Cyber Security Ethics

These questions are multiple choice questions. More than one answer may be correct.

What are the implications of NOT releasing (zero-day) vulnerability information?

• Potential death of targets (state actors)

  

  
• It gives incentive for others to search for vulnerabilities on their own

  

  
• Vulnerabilities that are not published are no problem

  

  

What are the implications of releasing (zero-day) vulnerability information?

• Administrators can patch their vulnerable systems

  

  
• Information can be used by bad actors until the vulnerability is patched

  

  
• Higher incentive for companies to release a patch

  

  
• The open-source community can work together and develop a patch