Vulnerabilities / Threats

10/5/2017
10:30 AM
Jason Haddix
Jason Haddix
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Private, Public, or Hybrid? Finding the Right Fit in a Bug Bounty Program

How can a bug bounty not be a bug bounty? There are several reasons. Here's why you need to understand the differences.

After nearly five years of managing bug bounty programs, it's easy for me to lose sight of the fact that this is still a relatively new concept. As a result, there are several common questions and misconceptions about bug bounty programs. Two of the most common go hand in hand: not all bug bounty programs are public, and not all bug bounty programs are, in fact, bug bounty programs.

Let's start with the second misconception because it's likely the most confusing. How can a bug bounty not be a bug bounty? The simplest answer is that the term bug bounty has come to mean any type of vulnerability disclosure program, which is the correct umbrella term for the industry. A vulnerability disclosure program is any program where external researchers can submit vulnerabilities to an organization, whether there is a reward or not. A bug bounty is more specifically a program by which organizations reward these vulnerability submissions.

Disclosure programs run the gamut, providing anything from a time-bound assessment (much like a penetration test) to an ongoing assessment — a vetted, private, crowd-to-crowd of thousands of global researchers. Equally vast are the types of targets the crowd can test, from public Web domains to not-yet-released mobile applications, and even hardware. This leads to the next point: not all bug bounty programs are public.

Organizations that are new to bug bounties, perhaps considering implementing one for the first time, often have concerns about their ability to handle submissions, fearing their application won't stand up to the volume of testing, fearing the unknown of "the crowd," or simply not knowing how to provide the crowd access to what they need tested. Although public programs are great solutions for many organizations (and we believe a public vulnerability disclosure channel is best practice) these are valid, yet addressable, concerns.

Enter Private Bug Bounty Programs
Private bug bounty programs allow organizations to harness the power of the crowd — diversity of skill and perspective at scale — in a more controlled environment. A private program includes only those researchers who have a proven track record. Those who have proven their skill and trustworthiness receive invitations to private programs. Private programs can be scoped or built around a customer's testing needs and parameters. Need a mobile app tested? Pull from mobile experts. Need an expert in virtualization? Build a customized "crowd" to fulfill your testing needs. A private program can also meet requirements around background checking, ID verification, or even location.

Private programs are open to a select, vetted group of researchers while public ones are open to thousands of global researchers; however, these are just two ends of a spectrum. At Bugcrowd, this summer we launched a recruitment effort for a top-secret program that offered a hybrid, allowing the organization to recruit security experts that specialized in the company's unique attack surface in a controlled way. This means that while not just any researcher can "hack on" the program, anyone can apply to.

When To Go Public
Public bug bounty programs provide all the benefits of a private program, at scale. This means more eyes, more skills sets, more submissions. With the added benefit of the publicity these programs naturally see, public programs tend to attract more talent not only to those programs, but also to the crowd as a whole. We almost always see big surges in signups after a public program launch.

A public bug bounty program is a fantastic means to ensure continuous risk assessment, and ultimately mitigation. Yet, as sure as bug bounties are an effective solution for most organizations, they are not a one-size-fits-all endeavor. In many cases, organizations can choose to run private, on-demand, and ongoing programs simultaneously. There can also be a healthy number of private to public stories, where the organization takes a crawl-walk-run approach, slowly building their muscle for receiving and remediating vulnerability submissions to ensure maximum effectiveness when they launch their public program to the full crowd.

This also highlights the value of program management. Most organizations — regardless of size — become quickly overwhelmed by the process of starting and running a program: defining scope, defining disclosure inputs, identifying program security owners, establishing a vulnerability management program, and even determining time-to-fix agreements within that program. And this doesn't even address how to establish attractive payout ranges or set up an efficient triage and validation process — much less attract a solid crowd of researchers to actively participate. Program management can help ensure the right type of program, at the right time, and can work with your organization to ensure the success of the problem over time.

Regardless of company size, a vulnerability program is a good idea. Given the increase in security incidents, followed by a new, yet quickly growing scrutiny of organizations' security programs, it's unsurprising that they're becoming a best practice. Whether looking for a public bug bounty program with high rewards or to access a diverse group of skilled researchers in a controlled environment or anything in between, there is a vulnerability disclosure program to suit your needs.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Jason is the head of trust and security at Bugcrowd. Jason works with clients and security researchers to create high value, sustainable, and impactful bug bounty programs. He also works with Bugcrowd to improve the security industry's relations with researchers. Jason's ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jcavery
50%
50%
jcavery,
User Rank: Moderator
10/5/2017 | 1:42:58 PM
Bugcrowd
<3  BugCrowd

Friendly,  responsive staff. keep up the great work.
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11321
PUBLISHED: 2018-05-22
An issue was discovered in com_fields in Joomla! Core before 3.8.8. Inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option.
CVE-2018-11322
PUBLISHED: 2018-05-22
An issue was discovered in Joomla! Core before 3.8.8. Depending on the server configuration, PHAR files might be handled as executable PHP scripts by the webserver.
CVE-2018-11323
PUBLISHED: 2018-05-22
An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to modify the access levels of user groups with higher permissions.
CVE-2018-11324
PUBLISHED: 2018-05-22
An issue was discovered in Joomla! Core before 3.8.8. A long running background process, such as remote checks for core or extension updates, could create a race condition where a session that was expected to be destroyed would be recreated.
CVE-2018-11325
PUBLISHED: 2018-05-22
An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after either a form validation error or navigating to a previous install step, and display the plaintext password for the administrator account at the confirmation screen.