暨南学报(哲学社会科学版)

作者：黄道丽

单位：西安交通大学法学院,公安部第三研究所副研究员。

关键词：网络安全漏洞,披露,类型,规则,协同

基金：国家社会科学基金重大项目“网络社会治理创新研究”( 15ZDA047);上海市科技创新行动计划“数据安全评估规范方案”(117DZ1101004);公安理论及软科学研究计划“我国关键信息基础设施保护的法律对策研究”(2016LLYJGASS020);公安部第三研究所所选项目“2017年度网络安全政策法律问题”(C17253)。

网络安全漏洞披露已成为网络安全风险控制的中心环节。不规范或非法的网络安全漏洞披露危害网络空间整体安全,凸显法律规定的灰色地带。实践中网络安全漏洞披露表现为不披露、完全披露、负责任披露和协同披露等类型。美国从法律和政策层面分别构建网络安全漏洞披露规则,并根据形势不断进行调整,规则设计呈现从负责任披露到协同披露的变化趋势,国家层面统一的网络安全漏洞披露协调和决策机制也在进一步完善中。我国现行立法从产品和服务提供者、第三方和国家三个层面提出了网络安全漏洞合法披露的基本要求,可借鉴域外经验,以协同披露为导向,围绕披露主体、披露对象、披露方式和披露的责任豁免论证和设计网络安全漏洞披露规则体系,为安全漏洞披露行为提供明确指引。"/>template{display:none;}.mag-rich-xref-fn { cursor: pointer;}//长视频$(document).ready(function(){if($("#showLongArticleVideo") && $("#showLongArticleVideo").length && $("#showLongArticleVideo").length>0){mag_ajax_update({ele_id:'showLongArticleVideo',url:mag_currentQikanUrl() + "/CN/article/showLongArticleVideo.do?id="+$("#articleId").val()});}});$(document).ready(function(){window.metaData = {"journal":{"issn":"1000-5072","qiKanMingCheng_CN":"暨南学报（哲学社会科学版）","id":2,"qiKanMingCheng_EN":"Jinan Journal"},"fundList_cn":["国家社会科学基金重大项目“网络社会治理创新研究”( 15ZDA047);上海市科技创新行动计划“数据安全评估规范方案”(117DZ1101004);公安理论及软科学研究计划“我国关键信息基础设施保护的法律对策研究”(2016LLYJGASS020);公安部第三研究所所选项目“2017年度网络安全政策法律问题”(C17253)。"],"article":{"keywordList_cn":["规则","类型","披露","网络安全漏洞","协同"],"juan":"40","zhaiyao_cn":"网络安全漏洞披露已成为网络安全风险控制的中心环节。不规范或非法的网络安全漏洞披露危害网络空间整体安全,凸显法律规定的灰色地带。实践中网络安全漏洞披露表现为不披露、完全披露、负责任披露和协同披露等类型。美国从法律和政策层面分别构建网络安全漏洞披露规则,并根据形势不断进行调整,规则设计呈现从负责任披露到协同披露的变化趋势,国家层面统一的网络安全漏洞披露协调和决策机制也在进一步完善中。我国现行立法从产品和服务提供者、第三方和国家三个层面提出了网络安全漏洞合法披露的基本要求,可借鉴域外经验,以协同披露为导向,围绕披露主体、披露对象、披露方式和披露的责任豁免论证和设计网络安全漏洞披露规则体系,为安全漏洞披露行为提供明确指引。","endNoteUrl_en":"https://jnxb.jnu.edu.cn/skb/EN/article/getTxtFile.do?fileType=EndNote&id=5976","bibtexUrl_cn":"https://jnxb.jnu.edu.cn/skb/CN/article/getTxtFile.do?fileType=BibTeX&id=5976","abstractUrl_en":"https://jnxb.jnu.edu.cn/skb/EN/Y2018/V40/I1/94","qi":"1","id":5976,"nian":2018,"bianHao":"2018-1-94","zuoZheEn_L":"HUANG Daoli","juanUrl_en":"https://jnxb.jnu.edu.cn/skb/EN/Y2018","shouCiFaBuRiQi":"2018-02-07","qiShiYe":"94","qiUrl_cn":"https://jnxb.jnu.edu.cn/skb/CN/Y2018/V40/I1","lanMu_cn":"网络法","pdfSize":"710","zuoZhe_CN":"黄道丽","risUrl_cn":"https://jnxb.jnu.edu.cn/skb/CN/article/getTxtFile.do?fileType=Ris&id=5976","title_cn":"网络安全漏洞披露规则及其体系设计*","jieShuYe":"106","keywordList_en":["coordination","cybersecurity vulnerabilities","disclosure","rules","types"],"endNoteUrl_cn":"https://jnxb.jnu.edu.cn/skb/CN/article/getTxtFile.do?fileType=EndNote&id=5976","zhaiyao_en":"The disclosure of cybersecurity vulnerabilities has become the central part of cybersecurity risk control. Non-standard or illegal disclosure endangers the overall security of cyberspace, highlighting the gray area of the law. There are four types of cybersecurity vulnerabilities disclosure in practice, including: non-disclosure, full disclosure, responsible disclosure and coordinated disclosure. America constructs its cybersecurity vulnerabilities rules from legal and policy aspects, and constantly adjusts them with the development of new situations. The design of rules presents a changing trend from responsible disclosure to coordinated disclosure, and the unified rules of coordination and decision-making of cybersecurity vulnerabilities disclosure are further improved on the national level. In China, current legislation puts forward the basic requirements of the legitimate disclosure of cybersecurity vulnerabilities from three aspects: the provider of product and service, the third parties and the government. Referring to the experience of other countries,we can design the system of cybersecurity vulnerabilities disclosure based on coordinated disclosure, focusing on the subjects, objects, measure and liability exemptions of disclosure so that clear guidance for cybersecurity vulnerabilities disclosure can be provided.","bibtexUrl_en":"https://jnxb.jnu.edu.cn/skb/EN/article/getTxtFile.do?fileType=BibTeX&id=5976","abstractUrl_cn":"https://jnxb.jnu.edu.cn/skb/CN/Y2018/V40/I1/94","zuoZheCn_L":"黄道丽","juanUrl_cn":"https://jnxb.jnu.edu.cn/skb/CN/Y2018","lanMu_en":"","qiUrl_en":"https://jnxb.jnu.edu.cn/skb/EN/Y2018/V40/I1","zuoZhe_EN":"HUANG Daoli","risUrl_en":"https://jnxb.jnu.edu.cn/skb/EN/article/getTxtFile.do?fileType=Ris&id=5976","title_en":"The Cybersecurity Vulnerabilities Disclosure Rules and System Design","hasPdf":"true"},"authorNotes_cn":["黄道丽,西安交通大学法学院,公安部第三研究所副研究员。"]};if(window.metaData && (!window.metaData.authorNotesCommon_cn && !window.metaData.authorNotesCorresp_cn && window.metaData.authorNotes_cn)){window.metaData.authorNotesCommon_cn = window.metaData.authorNotes_cn;}if(window.metaData && (!window.metaData.authorNotesCommon_en && !window.metaData.authorNotesCorresp_en && window.metaData.authorNotes_en)){window.metaData.authorNotesCommon_en = window.metaData.authorNotes_en;}var _nlmdtdXml = $("#article_nlmdtdXml").val();var magDir = _nlmdtdXml.replace(/\/[^\/]+$/,'');window.metaData.magDir = magDir;new mag_vue({ el: '#metaVue', //dataUrl: mag_currentQikanUrl() + '/EN/article/getRichHtmlJson.do?articleId='+$("#articleId").val(), data:window.metaData, loading:true, doTextFun:function(text){ return doDataJsonText(text); }, doAfterFun:function(selector,jsonData){doMagVueAfter(selector,jsonData);}});var pars = {attachType:'PDF',id:$("#articleId").val(),json:true};jQuery.post($("#mag-common-contextPath").val()+"/CN/article/showArticleFile.do?" + new Date().getTime(), pars, function(data){var json=null;if(data.match(/^\[json\].*/g)){json=eval("("+data.replace(/^\[json\]/g,"")+")");}if(json && json.status == 1){//有权限}else{//无权限$("#no-access-div").show();}});mag_ajax({url:mag_currentQikanUrl() + '/CN/article/getRichHtmlJson.do',data:{articleId:$("#articleId").val(),token:'7a1013c583ce495bbd5e96cc5586cb14',referer:document.referrer},dataType:"json",async:"false",success:function(json){if(json.richHtmlJson && json.richHtmlJson.article){if(json.trans){var _nlmdtdXmlCN = $("#article_nlmdtdXmlCN").val();var magDirCN = _nlmdtdXmlCN.replace(/\/[^\/]+$/,'');json.richHtmlJson.magDir=magDirCN;}else{json.richHtmlJson.magDir=magDir;}new mag_vue({ el: '#bodyVue', data:json.richHtmlJson, doTextFun:function(text){ return doDataJsonText(text); }, doAfterFun:function(selector,jsonData){doMagVueAfter(selector,jsonData);}});}}});//altmetricif($.trim($("#article_doi").val())!=''){$.ajax({url:'https://api.altmetric.com/v1/doi/'+$.trim($("#article_doi").val())+'?callback=altmetric_callback',//url:'https://api.altmetric.com/v1/doi/10.1007/s13238-016-0264-7?callback=altmetric_callback',dataType:'jsonp'});}mag_rich_menu(jQuery);$(function(){ $('#autoMenu').autoMenu();})$("#autoMenu").niceScroll({cursorcolor: "#ccc", //滚动条的颜色cursoropacitymax: 0, //滚动条的透明度，从0-1 touchbehavior: false, //使光标拖动滚动像在台式电脑触摸设备 true滚动条拖动不可用 cursorwidth: "6px", //滚动条的宽度 单位默认px cursorborder: "0", // 游标边框css定义 cursorborderradius: "3px", //滚动条两头的圆角 autohidemode: true, //是否隐藏滚动条 true的时候默认不显示滚动条，当鼠标经过的时候显示滚动条 zindex: "auto", //给滚动条设置z-index值 railvalign:'defaul',railpadding: {top: 0,right: -6,left: 0,bottom: 0}, //滚动条的位置});window.autoMenuFlag=true;$("#relatedArticles").niceScroll({cursorcolor: "#ccc", //滚动条的颜色cursoropacitymax: 0, //滚动条的透明度，从0-1 touchbehavior: false, //使光标拖动滚动像在台式电脑触摸设备 true滚动条拖动不可用 cursorwidth: "6px", //滚动条的宽度 单位默认px cursorborder: "0", // 游标边框css定义 cursorborderradius: "3px", //滚动条两头的圆角 autohidemode: true, //是否隐藏滚动条 true的时候默认不显示滚动条，当鼠标经过的时候显示滚动条 zindex: "auto", //给滚动条设置z-index值 railvalign:'defaul',railpadding: {top: 0,right: -6,left: 0,bottom: 0}, //滚动条的位置});//公式序号 居右jQuery(".mag-xml-disp-formula").each(function() {var _this = jQuery(this);var _label= _this.children("label");if(typeof(_label.html())!="undefined"){_this.children("label").remove();_this.wrap("");_this.parent().parent().append(""+_label.html()+"");}});$('body').click(function(){$('.daochu_div').hide();$('.qipao').hide();})$('.qipao').click(function(event){event.stopPropagation();})/*参考文献显示隐藏*/$('.biaotijiantoush1').click(function(event){if($(this).attr('class')=='glyphicon glyphicon-triangle-top biaotijiantoush biaotijiantoush1'){$(this).parents('.mag_main_zhengwen_left_div_ckwx_table_benwenyiny').next('.mag_main_zhengwen_left_div_ckwx_table_ckwx_xiangqing').stop().slideUp();$(this).attr('class','glyphicon glyphicon-triangle-bottom biaotijiantoush biaotijiantoush1');}else if($(this).attr('class')=='glyphicon glyphicon-triangle-bottom biaotijiantoush biaotijiantoush1'){$(this).parents('.mag_main_zhengwen_left_div_ckwx_table_benwenyiny').next('.mag_main_zhengwen_left_div_ckwx_table_ckwx_xiangqing').stop().slideDown();$(this).attr('class','glyphicon glyphicon-triangle-top biaotijiantoush biaotijiantoush1');}event.stopPropagation();});//加载补充材料mag_ajax_update({ele_id:'showArticle_suppls',url:mag_currentQikanUrl() + '/CN/article/showArticleSuppls.do',data:{articleId:$("#articleId").val()}});//加载专题mag_ajax_update({ele_id:'showArticle_subjects',url:mag_currentQikanUrl() + '/CN/subject/showSubjectListByArticle.do',data:{articleId:$("#articleId").val(),forwardJsp:'showArticle'}});//渲染公式mag_mathJax();});function altmetric_callback(json){if(json && json.score){if(json.score - parseInt(json.score) > 0){$("#altmetric-score").html(parseInt(json.score)+1);}else{$("#altmetric-score").html(parseInt(json.score));}$(".main_content_center_right_duoweidu_div").css("width","25%");$("#altmetric-a").show();$("#altmetric-a").attr("href",json.details_url);}}function richClickAuthor(name){var searchSQL = "((("+mag_advSearchValReplace(name)+"[Author]) AND 2J[Journal]) AND year[Order])";mag_request({url:mag_currentQikanUrl() + '/CN/searchresult',data:{searchSQL:searchSQL}});}function richClickKeyword(keyword){var searchSQL = "((("+mag_advSearchValReplace(keyword)+"[Keyword]) AND 2J[Journal]) AND year[Order])";mag_request({url:mag_currentQikanUrl() + '/CN/searchresult',data:{searchSQL:searchSQL}});}function mag_share(){$("#bShare_more_a").click();}function loadRelatedArticles(){if($("#showRelatedArticles") && $("#showRelatedArticles").length>0){//加载过了}else{mag_loading();mag_ajax_update({ele_id:'relatedArticles-content',url:mag_currentQikanUrl() + '/CN/article/relatedArticle.do',data:{id:$("#articleId").val(), forwardJsp:'showArticle'},complete:function(){mag_layer_close();}});}}function showMetrics(){mag_window_location(mag_currentQikanUrl() + '/CN/metrics/'+$("#articleId").val());}function piaofuFn(a,fnId){var content=''+$("#mag-rich-fn-"+fnId).html()+'';piaofu(a,content);}function huoqukuanduimg(){//}function doDataJsonText(text){var str = text;//var _nlmdtdXml = $("#article_nlmdtdXml").val();//var magDir = _nlmdtdXml.replace(/\/[^\/]+$/,'');str = str.replace(/";ss += "";var shuomingTitle = "";var shuomingContent = '';if(fig.titleCn && fig.titleCn!=''){shuomingTitle = fig.titleCn;if(fig.titleContentCn && fig.titleContentCn!=''){shuomingContent += fig.titleContentCn;}}if(shuomingTitle==''){if(fig.titleEn && fig.titleEn!=''){shuomingTitle = fig.titleEn;}if(fig.titleContentEn && fig.titleContentEn!=''){shuomingContent += fig.titleContentEn;}}else{if(fig.titleEn && fig.titleEn!=''){shuomingContent += ""+fig.titleEn+"

来源：2018年第1期

《暨南学报(哲学社会科学版)》期刊编辑部

查看暨南学报(哲学社会科学版)杂志2018年第1期