Emerging Trends in Information and Communication Security

Volume 3995 of the series Lecture Notes in Computer Science pp 298-311

A Comparison of Market Approaches to Software Vulnerability Disclosure

  • Rainer BöhmeAffiliated withInstitute for System Architecture, Technische Universität Dresden

* Final gross prices may vary according to local VAT.

Get Access


Practical computer (in)security is largely driven by the existence of and knowledge about vulnerabilities, which can be exploited to breach security mechanisms. Although the discussion on details of responsible vulnerability disclosure is controversial, there is a sort of consensus that better information sharing is socially beneficial. In the recent years we observe the emerging of “vulnerability markets” as means to stimulate exchange of information. However, this term subsumes a broad range of different concepts, which are prone to confusion. This paper provides a first attempt to structure the field by (1) proposing a terminology for distinct concepts and (2) defining criteria to allow for a better comparability between different approaches. An application of this framework on four market types shows notable differences between the approaches.