Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Security Management

7/13/2018
08:05 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Bug Bounty Programs Paying Off for Enterprises

The number of bug bounty programs continues to grow, and enterprise security is better for it. A new report urges more businesses to embrace and not squash these initiatives.

Organizations have come to realize that their security is improved when technically competent people examine their products for vulnerabilities.

It took a long time for this realization to happen.

Companies were afraid outsiders would just exploit whatever they found. They eventually realized they were assuring this behavior would happen by not taking advantage of what people found.

First, the larger tech companies started to reward bugs that were found -- and most importantly -- revealed to them before the public. Now, more and more enterprises are adopting that process, according to the 2018 Hacker-Powered Security Report.

The report from HackerOne is a benchmark study of the bug bounty, as well as the vulnerability disclosure ecosystem based on what researchers call the largest data set of reported vulnerabilities available.

(Source: Pixabay)
(Source: Pixabay)

The report was based on more than 1,700 responses to the 2017 HackerOne Community Survey, including those who successfully reported one valid vulnerability.

The report found that the total number of high or critical severity vulnerabilities had increased by 22% in 2017. Furthermore, 24% of the resolved vulnerabilities were classified as "high to critical" severity across industries.

This has caused the bounties for high-impact findings to rise.

A total of 116 unique critical vulnerabilities earned over $10,000 each in the past year. The top bounty awarded for a single report reached $75,000 in 2017, and that was paid by a technology company for three unique vulnerabilities that when chained together, produced a remote code execution (RCE) that required no user interaction to exploit.

Similar programs run by Google, Microsoft and Intel are offering $250,000 bounty awards for critical issues. (See Intel Boosts Bug Bounties in Wake of Spectre & Meltdown.)

Governments all over the world are also adopting this approach. The report notes that in government sector there was a 125% increase year-over-year with new program launches including the European Commission and the Ministry of Defense Singapore.

Further, the consumer goods, financial services and insurance, government and telecommunications industries now account for about 43% of bug bounty programs. Automotive programs increased 50% in the past year.

Enterprises across industries saw a 54% increase in year over year adoption.

However, HackerOne found that 93% of the 2017 Forbes Global 2000 list does not have a policy to receive, respond and resolve critical bug reports submitted by third parties. But, Goldman Sachs, Toyota and American Express were a few of the enterprises to launch a vulnerability disclosure policy (VDP) in 2018, so there is growth in VDP adoption.


Boost your understanding of new cybersecurity approaches at Light Reading's Automating Seamless Security event on October 17 in Chicago! Service providers and enterprise receive FREE passes. All others can save 20% off passes using the code LR20 today!

The VDP growth is global. Latin America had the largest uptake of VDPs and bug bounty programs, with an increase of 143% year-over-year. North America and the Asia Pacific region each increased 37%, and Europe, the Middle East and Africa saw a combined 26% increase in the past year.

Cross-site scripting (XSS) continues to be the most common vulnerability reported across all industries, with the exception of healthcare and technology. In those sectors, information disclosure, which means that information is disclosed to an actor not explicitly authorized to have access to that information, was the lead.

The report found that XSS vulnerabilities represented 59% of the t15 vulnerabilities reported to transportation organizations, and 37% of the Top 15 vulnerabilities reported to travel and hospitality organizations.

Companies have learned that giving rewards for security information gets them both better information and a controlled path for disclosure that is not disruptive.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-37759
PUBLISHED: 2021-07-31
A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).
CVE-2021-37760
PUBLISHED: 2021-07-31
A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).
CVE-2020-26564
PUBLISHED: 2021-07-31
ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey template (containing a link to this .css file), and import this .xml file at the survey/admin/folderSurvey.do?action=viewImportSurvey['importFil...
CVE-2020-26565
PUBLISHED: 2021-07-31
ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo data.
CVE-2020-26806
PUBLISHED: 2021-07-31
admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath can have directory traversal and fileContent can be valid JSP code.