Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Security Management

08:05 AM
Larry Loeb
Larry Loeb
Larry Loeb

Bug Bounty Programs Paying Off for Enterprises

The number of bug bounty programs continues to grow, and enterprise security is better for it. A new report urges more businesses to embrace and not squash these initiatives.

Organizations have come to realize that their security is improved when technically competent people examine their products for vulnerabilities.

It took a long time for this realization to happen.

Companies were afraid outsiders would just exploit whatever they found. They eventually realized they were assuring this behavior would happen by not taking advantage of what people found.

First, the larger tech companies started to reward bugs that were found -- and most importantly -- revealed to them before the public. Now, more and more enterprises are adopting that process, according to the 2018 Hacker-Powered Security Report.

The report from HackerOne is a benchmark study of the bug bounty, as well as the vulnerability disclosure ecosystem based on what researchers call the largest data set of reported vulnerabilities available.

(Source: Pixabay)
(Source: Pixabay)

The report was based on more than 1,700 responses to the 2017 HackerOne Community Survey, including those who successfully reported one valid vulnerability.

The report found that the total number of high or critical severity vulnerabilities had increased by 22% in 2017. Furthermore, 24% of the resolved vulnerabilities were classified as "high to critical" severity across industries.

This has caused the bounties for high-impact findings to rise.

A total of 116 unique critical vulnerabilities earned over $10,000 each in the past year. The top bounty awarded for a single report reached $75,000 in 2017, and that was paid by a technology company for three unique vulnerabilities that when chained together, produced a remote code execution (RCE) that required no user interaction to exploit.

Similar programs run by Google, Microsoft and Intel are offering $250,000 bounty awards for critical issues. (See Intel Boosts Bug Bounties in Wake of Spectre & Meltdown.)

Governments all over the world are also adopting this approach. The report notes that in government sector there was a 125% increase year-over-year with new program launches including the European Commission and the Ministry of Defense Singapore.

Further, the consumer goods, financial services and insurance, government and telecommunications industries now account for about 43% of bug bounty programs. Automotive programs increased 50% in the past year.

Enterprises across industries saw a 54% increase in year over year adoption.

However, HackerOne found that 93% of the 2017 Forbes Global 2000 list does not have a policy to receive, respond and resolve critical bug reports submitted by third parties. But, Goldman Sachs, Toyota and American Express were a few of the enterprises to launch a vulnerability disclosure policy (VDP) in 2018, so there is growth in VDP adoption.

Boost your understanding of new cybersecurity approaches at Light Reading's Automating Seamless Security event on October 17 in Chicago! Service providers and enterprise receive FREE passes. All others can save 20% off passes using the code LR20 today!

The VDP growth is global. Latin America had the largest uptake of VDPs and bug bounty programs, with an increase of 143% year-over-year. North America and the Asia Pacific region each increased 37%, and Europe, the Middle East and Africa saw a combined 26% increase in the past year.

Cross-site scripting (XSS) continues to be the most common vulnerability reported across all industries, with the exception of healthcare and technology. In those sectors, information disclosure, which means that information is disclosed to an actor not explicitly authorized to have access to that information, was the lead.

The report found that XSS vulnerabilities represented 59% of the t15 vulnerabilities reported to transportation organizations, and 37% of the Top 15 vulnerabilities reported to travel and hospitality organizations.

Companies have learned that giving rewards for security information gets them both better information and a controlled path for disclosure that is not disruptive.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-10-18
Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.
PUBLISHED: 2021-10-18
An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem allows a remote server to obtain security trust well improperly. This indication of trust may be passed ...
PUBLISHED: 2021-10-18
myfactory.FMS before 7.1-912 allows XSS via the UID parameter.
PUBLISHED: 2021-10-18
myfactory.FMS before 7.1-912 allows XSS via the Error parameter.
PUBLISHED: 2021-10-18
Agents are able to lock the ticket without the "Owner" permission. Once the ticket is locked, it could be moved to the queue where the agent has "rw" permissions and gain a full control. This issue affects: OTRS AG OTRS 8.0.x version: 8.0.16 and prior versions.