Google Debuts Quality Ratings for Security Bug DisclosuresGoogle Debuts Quality Ratings for Security Bug Disclosures
New rules aim to level up the quality of submissions to Google and Android device Vulnerability Reward Program.
May 19, 2023
Google and Android will now assess device vulnerability disclosure reports based on the level of information that bug hunters provide in order to encourage more comprehensive submissions.
Vulnerability reports submitted to the Android and Google Vulnerability Reward Program (VRP) will be rated as "High," "Medium," or "Low" quality based on these elements, according to Google Security:
The accuracy and detail of the vulnerability description
Analysis of its root cause
Proof of concept
Evidence of reachability
Google and Android have also upped the top bug bounty prize to $15,000.
"Additionally, starting March 15th, 2023, Android will no longer assign Common Vulnerabilities and Exposures (CVEs) to most moderate severity issues," the Google Security blog post announcing the VRP changes said. "The CVEs will continue to be assigned to critical and high severity vulnerabilities."
Bugcrowd founder and chief technology officer (CTO) Casey Ellis applauds the effort by Google to define the elements of a high-quality vulnerability disclosure.
"Nothing happens without effective communication. ... The power of crowdsourcing brings with variability in how vulnerability submitters communicate, and the downstream effectiveness of the report at communicating the risk to those who need to fix it," Ellis says, in response to the new VRP rules. "Google stepping up to help educate the hacker community on 'the things which make communication more effective' is an enormous win for both the space and the community itself."
In 2022 alone, Google's VRPs paid out a record-setting $12 million in bug bounties.
About the Author(s)
You May Also Like
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
What's In Your Cloud?Nov 30, 2023
Everything You Need to Know About DNS AttacksNov 30, 2023
Passwords Are Passe: Next Gen Authentication Addresses Today's Threats
How to Deploy Zero Trust for Remote Workforce Security
What Ransomware Groups Look for in Enterprise Victims
Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware
Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks