Ethical issues around the wake of discovered security vulnerabilities are vast and murky. And sometimes, it all appears familiar and almost too easy. Like poker games, many ecosystems have a tail that only a skilled player can identify.

Part of the problem likely stems from the fact that many organizations have not created a disclosure system. Without a written and easy followed process stipulated in company culture, a practice of blame-shifting and finger-pointing.

The chief information security officer (CISO) dealing with the nagging issue of a potential security breach and the ethical mandate to disclose and create dialogue turns instead to do another task on the to-do list and sometimes, after long enough, it just gets pushed under the rug and forgotten. Sometimes the burying of the head in the sand, even if it burned out of desperation and practice of being overworked and understaffed, turns into something deliberate. 

Many organizations declare outright that they do not want to receive disclosures because they have no desire and/or capacity to deal with the liabilities created by them. Ignoring a security problem does not make it go away. If anything, without attention and adherence, it festers and grows until it has the potential to annoy and cause frustration. It can become the straw that breaks the company back.

Moving forward and shifting the culture on disclosures, the first challenge is to find the sweet spot between being approachable versus actually inviting hacking attempts. The door needs to be open to those who wish to raise alarms but firmly closed to those who want to breach its door frame and crash right into the building.

The chief information security officer (CISO) is between two terrible options: if they do not catch an issue or are bad at their jobs. But, if they get it and then fail to act on it. They blame for security failure, and it will affect their reputation. Proper regulations for ethical disclosures need the right balance of this entirely lopsided situation. 

CISOs must do what is right in terms of disclosures and motivate them in that direction. The burden of identifying and inventing what is right needs to be in place. We need to set the rules for them. Without regulations, we are all just holding our breath and waiting for the next attack.