Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/5/2017
10:30 AM
Jason Haddix
Jason Haddix
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Private, Public, or Hybrid? Finding the Right Fit in a Bug Bounty Program

How can a bug bounty not be a bug bounty? There are several reasons. Here's why you need to understand the differences.

After nearly five years of managing bug bounty programs, it's easy for me to lose sight of the fact that this is still a relatively new concept. As a result, there are several common questions and misconceptions about bug bounty programs. Two of the most common go hand in hand: not all bug bounty programs are public, and not all bug bounty programs are, in fact, bug bounty programs.

Let's start with the second misconception because it's likely the most confusing. How can a bug bounty not be a bug bounty? The simplest answer is that the term bug bounty has come to mean any type of vulnerability disclosure program, which is the correct umbrella term for the industry. A vulnerability disclosure program is any program where external researchers can submit vulnerabilities to an organization, whether there is a reward or not. A bug bounty is more specifically a program by which organizations reward these vulnerability submissions.

Disclosure programs run the gamut, providing anything from a time-bound assessment (much like a penetration test) to an ongoing assessment — a vetted, private, crowd-to-crowd of thousands of global researchers. Equally vast are the types of targets the crowd can test, from public Web domains to not-yet-released mobile applications, and even hardware. This leads to the next point: not all bug bounty programs are public.

Organizations that are new to bug bounties, perhaps considering implementing one for the first time, often have concerns about their ability to handle submissions, fearing their application won't stand up to the volume of testing, fearing the unknown of "the crowd," or simply not knowing how to provide the crowd access to what they need tested. Although public programs are great solutions for many organizations (and we believe a public vulnerability disclosure channel is best practice) these are valid, yet addressable, concerns.

Enter Private Bug Bounty Programs
Private bug bounty programs allow organizations to harness the power of the crowd — diversity of skill and perspective at scale — in a more controlled environment. A private program includes only those researchers who have a proven track record. Those who have proven their skill and trustworthiness receive invitations to private programs. Private programs can be scoped or built around a customer's testing needs and parameters. Need a mobile app tested? Pull from mobile experts. Need an expert in virtualization? Build a customized "crowd" to fulfill your testing needs. A private program can also meet requirements around background checking, ID verification, or even location.

Private programs are open to a select, vetted group of researchers while public ones are open to thousands of global researchers; however, these are just two ends of a spectrum. At Bugcrowd, this summer we launched a recruitment effort for a top-secret program that offered a hybrid, allowing the organization to recruit security experts that specialized in the company's unique attack surface in a controlled way. This means that while not just any researcher can "hack on" the program, anyone can apply to.

When To Go Public
Public bug bounty programs provide all the benefits of a private program, at scale. This means more eyes, more skills sets, more submissions. With the added benefit of the publicity these programs naturally see, public programs tend to attract more talent not only to those programs, but also to the crowd as a whole. We almost always see big surges in signups after a public program launch.

A public bug bounty program is a fantastic means to ensure continuous risk assessment, and ultimately mitigation. Yet, as sure as bug bounties are an effective solution for most organizations, they are not a one-size-fits-all endeavor. In many cases, organizations can choose to run private, on-demand, and ongoing programs simultaneously. There can also be a healthy number of private to public stories, where the organization takes a crawl-walk-run approach, slowly building their muscle for receiving and remediating vulnerability submissions to ensure maximum effectiveness when they launch their public program to the full crowd.

This also highlights the value of program management. Most organizations — regardless of size — become quickly overwhelmed by the process of starting and running a program: defining scope, defining disclosure inputs, identifying program security owners, establishing a vulnerability management program, and even determining time-to-fix agreements within that program. And this doesn't even address how to establish attractive payout ranges or set up an efficient triage and validation process — much less attract a solid crowd of researchers to actively participate. Program management can help ensure the right type of program, at the right time, and can work with your organization to ensure the success of the problem over time.

Regardless of company size, a vulnerability program is a good idea. Given the increase in security incidents, followed by a new, yet quickly growing scrutiny of organizations' security programs, it's unsurprising that they're becoming a best practice. Whether looking for a public bug bounty program with high rewards or to access a diverse group of skilled researchers in a controlled environment or anything in between, there is a vulnerability disclosure program to suit your needs.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Jason is the head of trust and security at Bugcrowd. Jason works with clients and security researchers to create high value, sustainable, and impactful bug bounty programs. He also works with Bugcrowd to improve the security industry's relations with researchers. Jason's ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jcavery
50%
50%
jcavery,
User Rank: Moderator
10/5/2017 | 1:42:58 PM
Bugcrowd
<3  BugCrowd

Friendly,  responsive staff. keep up the great work.
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27852
PUBLISHED: 2021-01-20
A stored Cross-Site Scripting (XSS) vulnerability in the survey feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via a textarea field. This code is interpreted by users in a privileged role (Administrator, Editor, etc.).
CVE-2021-3137
PUBLISHED: 2021-01-20
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section.
CVE-2020-27850
PUBLISHED: 2021-01-20
A stored Cross-Site Scripting (XSS) vulnerability in forms import feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via the import of a GF form. This code is interpreted by users in a privileged role (Administrator, Editor, etc.).
CVE-2020-27851
PUBLISHED: 2021-01-20
Multiple stored HTML injection vulnerabilities in the &quot;poll&quot; and &quot;quiz&quot; features in an additional paid add-on of Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary HTML code via poll or quiz answers. This code is interpreted by users in a privile...
CVE-2020-13134
PUBLISHED: 2021-01-20
Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS payload itself), and can exploit (be triggered by) admin users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1...