Are Dutch Municipalities Falling Short in Addressing Security Vulnerabilities?

Many Dutch Municipalities Struggle to Respond to Security Vulnerabilities, Research Shows

Introduction

A recent study conducted by the University of Twente and the Dutch Institute for Vulnerability Disclosure (DIVD) has found that numerous local authorities in the Netherlands are failing to adequately respond to reports about security vulnerabilities. These vulnerabilities are often identified and reported by ethical hackers with the intention of making the internet a safer place. While progress has been made in recent years, the research emphasizes that there is still significant room for improvement in how local authorities handle coordinated vulnerability disclosures (CVD reports).

The Findings

The study focused on 114 Dutch municipalities and examined whether the reported security issues were resolved in a timely manner. Shockingly, it was found that 44 of the contacted municipalities failed to respond within the specified 90-day period regarding the security notification. Additionally, in 49 of the responding municipalities, the security vulnerability remained unresolved, indicating a lack of action taken to mitigate the risks. Furthermore, even in cases where the security vulnerability was fixed, the solution was not communicated back to the original reporter in 10 municipalities.

However, the study did point out that there were municipalities that proactively responded to the notifications. In 19 municipalities, the reports were handled appropriately, and a response was provided to the original notifier. This demonstrates that some local authorities are taking the necessary steps to address security vulnerabilities effectively.

The Research Process

The research was carried out by Koen van Hove, a Ph.D. candidate at the University of Twente and a researcher at the Dutch Institute of Vulnerability Disclosure. Van Hove conducted the study out of curiosity about the functioning of CVD procedures in Dutch municipalities. Over the course of six months, he reported a security vulnerability in commonly used software to the municipalities. He made use of the CVD procedures available on the municipalities’ websites whenever possible.

During the reporting process, Van Hove encountered several challenges. Malfunctioning forms and email addresses, as well as confusing reporting methods, hindered the process. Notably, many reporting forms could only be accessed after logging in via DigiD, which made it impossible for reporters to remain anonymous. In 11 out of the 114 cases, an automated process requested personal information such as date of birth, marriage date, financial status, residence permit information for both the notifier and their partner, as well as information related to their parents and children. Alarmingly, this information was requested without the knowledge or consent of the responsible parties at the municipalities.

Implications and Recommendations

The research findings highlight the pressing need for improvement in how Dutch municipalities handle security vulnerabilities. It is crucial that municipalities dedicate resources to develop and enforce clear and publicly accessible CVD procedures. Furthermore, these procedures should ideally include provisions for anonymous reporting to lower the barrier for reporters, ensuring that potential vulnerabilities are not left unaddressed due to fears of reprisal or exposure.

Additionally, municipalities must focus on enhancing their communication with the original reporters. Timely and informative responses create a collaborative approach and demonstrate the importance placed on resolving security vulnerabilities. This will encourage ethical hackers and members of the public to continue contributing their knowledge and insights in the interest of upholding public safety.

It is important to note that since January 1, 2019, the Dutch government has mandated the adoption of the Baseline Information Security Government (BIO), which requires municipalities to have and publicly disclose a procedure for reporting security issues. Compliance with this requirement is paramount in order to mitigate risks and protect crucial digital infrastructure.

Furthermore, the research findings raise broader philosophical questions about the importance of internet security and data protection within local governments. Municipalities handle sensitive personal information, and any vulnerabilities in their systems can have significant consequences for individuals’ privacy. This emphasizes the need for continuous vulnerability assessments, robust risk management practices, and regular training for municipal employees to ensure they are equipped to safeguard sensitive information.

In conclusion, the University of Twente research underscores the challenges faced by Dutch municipalities in responding adequately to security vulnerabilities. Urgent improvements are needed to enhance the handling of coordinated vulnerability disclosures. Municipalities must prioritize the development and enforcement of clear CVD procedures, improve communication with reporters, and ensure the protection of personal data. Only through such proactive measures can Dutch municipalities effectively contribute to the creation of a safer and more secure internet environment for all.