Responsible management of IT security vulnerabilities: Problem scenarios and optimization strategies for an efficient collaboration between IT security research and IT management

IT security vulnerabilities in hard- and software affect private, corporate and also governmental systems. As soon as it is technologically possible to exploit the vulnerabilities, they pose a threat to the IT security of all parties involved. Specifically impacted are citizens and companies as users, manufacturers of software and hardware, and government (critical) IT infrastructure. It is therefore in the interest of the whole society to keep the number of exploitable security vulnerabilities as limited as possible. This white paper introduces legal and practical problems of IT security research. Above all, it points out legal solutions that will lead to a legally secure IT security research in the future.