Bug Bounty Programs Paying Off for Enterprises

Organizations have come to realize that their security is improved when technically competent people examine their products for vulnerabilities.

It took a long time for this realization to happen.

Companies were afraid outsiders would just exploit whatever they found. They eventually realized they were assuring this behavior would happen by not taking advantage of what people found.

First, the larger tech companies started to reward bugs that were found -- and most importantly -- revealed to them before the public. Now, more and more enterprises are adopting that process, according to the 2018 Hacker-Powered Security Report.

The report from HackerOne is a benchmark study of the bug bounty, as well as the vulnerability disclosure ecosystem based on what researchers call the largest data set of reported vulnerabilities available.

(Source: Pixabay)

The report was based on more than 1,700 responses to the 2017 HackerOne Community Survey, including those who successfully reported one valid vulnerability.

The report found that the total number of high or critical severity vulnerabilities had increased by 22% in 2017. Furthermore, 24% of the resolved vulnerabilities were classified as "high to critical" severity across industries.

This has caused the bounties for high-impact findings to rise.

A total of 116 unique critical vulnerabilities earned over $10,000 each in the past year. The top bounty awarded for a single report reached $75,000 in 2017, and that was paid by a technology company for three unique vulnerabilities that when chained together, produced a remote code execution (RCE) that required no user interaction to exploit.

Similar programs run by Google, Microsoft and Intel are offering $250,000 bounty awards for critical issues. (See Intel Boosts Bug Bounties in Wake of Spectre & Meltdown.)

Governments all over the world are also adopting this approach. The report notes that in government sector there was a 125% increase year-over-year with new program launches including the European Commission and the Ministry of Defense Singapore.

Further, the consumer goods, financial services and insurance, government and telecommunications industries now account for about 43% of bug bounty programs. Automotive programs increased 50% in the past year.

Enterprises across industries saw a 54% increase in year over year adoption.

However, HackerOne found that 93% of the 2017 Forbes Global 2000 list does not have a policy to receive, respond and resolve critical bug reports submitted by third parties. But, Goldman Sachs, Toyota and American Express were a few of the enterprises to launch a vulnerability disclosure policy (VDP) in 2018, so there is growth in VDP adoption.

Boost your understanding of new cybersecurity approaches at Light Reading's Automating Seamless Security event on October 17 in Chicago! Service providers and enterprise receive FREE passes. All others can save 20% off passes using the code LR20 today!

The VDP growth is global. Latin America had the largest uptake of VDPs and bug bounty programs, with an increase of 143% year-over-year. North America and the Asia Pacific region each increased 37%, and Europe, the Middle East and Africa saw a combined 26% increase in the past year.

Cross-site scripting (XSS) continues to be the most common vulnerability reported across all industries, with the exception of healthcare and technology. In those sectors, information disclosure, which means that information is disclosed to an actor not explicitly authorized to have access to that information, was the lead.

The report found that XSS vulnerabilities represented 59% of the t15 vulnerabilities reported to transportation organizations, and 37% of the Top 15 vulnerabilities reported to travel and hospitality organizations.

Companies have learned that giving rewards for security information gets them both better information and a controlled path for disclosure that is not disruptive.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.