To Coerce or Not to Coerce? A Quantitative Investigation on Cybersecurity and Cybercrime Legislations Towards Large-Scale Vulnerability Notifications

Abstract

The rise of large-scale vulnerability scanners, which make the detection of vulnerabilities easy, has recently raised the attention to the security community. This leads to multiple research on the effectiveness of large-scale vulnerability notifications as a countermeasure and several studies have examined the different factors that could impact the effectiveness and how they could incite people to apply vulnerability fixing steps. And we contend that using a legal constraint could improve the vulnerability fixing rate. In this paper, we survey the Cybersecurity and Cybercrime Legislations of 156 countries looking for Articles that consider the liability of vulnerable resource owners. We discovered that only two countries required companies, regardless of the industry, to implement cybersecurity measures and conduct vulnerability assessments. This study aims to define a more effective large-scale vulnerability notifications system using Cybersecurity and Cybercrime Laws.