Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/5/2017
10:30 AM
Jason Haddix
Jason Haddix
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Private, Public, or Hybrid? Finding the Right Fit in a Bug Bounty Program

How can a bug bounty not be a bug bounty? There are several reasons. Here's why you need to understand the differences.

After nearly five years of managing bug bounty programs, it's easy for me to lose sight of the fact that this is still a relatively new concept. As a result, there are several common questions and misconceptions about bug bounty programs. Two of the most common go hand in hand: not all bug bounty programs are public, and not all bug bounty programs are, in fact, bug bounty programs.

Let's start with the second misconception because it's likely the most confusing. How can a bug bounty not be a bug bounty? The simplest answer is that the term bug bounty has come to mean any type of vulnerability disclosure program, which is the correct umbrella term for the industry. A vulnerability disclosure program is any program where external researchers can submit vulnerabilities to an organization, whether there is a reward or not. A bug bounty is more specifically a program by which organizations reward these vulnerability submissions.

Disclosure programs run the gamut, providing anything from a time-bound assessment (much like a penetration test) to an ongoing assessment — a vetted, private, crowd-to-crowd of thousands of global researchers. Equally vast are the types of targets the crowd can test, from public Web domains to not-yet-released mobile applications, and even hardware. This leads to the next point: not all bug bounty programs are public.

Organizations that are new to bug bounties, perhaps considering implementing one for the first time, often have concerns about their ability to handle submissions, fearing their application won't stand up to the volume of testing, fearing the unknown of "the crowd," or simply not knowing how to provide the crowd access to what they need tested. Although public programs are great solutions for many organizations (and we believe a public vulnerability disclosure channel is best practice) these are valid, yet addressable, concerns.

Enter Private Bug Bounty Programs
Private bug bounty programs allow organizations to harness the power of the crowd — diversity of skill and perspective at scale — in a more controlled environment. A private program includes only those researchers who have a proven track record. Those who have proven their skill and trustworthiness receive invitations to private programs. Private programs can be scoped or built around a customer's testing needs and parameters. Need a mobile app tested? Pull from mobile experts. Need an expert in virtualization? Build a customized "crowd" to fulfill your testing needs. A private program can also meet requirements around background checking, ID verification, or even location.

Private programs are open to a select, vetted group of researchers while public ones are open to thousands of global researchers; however, these are just two ends of a spectrum. At Bugcrowd, this summer we launched a recruitment effort for a top-secret program that offered a hybrid, allowing the organization to recruit security experts that specialized in the company's unique attack surface in a controlled way. This means that while not just any researcher can "hack on" the program, anyone can apply to.

When To Go Public
Public bug bounty programs provide all the benefits of a private program, at scale. This means more eyes, more skills sets, more submissions. With the added benefit of the publicity these programs naturally see, public programs tend to attract more talent not only to those programs, but also to the crowd as a whole. We almost always see big surges in signups after a public program launch.

A public bug bounty program is a fantastic means to ensure continuous risk assessment, and ultimately mitigation. Yet, as sure as bug bounties are an effective solution for most organizations, they are not a one-size-fits-all endeavor. In many cases, organizations can choose to run private, on-demand, and ongoing programs simultaneously. There can also be a healthy number of private to public stories, where the organization takes a crawl-walk-run approach, slowly building their muscle for receiving and remediating vulnerability submissions to ensure maximum effectiveness when they launch their public program to the full crowd.

This also highlights the value of program management. Most organizations — regardless of size — become quickly overwhelmed by the process of starting and running a program: defining scope, defining disclosure inputs, identifying program security owners, establishing a vulnerability management program, and even determining time-to-fix agreements within that program. And this doesn't even address how to establish attractive payout ranges or set up an efficient triage and validation process — much less attract a solid crowd of researchers to actively participate. Program management can help ensure the right type of program, at the right time, and can work with your organization to ensure the success of the problem over time.

Regardless of company size, a vulnerability program is a good idea. Given the increase in security incidents, followed by a new, yet quickly growing scrutiny of organizations' security programs, it's unsurprising that they're becoming a best practice. Whether looking for a public bug bounty program with high rewards or to access a diverse group of skilled researchers in a controlled environment or anything in between, there is a vulnerability disclosure program to suit your needs.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Jason is the head of trust and security at Bugcrowd. Jason works with clients and security researchers to create high value, sustainable, and impactful bug bounty programs. He also works with Bugcrowd to improve the security industry's relations with researchers. Jason's ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jcavery
50%
50%
jcavery,
User Rank: Moderator
10/5/2017 | 1:42:58 PM
Bugcrowd
<3  BugCrowd

Friendly,  responsive staff. keep up the great work.
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27486
PUBLISHED: 2021-04-12
The Fatek Automation WinProladder Versions 3.3 and prior are vulnerable to an integer underflow, which may cause an out-of-bounds write and allow an attacker to execute arbitrary code.
CVE-2021-3465
PUBLISHED: 2021-04-12
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2020-15942
PUBLISHED: 2021-04-12
An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile.
CVE-2021-22190
PUBLISHED: 2021-04-12
A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token
CVE-2021-24024
PUBLISHED: 2021-04-12
A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may allow a remote authenticated attacker to read other local users' password in log files.