{"id":6711,"date":"2017-02-21T14:30:06","date_gmt":"2017-02-21T22:30:06","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/02\/21\/news-528\/"},"modified":"2017-02-21T15:08:17","modified_gmt":"2017-02-21T23:08:17","slug":"news-528","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/02\/21\/news-528\/","title":{"rendered":"Why you need a bug bounty program"},"content":{"rendered":"<p><img decoding=\"async\" src=\"http:\/\/zapt3.staticworld.net\/images\/article\/2017\/01\/bug_bounty-100701715-large.3x2.jpg\" \/><\/p>\n<p><strong>Credit to Author: Mary Branscombe| Date: Tue, 21 Feb 2017 12:50:00 -0800<\/strong><\/p>\n<p>Every business needs to have a process in place for <a href=\"http:\/\/www.cio.com\/article\/3157698\/security\/how-to-handle-security-vulnerability-reports.html\">handling security vulnerability reports<\/a>, but some organizations take a much more proactive approach to dealing with security researchers.<\/p>\n<p>An increasing number of hardware and software vendors have formal bug bounty programs. Google, for example, runs its own <a href=\"https:\/\/security.googleblog.com\/2017\/01\/vulnerability-rewards-program-2016-year.html\">vulnerability rewards program<\/a>, and Microsoft has <a href=\"https:\/\/technet.microsoft.com\/en-us\/library\/dn425036.aspx\">multiple bug bounties<\/a> covering Office 365, Azure, .NET and Edge as general programs covering exploits and defenses.<\/p>\n<p>[ <a href=\"http:\/\/www.cio.com\/article\/2981998\/extortion-or-fair-trade-the-value-of-bug-bounties#tk.ciofsb\">Extortion or fair trade? The value of bug bounties<\/a> ]<\/p>\n<p>And the U.S. Department of Defense (DoD) set up its first bug bounty after several years of watching the software industry, says Katie Moussouris, now CEO of Luta Security. She previously created similar programs for Microsoft and Symantec, worked with the FDA to create market guidance around vulnerability disclosure for medical devices and helped the DoD prepare for their bug bounty while working at HackerOne. \u201cThe DoD was curious about those programs were effective, whether the folks participating in it were acting in good faith,\u201d she tells CIO. \u201cThey wanted to take what was working in the private sector and fast track that into the DoD.\u201d<\/p>\n<p>\u201cBug bounties are really just a subset of vulnerability disclosure with a particular incentive. They can be a useful tool. Just like any other incentive program, you&#8217;re trying to incent certain types of behavior, certain types of bugs,\u201d Moussouris says.<\/p>\n<p><a href=\"http:\/\/www.computerworld.com\/article\/3172536\/security\/why-you-need-a-bug-bounty-program.html#tk.rss_security\" target=\"bwo\">http:\/\/www.computerworld.com\/category\/security\/index.rss<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img decoding=\"async\" src=\"http:\/\/zapt3.staticworld.net\/images\/article\/2017\/01\/bug_bounty-100701715-large.3x2.jpg\"\/><\/p>\n<p><strong>Credit to Author: Mary Branscombe| Date: Tue, 21 Feb 2017 12:50:00 -0800<\/strong><\/p>\n<p>   Every business needs to have a process in place for <a href=\"http:\/\/www.cio.com\/article\/3157698\/security\/how-to-handle-security-vulnerability-reports.html\" target=\"_blank\">handling security vulnerability reports<\/a>, but some organizations take a much more proactive approach to dealing with security researchers.<\/p>\n<p class=\"jumpTag\"><a href=\"\/article\/3172536\/security\/why-you-need-a-bug-bounty-program.html#jump\">To read this article in full or to leave a comment, please click here<\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[11062,10643],"tags":[11181,11068,714],"class_list":["post-6711","post","type-post","status-publish","format-standard","hentry","category-computerworld","category-independent","tag-application-development","tag-idg-insider","tag-security"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/6711","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=6711"}],"version-history":[{"count":4,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/6711\/revisions"}],"predecessor-version":[{"id":6734,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/6711\/revisions\/6734"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=6711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=6711"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=6711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}