Thanking the vulnerability research community with NCSC Challenge Coins
Reflecting on the positive impact of the Vulnerability Reporting Service – and introducing something new for selected contributors.
In 2018 the NCSC launched the Vulnerability Reporting Service (VRS), for security researchers to disclose vulnerabilities they had found in UK government services. We set it up because we wanted to offer a way to disclose responsibly. At its heart is the core principle of responsible vulnerability disclosure: that disclosure itself is not an incident, but has the potential to become one if a vulnerability is disclosed in an irresponsible way, like posting it on social media.
Positive impact
The VRS has been a real success because it has allowed us to make use of talented researchers worldwide through the HackerOne platform, with help from NCC Group.
In 2022, there were four times the number of reports than when the service first started. It’s been heartening to see that where there is a route to report vulnerabilities and even with minimal incentive, the researcher community is in most cases committed to disclosing vulnerabilities responsibly and seeing them remediated.
The service has also helped in other ways – indirectly, by helping us shape the Vulnerability Disclosure Toolkit, where we’ve taken what we’ve learned from the VRS and made it available to everyone. And more directly, we’ve seen the VRS evolve and work alongside a wider ‘Disclosure for Government’ scheme that empowers government departments to manage their own vulnerability disclosure process, while making use of the shared platform and triage service the VRS offers.
Introducing the challenge coins
We have awarded HackerOne reputation points to show our appreciation to researchers who submit valid vulnerability reports and as we come to the five-year mark, we’ll now also be awarding NCSC Challenge Coins to selected researchers. Regrettably we can’t give coins to everyone who contributes a report, so we're awarding them to those who have shown themselves to be exemplars of the vulnerability disclosure community. If you’ve been selected, you’ll be contacted through the HackerOne platform.
We’d like to take this opportunity to thank everyone who has reported a vulnerability and helped to make government systems more secure and resilient.
Tell me about the coins!
There are four versions of the challenge coins. Each depicts a person or element important in the history of British computing (top down, left to right).
What next for vulnerability management from the NCSC?
As the UK national technical authority for cyber security, our work to help manage vulnerabilities continues, as we consider how to take what we’ve learnt in the government space into other areas to help make the UK the safest place to live and work online.
And look out soon for our updated vulnerability management guidance, which includes advice about how to establish a vulnerability disclosure process.
Ollie N
Head of Vulnerability Management Team, NCSC
Share and print this article
Written by
