Michael Borohovski of Tinfoil Security, which makes software that hunts for security flaws, says firms often make big changes to their systems between pentests, which can accidentally create new vulnerabilities.
While many software makers offer some system to rank the severity of security flaws, network administrators are still left to create their best estimate of how long they have before online miscreants start using a vulnerability to attack systems.
"Now that the vulnerability has been made public, we should expect this being exploited in the wild in the next few days". It's common for researchers to withhold public disclosure of a security flaw until companies can create patches to protect users.
This law can make it a crime to "tinker" or repair your own devices, remix a video, and conduct independent security research to reveal security flaws, fueling the EFF's argument that this legislation is creating a chilling effect and is preventing the right to freedom of expression.
Forbes.com: Why create a tax on software based on its security flaws?
Earlier this year, President Barack Obama created an exception that allows the NSA to take advantage of security flaws to collect intelligence, but only when there is "a clear national security or law enforcement need," The New York Times reported.
It also created a new team, called Google Project Zero, to hunt for critical security flaws in technology outside Google.
Google said Tuesday it had created an elite team of researchers to find and report major Internet security flaws, potentially thwarting both Chinese hackers and U.S. intelligence agencies.
The ranking is used to designate security flaws that could allow online vandals to take control of a user's computer or create an Internet worm that could spread from system to system.
Most recently, #OpCyberPrivacy was created to launch DDOS attacks on government systems to raise awareness about C-51 and to publicly disclose significant security flaws in the Canadian government's web services.
