Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Security Management

7/13/2018
08:05 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Bug Bounty Programs Paying Off for Enterprises

The number of bug bounty programs continues to grow, and enterprise security is better for it. A new report urges more businesses to embrace and not squash these initiatives.

Organizations have come to realize that their security is improved when technically competent people examine their products for vulnerabilities.

It took a long time for this realization to happen.

Companies were afraid outsiders would just exploit whatever they found. They eventually realized they were assuring this behavior would happen by not taking advantage of what people found.

First, the larger tech companies started to reward bugs that were found -- and most importantly -- revealed to them before the public. Now, more and more enterprises are adopting that process, according to the 2018 Hacker-Powered Security Report.

The report from HackerOne is a benchmark study of the bug bounty, as well as the vulnerability disclosure ecosystem based on what researchers call the largest data set of reported vulnerabilities available.

The report was based on more than 1,700 responses to the 2017 HackerOne Community Survey, including those who successfully reported one valid vulnerability.

The report found that the total number of high or critical severity vulnerabilities had increased by 22% in 2017. Furthermore, 24% of the resolved vulnerabilities were classified as "high to critical" severity across industries.

This has caused the bounties for high-impact findings to rise.

A total of 116 unique critical vulnerabilities earned over $10,000 each in the past year. The top bounty awarded for a single report reached $75,000 in 2017, and that was paid by a technology company for three unique vulnerabilities that when chained together, produced a remote code execution (RCE) that required no user interaction to exploit.

Similar programs run by Google, Microsoft and Intel are offering $250,000 bounty awards for critical issues. (See Intel Boosts Bug Bounties in Wake of Spectre & Meltdown.)

Governments all over the world are also adopting this approach. The report notes that in government sector there was a 125% increase year-over-year with new program launches including the European Commission and the Ministry of Defense Singapore.

Further, the consumer goods, financial services and insurance, government and telecommunications industries now account for about 43% of bug bounty programs. Automotive programs increased 50% in the past year.

Enterprises across industries saw a 54% increase in year over year adoption.

However, HackerOne found that 93% of the 2017 Forbes Global 2000 list does not have a policy to receive, respond and resolve critical bug reports submitted by third parties. But, Goldman Sachs, Toyota and American Express were a few of the enterprises to launch a vulnerability disclosure policy (VDP) in 2018, so there is growth in VDP adoption.


Boost your understanding of new cybersecurity approaches at Light Reading's Automating Seamless Security event on October 17 in Chicago! Service providers and enterprise receive FREE passes. All others can save 20% off passes using the code LR20 today!

The VDP growth is global. Latin America had the largest uptake of VDPs and bug bounty programs, with an increase of 143% year-over-year. North America and the Asia Pacific region each increased 37%, and Europe, the Middle East and Africa saw a combined 26% increase in the past year.

Cross-site scripting (XSS) continues to be the most common vulnerability reported across all industries, with the exception of healthcare and technology. In those sectors, information disclosure, which means that information is disclosed to an actor not explicitly authorized to have access to that information, was the lead.

The report found that XSS vulnerabilities represented 59% of the t15 vulnerabilities reported to transportation organizations, and 37% of the Top 15 vulnerabilities reported to travel and hospitality organizations.

Companies have learned that giving rewards for security information gets them both better information and a controlled path for disclosure that is not disruptive.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.