing The Power Of A Mature Enterprise-Class AI
FEATURE | By Rob Enderle,
September 11, 2020
Artificial Intelligence: Perception vs. Reality
FEATURE | By James Maguire,
September 09, 2020
Anticipating The Coming Wave Of AI Enhanced PCs
FEATURE | By Rob Enderle,
September 05, 2020
The Critical Nature Of IBM’s NLP (Natural Language Processing) Effort
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
August 14, 2020
Datamation is the leading industry resource for B2B data professionals and technology buyers. Datamation's focus is on providing insight into the latest trends and innovation in AI, data security, big data, and more, along with in-depth product recommendations and comparisons. More than 1.7M users gain insight and guidance from Datamation every year.
Advertise with TechnologyAdvice on Datamation and our other data and technology-focused platforms.
Advertise with Us
Property of TechnologyAdvice.
© 2025 TechnologyAdvice. All Rights Reserved
Advertiser Disclosure: Some of the products that appear on this
site are from companies from which TechnologyAdvice receives
compensation. This compensation may impact how and where products
appear on this site including, for example, the order in which
they appear. TechnologyAdvice does not include all companies
or all types of products available in the marketplace.