Italy protects itself from "zero day" IT vulnerabilities by focusing on ethical hackers

Reporting, analysis and management of "zero day" IT vulnerabilities, i.e. those not yet publicly known. They are the pillars of the new National Policy for Coordinated Vulnerability Disclosure (CVD) adopted by the National Cybersecurity Agency (ACN) in agreement with the Ministry of Justice. The CVD policy was foreseen by a legislative decree dating back to 2024 which transposed the European cybersecurity directive NIS 2.

The objective of the CVD policy is to introduce a structured process that favors the timely identification and resolution of possible vulnerabilities, beating criminal or malicious actors who may wish to disclose and exploit the relevant information.

The general director of the ACN Andrea Quacivi explains that, within the framework of the new provisions, the CSIRT Italia, i.e. the Computer Security Incident Response Team, an operational branch of the Cybersecurity Agency, once the communication has been received «will immediately take charge of carrying out the technical analyzes to identify, in collaboration with the manufacturer or supplier of the service or product affected by the vulnerability, the solution - usually a "patch" - to be introduced as soon as possible to resolve that specific threat».

To be effective, the CVD policy therefore requires the collaboration of those who, through research and analysis activities, identify potential vulnerabilities in ICT services and products. It therefore becomes fundamental to valorise the contribution of the digital community and, in particular, of security researchers and ethical hackers, i.e. IT security experts who test the digital systems of companies or public bodies to identify their weak points before they are exploited by malicious actors.

In fact, “zero day” vulnerabilities can represent a major critical issue. Since they are not known until they are identified and managed, solutions to stem the damage are often not available until it is too late. If the first to discover them are malicious actors, the risk is that they will be exploited to carry out cyber attacks which can have serious repercussions on the security of those who use the affected products or services.