Cybersecurity experts are calling out the new EU rules surrounding vulnerability disclosure requirements detailed in the new Cyber Resilience Act (CRA).

The new law includes a series of obligations cybersecurity firms and organisations will have to take to keep their software secure and to regulation.

The most controversial of these new stipulations is found in Article 11 and concerns vulnerability disclosures – organisations will have 24 hours to report to an EU agency upon learning of any software vulnerabilities after their initial exploitation.

While the law was put in place so keep software manufacturers complaint with security protocols, cyber experts have said the law is counterproductive and could cause more harm than help.

An open letter signed by the likes of Vint Cerf, VP and chief internet evangelist at  Google, Toomas Hendrik Ilves, the former president of Estonia, cyber experts urged the EU to reconsider the law and its potential effects on cybersecurity outcomes.

“While we appreciate the CRA’s aim to enhance cybersecurity in Europe and beyond,” the letter read, “We believe that the current provisions on vulnerability disclosure are counterproductive and will create new threats that undermine the security of digital products and the individuals who use them.”

Essentially, cyber experts are worried that speeding up the disclosure process will mean the government has access to a database of active vulnerabilities that may have not been patched, making it a prime target for threat actors.

The open letter outlined several key concerns about Article 11:

1. Misuse of Intelligence and Surveillance

If organisations are required to update the government on unmitigated software vulnerabilities, cyber experts are concerned this could be misused for surveillance or intelligence purposes, especially with the current absence of restrictions.

2. Risk of Exposure to Malicious Actors

The cyber experts claim that breaches of government held vulnerabilities have happened before, and government entities can be breached. While the new law does not require a full technical assessment as part of the disclosure, mere knowledge of a vulnerability can be taken advantage of a threat actor.

3. Effect on Researchers

Changing the vulnerability disclosure process can rupture the coordination between software manufacturers and security researchers who need time to verify, test, and patch vulnerabilities prior to publishing them. The CRA may discourage this collaboration, stopping each from reporting and investigating vulnerabilities together if they trigger government notifications.

The cyber experts did make clear that they are not critiquing the entire CRA, and agreed with the stipulation that they should mitigate vulnerabilities urgently.

Recommended reading

• Is It Okay to Break Cybersecurity laws? Depends, UK Citizens Say
• EU Cyber Security Defences Strengthened After Landmark Agreement
• EU Joint Cyber Unit Proposed to Boost Cybersecurity

They called for the absolute abolition of Article 11, paragraph 1 which detailed the disclosure policy, or for EU policy makers to revise it along the following lines:

• with a provision that agencies are prohibited from sharing vulnerabilities through the CRA for intelligence, surveillance or offensive purposes
• Require disclosure to occur within 72 hours of an effective patch
• not require the vulnerabilities exploited through “good faith security research” to be reported with the same rules

However, reporting and disclosure of vulnerabilities is vital to keeping organisations secure.

“Timely and accurate reporting of vulnerabilities is crucial for organisations, not only to protect their own organisation, but others along the supply chain, as well as alerting software providers to potential issues,” Achi Lewis, area VP EMEA for Absolute Software, said.

“The current patching landscape is messy, and our Resilience Index research found that there are 14 different versions of Windows 10, for example, being used by enterprise businesses, with over 800 different patches. This is made worse by one in six devices working on an old patch, increasing the cybersecurity risks to the device, and subsequently the organisation.”

“IT managers already have a difficult job managing a work-from-anywhere device fleet so ensuring patching is up to date is an important step to bolstering security, and new vulnerability reporting rules as part of the Cyber Resilience Act will support organisations to stop vulnerabilities spreading. These actions will better prepare organisations to prevent cyber incidents, as well as improve response protocols when attacks occur.”