Why transparency and accountability are important in cyber security

Transparency and accountability lead to increased trust and improved reputations

When I say “we”, I mean “we”. At Bugcrowd we lead by example, and the values of transparency and accountability are baked into everything we do; it’s part of our corporate DNA. Trust and accuracy are vital, so our security practices are an open book, forging trust with our partners and the public. When a vulnerability is uncovered by our researchers, we aim to ensure that said vulnerability is nullified by its developer or publisher to prevent the same vulnerability continuing to exist elsewhere.

Organizations that work with Bugcrowd to implement bug bounty or vulnerability disclosure programs demonstrate the same transparency-and-accountability mindset. Their starting point is to assume that mistakes may have been made. They accept accountability for uncovering any resulting vulnerabilities they may have and take transparent steps to address the possibility. It is much cheaper and simpler than finding themselves accountable for the consequences of vulnerability exploitation.

But transparency and accountability are not, of course, outcomes; they describe how to do things. The outcomes of doing things in a transparent and accountable way - and another reason they are important in cyber security - are increased trust and improved reputations. For example, we see that organisations are increasingly engaging with Bugcrowd to proactively safeguard their brand and intellectual property and are communicating, to their own customers, the measures they are taking. Their objective is to grow public confidence by positioning themselves publicly as fearless defenders of their customers’ safety.

In another example, Bugcrowd was recently involved in an event organised by the Election Security Research Forum (ESRF), as part of that organisation’s aim “to help shape a clear and concerted approach to establishing processes by which security researchers and US election technology providers can work together under principles of Coordinated Vulnerability Disclosure (CVD) to enhance the security of elections technology and increase overall confidence in US elections.”

To me, the value of that event was something more important than “we tested election equipment”. To me, the key value was that, in the context of a highly emotive and important subject, everyone involved promoted transparency: we tested very publicly, jointly, and declared that we were doing so. The result of such an activity must, inevitably, be increased trust in the entirety of the process. (And, had any vulnerability been found, it would have been declared and addressed; accountability and transparency in action.)

The accountability and transparency mindset is certainly gaining traction across cyber security. But it's worth acknowledging that it can be difficult to prove, to the C-suite, the return on an investment intended to prevent occurrence: if something never happens, who’s to know that it would have not happened anyway? Such an argument quickly runs out of steam once the C-suite is reminded to focus on the outcomes rather than the process: most organisations invest heavily across their entire operation to cultivate trust and their reputation, precisely because they are both such highly-prized attributes.

Highly prized at least in peacetime, at least – but both Kerckhoffs and Shannon had rather different agendas in mind when they were coming up with their Principle and Maxim respectively. I like to believe they’d be delighted to see their critical thinking applied to more positive effect, so many years later, in a very different world.

Casey Ellis is founder and chief strategy officer at Bugcrowd