Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Security Management

08:05 AM
Larry Loeb
Larry Loeb
Larry Loeb

Bug Bounty Programs Paying Off for Enterprises

The number of bug bounty programs continues to grow, and enterprise security is better for it. A new report urges more businesses to embrace and not squash these initiatives.

Organizations have come to realize that their security is improved when technically competent people examine their products for vulnerabilities.

It took a long time for this realization to happen.

Companies were afraid outsiders would just exploit whatever they found. They eventually realized they were assuring this behavior would happen by not taking advantage of what people found.

First, the larger tech companies started to reward bugs that were found -- and most importantly -- revealed to them before the public. Now, more and more enterprises are adopting that process, according to the 2018 Hacker-Powered Security Report.

The report from HackerOne is a benchmark study of the bug bounty, as well as the vulnerability disclosure ecosystem based on what researchers call the largest data set of reported vulnerabilities available.

The report was based on more than 1,700 responses to the 2017 HackerOne Community Survey, including those who successfully reported one valid vulnerability.

The report found that the total number of high or critical severity vulnerabilities had increased by 22% in 2017. Furthermore, 24% of the resolved vulnerabilities were classified as "high to critical" severity across industries.

This has caused the bounties for high-impact findings to rise.

A total of 116 unique critical vulnerabilities earned over $10,000 each in the past year. The top bounty awarded for a single report reached $75,000 in 2017, and that was paid by a technology company for three unique vulnerabilities that when chained together, produced a remote code execution (RCE) that required no user interaction to exploit.

Similar programs run by Google, Microsoft and Intel are offering $250,000 bounty awards for critical issues. (See Intel Boosts Bug Bounties in Wake of Spectre & Meltdown.)

Governments all over the world are also adopting this approach. The report notes that in government sector there was a 125% increase year-over-year with new program launches including the European Commission and the Ministry of Defense Singapore.

Further, the consumer goods, financial services and insurance, government and telecommunications industries now account for about 43% of bug bounty programs. Automotive programs increased 50% in the past year.

Enterprises across industries saw a 54% increase in year over year adoption.

However, HackerOne found that 93% of the 2017 Forbes Global 2000 list does not have a policy to receive, respond and resolve critical bug reports submitted by third parties. But, Goldman Sachs, Toyota and American Express were a few of the enterprises to launch a vulnerability disclosure policy (VDP) in 2018, so there is growth in VDP adoption.

Boost your understanding of new cybersecurity approaches at Light Reading's Automating Seamless Security event on October 17 in Chicago! Service providers and enterprise receive FREE passes. All others can save 20% off passes using the code LR20 today!

The VDP growth is global. Latin America had the largest uptake of VDPs and bug bounty programs, with an increase of 143% year-over-year. North America and the Asia Pacific region each increased 37%, and Europe, the Middle East and Africa saw a combined 26% increase in the past year.

Cross-site scripting (XSS) continues to be the most common vulnerability reported across all industries, with the exception of healthcare and technology. In those sectors, information disclosure, which means that information is disclosed to an actor not explicitly authorized to have access to that information, was the lead.

The report found that XSS vulnerabilities represented 59% of the t15 vulnerabilities reported to transportation organizations, and 37% of the Top 15 vulnerabilities reported to travel and hospitality organizations.

Companies have learned that giving rewards for security information gets them both better information and a controlled path for disclosure that is not disruptive.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I think the boss is bing watching '70s TV shows again!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-12-02
Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algorithm was not checked automatically, but only if the expecte...
PUBLISHED: 2020-12-02
An issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0. An "User enumeration and Improper Restriction of Excessive Authentication Attempts" vulnerability exists in the admin login form, allowing a remote user to enumerate users in the administrator group. This also ...
PUBLISHED: 2020-12-02
An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Virtual Machine) of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read which can subsequently trigger an out-of-bounds write resulting in remote code execution. An attacker can create/send m...
PUBLISHED: 2020-12-02
An exploitable Out-of-bounds Write vulnerability exists in the xls_addCell function of libxls 2.0. A specially crafted xls file can cause a memory corruption resulting in remote code execution. An attacker can send malicious xls file to trigger this vulnerability.
PUBLISHED: 2020-12-02
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. A specially crafted USDC file format path jumps decompression heap overflow in a way path jumps are processed. To trigger this vulnerability, the victim needs to open an atta...