Resolved: The NSA should disclose zero day vunerabilities to relevant vendors

Great to hear back from Pro, I am glad to know you are feeling better and I appreciates your responses. Of course, I will continue wit this final post. "My opponent claims that Zero days pose little threat to regular people." What Claims? I PROVIDED reference and citation in my argument that my opponent seem to missed. Original references #3 http://arstechnica.com... Paragraph 7: In short, then, the actual usage of zero-days is quite limited. "It's not that zero-days aren't being used," explained Adriel Desautels, an experienced security researcher and CEO of Netragard. "It's that they hold no real threat for the average business or citizen." Not only did I just used it as reference I even took the trouble to verify the credibility of the quote => reference #2. http://www.netragard.com... " My opponent also claims that we use firewalls to prevent this sort of exploit, but that's exactly what zero days are for. They are used to surpass those firewalls and find holes within them. " What I mention is firewall being an example of security layer to 'delay exploit to the point of the attacker retreat' and NOT say that it is impossible to break through. This is the point of IT security, to prevent hacking by delaying the attempt to surpass it, and make it as impenetrable as possible. Unless my opponent can explain how firewall does NOT delay intrusion than this is not a claim. What pro says is true zero day can surpass firewall, but my opponent does not understand how basics hacking exploits works for a complex hack, Black-hats needs to figure out where the zero-day software Is on the computer, plan it, and execute. Just like beating the henchmen and minions before meeting the boss. This requires multiple hacking phases that takes time to prob and see what best path to take in order to exploit [1]. These is something, commonly takes massive of time and effort to bypass. Many time if there a little to gain, even meaningless and a waste of time. This the reason zero-day threats on regular people and regular businesses. This is very reason why zero-day exploits cost so much, because security researchers invest much time, efforts, requiring cultivated skills, and knowledge to nitpick through the system and figure out the exploits many times in groups. This can involve skill, constraints, and requirements to go through and discover such exploits and to execute[2]. Point it is not easy for Blackhats to discover their own zero day, to purchase it, to collect recon for exploit, and to EXTRACT the right data to perform a valuable zero-day attack. ""black hate hackers are perfectly able to find the exploits first. No amount of skill and competence an IT team can have will prevent that." In order to find these exploits blackhat would to phases as I mention previous in order bypass and launch their exploits on [1]. Going through large business that has quite with complex security infrastructure would be much more challenging than exploiting regular people. There are many tools can detect exploit attempts and thus 'Proper security' and pattern recognition using honeypots, Intrusion Detection System, and Intrusion Prevention System are very common security tools [3]. Such tools are specifically design to detect of data gathering, intrusion, and prerequisite before launching exploits. This is what is are the tools that are keeping malicious hackers from needed info and recon as a prerequisite for a working hack They are able but to what troubles and whether they can avoid the radar. "The problem with this argument is that Con seems to misunderstand how the market works." Now compared to my opponent's references and citation to this debate. My references / citations included very elaborated explanation about markets, obviously in my arguments brought 'Markets' to light and did say how those information cost, especially cost in the blackmarket. The big cost of zero day is not something anyone can afford, including blackhats, when they do afford, it's a decision of great risk. Likewise, I need to apologize for not making Blackhat and or even Grey Hat explicit enough. I use blackhat as 'malicious hackers' and white hats as 'security professionals' but I did make the imply of the blackmarket, perhaps my opponent missed that implication. => "This essentially is a way prevents burden of NSA to purchase those vulnerabilities using our taxes and prevents any FURTHER VIOLATIONS of ETHICS as a governmental agency." Meaning I have a fairly good understanding of how the market works. Let me elaborate, this is the reason I am focusing on white hats and my point to this is vendors as a solution are already active on the zero-day market at there own expense without the needs for the NSA to use our tax money and avoid any chances of purchasing zero-day from questionable markets. Now, my implication is logically that IF the NSA bought the zero-day from Blackhats (AKA criminal) it would be a 'violations of ethics' and makes the NSA criminal themselves. IF the NSA bought zero-day data from 'Grey Hats' if doesn't mean that Grey Hats wouldn't be selling it to 'malicious hackers' to; as probable conclusion to 'Grey Hat' as blackhat violation. This reinforces on why NSA should not buy zero-day vulnerability data and not spend more of our taxes to communicate, convince, and considering additional cost and the time to share report of "X" amount 0days to 'X' amount of vendors. ""...but black hat hackers are selling them to the highest bigger regardless of what they will use it for."" This is exactly of my point (excluding the highest bigger) of zero-day cost and why vendors are buying it from white hats because it cost less and we should give our support and culture the growth security experts and not having the NSA as a competitor. Also for us not to allow any chances for the NSA or Government to unethically purchase it from them Blackhats and Grey Hats for ridiculous price. Thank you for bringing up my point. I won't deny that they aren't used most of the time, but that doesn't mean we shouldn't eliminate the risk of them being used. Sweet on that part. But in order to eliminate it, we would need to be obtain it and with a question of time, depending on the threats 0day can cost from $5000 to half a million for a single 0day [7]. Someone has to buy it from the market or Blackmarket. Meaning that for critical 0day, the NSA would have to determine its value, it's potential threat, go through costly bureaucratic process, find a seller, buy it, prey it hasn't been patched or used, and share it with vendors. That is reality. "Not quite, regardless of how competent the staff is, their software is still vulnerable if their is a zero day exploit involved." Its true zero day exploit are still vulnerable hence the name itself, but reinforcing my original argument and references used. Zero day vulnerabilities has little probability threats. Why? it would be profitable and easier for malicious hackers to use the easiest and quickest method than the hard road with zero-day. I have included 3 references of common hacking techniques that commonly and successfully use for cybercrimes. Including social engineering (human stupidity), wireless hacks, sql injection, etc... [4][5][6]. None of those include the low probability threat zero-day. This can deduce that zero-day is even harder than common hacking which already hard. Thus cybercrime has higher probability using commons hack without paying $$$$ and without learning how those 0days works. Looks like this it for the debate and definitely has been a challenging and enjoyable one. All thanks to you Pro for starting it, presenting your argument, and a final rebuttals. It was short but awesome. Good luck to you, your debating journey, and kind regards. [1] http://certifiedethicalhackerceh.blogspot.com... [2] https://www.blackhat.com... [3] http://csrc.nist.gov... [4] http://www.computerworld.com... [5] http://www.infoworld.com... [6] http://www.securityweek.com... [7] http://www.wired.com...