Bug bounties: Bad dog! Have a treat!
Bug bounty programs are probably very cost-effective for software vendors, but they reward bad behavior
Computerworld - Last month at the FIRST conference (the Forum of Incident Response and Security Teams) in Bangkok, Microsoft announced that it's joining the "bug bounty" crowd. Some might say, "Finally!" but I'm not convinced it's a positive move. No doubt, there are strong arguments both for and against bug bounty programs, but in the long run, I'm not a fan.
Bug bounty programs are used by quite a few software organizations to encourage their customers and the general public to report security vulnerabilities directly to the software organization. Most such programs encourage (or require) a responsible disclosure process, but in the end the vulnerability and its remediation are published to the world. So what's the big deal? Let's consider the pros and cons a bit.
In favor of bug bounties
Bug bounty programs are in essence an extension of security testing programs. They are an ad hoc form of outsourcing a company's security testing -- to a community of people who likely aren't under NDA and, as non-employees, have absolutely no fiduciary responsibility to the software company, I should add. From the company's standpoint, they are relatively cost-effective, since the vendor ends up paying only for actual vulnerabilities, not for time spent trying (and failing) to find the bugs.
In Microsoft's case, it will pay $100,000 for new operating system vulnerabilities and an additional $50,000 for successful mitigation information. (Microsoft also offers $11,000 for critical vulnerabilities found in Internet Explorer.) I suspect these amounts are far less money than Microsoft would pay its own employees for vulnerability exploration and mitigation development work. Any vulnerability explorer will no doubt agree that far more time is spent searching and failing than searching and succeeding. Bug bounty sponsors have found a way to make all that searching-and-failing time cost-free to the software companies.
I'm confident that companies with bug bounty programs have weighed these costs carefully. Having held off on a public program for so long, Microsoft seems likely to have put a great deal of consideration and justification into its decision. Of course, I don't have access to the actual factors that influenced these decisions, but it stands to reason that the cost structure is beneficial for the sponsoring companies.
Against bug bounties
Part of what makes me dislike bug bounty programs is the fact that they reward bad behavior. I can't help but think that the bug finders are in essence holding a metaphorical gun to the heads of the software companies by saying, "pay up or I'm going to publish this vulnerability to the world". Perhaps that explains Microsoft's reluctance till now to embrace bug bounties. Let me explain why I think bug bounty programs are a doggie treat for bad pooches.
More by Kenneth van Wyk
- Kenneth van Wyk: Apple's big fail
- Kenneth van Wyk: After Snowden
- Kenneth van Wyk: Target breach underscores how backward U.S. payment tech is
- Kenneth van Wyk: Enjoy your trip, but protect the data you take with you
- Kenneth van Wyk: Lingering faults with security by default
- Kenneth van Wyk: High hopes for iPhone's Touch ID
- Kenneth van Wyk: Why mobile apps beat Web apps for privacy
- Bug bounties: Bad dog! Have a treat!
- How to avoid Big Brother's gaze
- The true root causes of software security failures
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Riverbed Stingray Application Firewall: Securing Cloud Applications with a Distributed Web Application Firewall Responsibility over IT security is moving away from the network and IT infrastructure and to the application and software architecture itself. IT organizations...
- Web Application Firewalls--Laying the Myths to Rest This paper addresses some of the myths about WAFs and outlines how businesses are optimizing their investment in protecting their ever-evolving web apps.
- PCI DSS Compliance in Cloud Environments This technology analysis addresses the challenges of the evolving cloud security landscape and how organizations can achieve PCI DSS compliance in cloud environments...
- Web Attack Survival Guide This guide will help you protect your organization from external threats targeting your high-value applications and data assets.
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Application Security White Papers | Webcasts