--- title: "Episode 20: Legal Ramifications of Vulnerability Disclosure with Paul Hastings Partner Aaron Charfoos" description: Episode 20 of the podcast covers a discussion on business and legal implications around vulnerability disclosure with Aaron Charfoos, Partner at Paul Hastings image: https://blog.nisos.com/hubfs/20podcast-01.png --- - [Home](https://www.nisos.com/) - Solutions - [Manage Human Risk](https://nisos.com/solutions/human-risk/) - [Protect Online Platforms](https://www.nisos.com/solutions/trust-safety/) - [Manage Cybersecurity Risks](https://www.nisos.com/solutions/cybersecurity/) - [Protect Executives, Assets, and Reputation](https://www.nisos.com/solutions/corporate-security/) - [Secure the Employee Lifecycle](https://nisos.com/solutions/workforce-risk/) - Services - [Human Risk](https://nisos.com/services/human-risk/) - [Employment Shield](https://nisos.com/services/employment-shield/) - [Executive Shield](https://nisos.com/services/executive-shield/) - [Third-Party Intelligence Solutions](https://nisos.com/services/third-party-intelligence-solutions/) - [Insider Threat Intelligence Solutions](https://nisos.com/services/executive-shield/) - [Risk Assessment](https://www.nisos.com/services/risk-assessments/) - [Threat Landscape](https://www.nisos.com/services/threat-landscape-assessment/) - [Threat Monitoring](https://www.nisos.com/services/threat-monitoring/) - [OSINT Monitoring & Analysis](https://www.nisos.com/services/osint-monitoring-and-analysis/) - [Investigations](https://www.nisos.com/services/investigations/) - [Adversary Investigation](https://www.nisos.com/services/adversary-insights/) - Company - [About Us](https://nisos.com/company/about-us/) - [The Nisos Difference](https://nisos.com/company/the-nisos-difference/) - [Client Success](https://nisos.com/company/client-success/) - [Careers](https://www.nisos.com/company/about-the-company/careers/) - Resources - [News](https://www.nisos.com/newsroom/) - [Blog](https://www.nisos.com/nisos-blog/) - [Events](https://www.nisos.com/events/) - [Resource Library](https://www.nisos.com/resources/library/) - [Podcasts](https://www.nisos.com/podcasts/) - [Contact](https://www.nisos.com/contact/) [![Nisos-Logo-Blue](https://blog.nisos.com/hubfs/Nisos-Logo-Blue.png) ![Nisos-Logo-White](https://blog.nisos.com/hubfs/Nisos-Logo-White.png) ![Nisos-Logo-Blue](https://blog.nisos.com/hubfs/Nisos-Logo-Blue.png)](https://www.nisos.com/) - [Default HubSpot Blog](https://blog.nisos.com/blog) - [Home](https://www.nisos.com/) - Solutions - [Manage Human Risk](https://nisos.com/solutions/human-risk/) - [Protect Online Platforms](https://www.nisos.com/solutions/trust-safety/) - [Manage Cybersecurity Risks](https://www.nisos.com/solutions/cybersecurity/) - [Protect Executives, Assets, and Reputation](https://www.nisos.com/solutions/corporate-security/) - [Secure the Employee Lifecycle](https://nisos.com/solutions/workforce-risk/) - Services - [Human Risk](https://nisos.com/services/human-risk/) - [Employment Shield](https://nisos.com/services/employment-shield/) - [Executive Shield](https://nisos.com/services/executive-shield/) - [Third-Party Intelligence Solutions](https://nisos.com/services/third-party-intelligence-solutions/) - [Insider Threat Intelligence Solutions](https://nisos.com/services/executive-shield/) - [Risk Assessment](https://www.nisos.com/services/risk-assessments/) - [Threat Landscape](https://www.nisos.com/services/threat-landscape-assessment/) - [Threat Monitoring](https://www.nisos.com/services/threat-monitoring/) - [OSINT Monitoring & Analysis](https://www.nisos.com/services/osint-monitoring-and-analysis/) - [Investigations](https://www.nisos.com/services/investigations/) - [Adversary Investigation](https://www.nisos.com/services/adversary-insights/) - Company - [About Us](https://nisos.com/company/about-us/) - [The Nisos Difference](https://nisos.com/company/the-nisos-difference/) - [Client Success](https://nisos.com/company/client-success/) - [Careers](https://www.nisos.com/company/about-the-company/careers/) - Resources - [News](https://www.nisos.com/newsroom/) - [Blog](https://www.nisos.com/nisos-blog/) - [Events](https://www.nisos.com/events/) - [Resource Library](https://www.nisos.com/resources/library/) - [Podcasts](https://www.nisos.com/podcasts/) - [Contact](https://www.nisos.com/contact/) ### Solutions Managed Intelligence solutions are designed to address your needs in an evolving risk landscape. Empower your organization with methodologies and actionable results tailored to the innovative ways adversaries are targeting you. ### Mitigate Advanced Threat Actors Inform your security operations with greater context answering the “how” and “why” of the threat actors you face. ### Counter Disinformation Enable informed business responses with the “who” and “why” behind coordinated campaigns. ### Mitigate Insider Threats Improve your program’s ability to get to “who” and “what” with technical program building and investigations. ### Stop Platform Abuse Take action against nefarious use of your platforms with the “who” and “how” of threat actors targeting them. ### Cyber Diligence for Mergers and Acquisitions Facilitate a smooth transition with the “what” and “why” of the security risks to your acquisition. ### Third Party Risk Dilligence Increase the effectiveness of your security evaluations with specifics on the “where” and “what” of your third party risk profile. ### Services Access a world-class intelligence capability tailored to your specific needs. Control a multi-million dollar program without the time or expense and solve problems both lasting and acute. ### Managed Intelligence Ongoing risks, whether from one threat actor or many, require persistent focus. Leverage skills, data, and technology to harden your defenses. ### Security Investigations Gain the context needed to make informed decisions during periods of heightened risk. ### What is Managed Intelligence? ## Podcast ###### 1 min read # [Episode 20: Legal Ramifications of Vulnerability Disclosure with Paul Hastings Partner Aaron Charfoos](https://blog.nisos.com/podcast/cyber5_episode20_legal_ramifications_of_vulnerability_disclosure) Aug 20, 2020 5:41:07 AM - [Tweet](https://twitter.com/share) Episode 20 of the podcast covers a discussion on business and legal implications around vulnerability disclosure with Aaron Charfoos, Partner at Paul Hastings.   **Outline:** - **(01:23)** Question 1: How would you advise clients/companies to react to security researchers with knowledge of a vulnerability when they contact the organization? Should companies treat this as incident response? - **(03:39)** Question 2: What kind of business and legal issues do those disclosures pose? How should companies weigh out the risks? - **(06:17)** Question 3: How should security researchers think about approaching companies with vulnerability disclosures? - **(10:40)** Question 4: With regard to disclosure, what should organizations say and not say and to whom? Can those disclosures be coordinated with the white hats who bring the CVEs over to them? What’s the best way to get ahead of the media’s desire to shine light on these issues as news items? - **(14:09)** Question 5: Are there any helpful case studies to delve into for our listeners - ie - where in your practice have you seen this work out well for clients and not so well?         ---   Topics: [podcast](https://blog.nisos.com/podcast/topic/podcast) [cyber5](https://blog.nisos.com/podcast/topic/cyber5) ##### Written by [Nisos](https://blog.nisos.com/podcast/author/nisos) ###### [Previous Post](https://blog.nisos.com/podcast/cyber5_episode19_tprm_in_view_of_medium_size_business) [![](https://blog.nisos.com/hubfs/Podcast__Logo%20(TM)%20+%20Nisos-Jul-24-2020-08-57-46-75-AM.png)](https://blog.nisos.com/podcast/cyber5_episode19_tprm_in_view_of_medium_size_business) ###### [Episode 19: Third Party Risk Management in the View of Medium Size Businesses with AlixPartners Security Manager Bill Varhol](https://blog.nisos.com/podcast/cyber5_episode19_tprm_in_view_of_medium_size_business) ###### [Next Post](https://blog.nisos.com/podcast/cyber5_episode21_evolution_disinformation_us_uk) [![](https://blog.nisos.com/hubfs/Podcast__Logo%20(TM)%20+%20Nisos-Jul-24-2020-08-43-42-60-AM.png)](https://blog.nisos.com/podcast/cyber5_episode21_evolution_disinformation_us_uk) ###### [Episode 21: The Evolution of Disinformation in the US and UK with Researcher Samantha North](https://blog.nisos.com/podcast/cyber5_episode21_evolution_disinformation_us_uk) ### Post a Comment ### Featured ![](https://blog.nisos.com/hubfs/Nisos-Logo-White.png) Responsive strategies and intelligent defenses for protecting your enterprise. - Services - Managed Intelligence - Security Investigations - Why Nisos - Company - Resources - [Blog](https://blog.nisos.com/blog) - [Case Studies](https://blog.nisos.com/case-studies) - [White Papers](https://blog.nisos.com/technical-blogs) - [Podcast](https://blog.nisos.com/podcast) - [News](https://blog.nisos.com/news) - Contact ###### Contact Us [1-703-382-8400](tel:1-703-382-8400) [info@nisos.com](mailto:info@nisos.com) 603 King Street, Suite 300 Alexandria, VA 22314 [![Learn More](https://no-cache.hubspot.com/cta/default/6068438/043dbe58-e265-499f-8574-2e0d1b4d410e.png)](https://cta-redirect.hubspot.com/cta/redirect/6068438/043dbe58-e265-499f-8574-2e0d1b4d410e) ©2020 Nisos. All rights reserved. - Terms - Cookie Policy - Privacy Policy ![](https://px.ads.linkedin.com/collect/?pid=1593266&fmt=gif)