Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/5/2017
10:30 AM
Jason Haddix
Jason Haddix
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Private, Public, or Hybrid? Finding the Right Fit in a Bug Bounty Program

How can a bug bounty not be a bug bounty? There are several reasons. Here's why you need to understand the differences.

After nearly five years of managing bug bounty programs, it's easy for me to lose sight of the fact that this is still a relatively new concept. As a result, there are several common questions and misconceptions about bug bounty programs. Two of the most common go hand in hand: not all bug bounty programs are public, and not all bug bounty programs are, in fact, bug bounty programs.

Let's start with the second misconception because it's likely the most confusing. How can a bug bounty not be a bug bounty? The simplest answer is that the term bug bounty has come to mean any type of vulnerability disclosure program, which is the correct umbrella term for the industry. A vulnerability disclosure program is any program where external researchers can submit vulnerabilities to an organization, whether there is a reward or not. A bug bounty is more specifically a program by which organizations reward these vulnerability submissions.

Disclosure programs run the gamut, providing anything from a time-bound assessment (much like a penetration test) to an ongoing assessment — a vetted, private, crowd-to-crowd of thousands of global researchers. Equally vast are the types of targets the crowd can test, from public Web domains to not-yet-released mobile applications, and even hardware. This leads to the next point: not all bug bounty programs are public.

Organizations that are new to bug bounties, perhaps considering implementing one for the first time, often have concerns about their ability to handle submissions, fearing their application won't stand up to the volume of testing, fearing the unknown of "the crowd," or simply not knowing how to provide the crowd access to what they need tested. Although public programs are great solutions for many organizations (and we believe a public vulnerability disclosure channel is best practice) these are valid, yet addressable, concerns.

Enter Private Bug Bounty Programs
Private bug bounty programs allow organizations to harness the power of the crowd — diversity of skill and perspective at scale — in a more controlled environment. A private program includes only those researchers who have a proven track record. Those who have proven their skill and trustworthiness receive invitations to private programs. Private programs can be scoped or built around a customer's testing needs and parameters. Need a mobile app tested? Pull from mobile experts. Need an expert in virtualization? Build a customized "crowd" to fulfill your testing needs. A private program can also meet requirements around background checking, ID verification, or even location.

Private programs are open to a select, vetted group of researchers while public ones are open to thousands of global researchers; however, these are just two ends of a spectrum. At Bugcrowd, this summer we launched a recruitment effort for a top-secret program that offered a hybrid, allowing the organization to recruit security experts that specialized in the company's unique attack surface in a controlled way. This means that while not just any researcher can "hack on" the program, anyone can apply to.

When To Go Public
Public bug bounty programs provide all the benefits of a private program, at scale. This means more eyes, more skills sets, more submissions. With the added benefit of the publicity these programs naturally see, public programs tend to attract more talent not only to those programs, but also to the crowd as a whole. We almost always see big surges in signups after a public program launch.

A public bug bounty program is a fantastic means to ensure continuous risk assessment, and ultimately mitigation. Yet, as sure as bug bounties are an effective solution for most organizations, they are not a one-size-fits-all endeavor. In many cases, organizations can choose to run private, on-demand, and ongoing programs simultaneously. There can also be a healthy number of private to public stories, where the organization takes a crawl-walk-run approach, slowly building their muscle for receiving and remediating vulnerability submissions to ensure maximum effectiveness when they launch their public program to the full crowd.

This also highlights the value of program management. Most organizations — regardless of size — become quickly overwhelmed by the process of starting and running a program: defining scope, defining disclosure inputs, identifying program security owners, establishing a vulnerability management program, and even determining time-to-fix agreements within that program. And this doesn't even address how to establish attractive payout ranges or set up an efficient triage and validation process — much less attract a solid crowd of researchers to actively participate. Program management can help ensure the right type of program, at the right time, and can work with your organization to ensure the success of the problem over time.

Regardless of company size, a vulnerability program is a good idea. Given the increase in security incidents, followed by a new, yet quickly growing scrutiny of organizations' security programs, it's unsurprising that they're becoming a best practice. Whether looking for a public bug bounty program with high rewards or to access a diverse group of skilled researchers in a controlled environment or anything in between, there is a vulnerability disclosure program to suit your needs.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Jason is the head of trust and security at Bugcrowd. Jason works with clients and security researchers to create high value, sustainable, and impactful bug bounty programs. He also works with Bugcrowd to improve the security industry's relations with researchers. Jason's ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jcavery
50%
50%
jcavery,
User Rank: Moderator
10/5/2017 | 1:42:58 PM
Bugcrowd
<3  BugCrowd

Friendly,  responsive staff. keep up the great work.
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2009-20001
PUBLISHED: 2021-03-07
An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them.
CVE-2020-28466
PUBLISHED: 2021-03-07
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened r...
CVE-2021-27364
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
CVE-2021-27365
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length...
CVE-2021-27363
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system...