Bug Bounty Programs Made Easy

New weaknesses of popular publishing platforms are always coming to light. It’s hard to keep up, and one can never be totally sure that all the potential bugs or security weaknesses have been found.

However, with bug-bounty.com, tracking down bugs in your systems may be less troublesome than you first thought.

What is a bug bounty?

Bug bounty programs offer rewards to ethical hackers who discover bugs or security weaknesses. They are often run by big software publishers so that they can fix these issues before they’re discovered and exploited by the bad guys.

Companies often hire a team to test the security of their website or system before deployment. But what happens when new features or updates are pushed? What about the bugs or weaknesses that these teams miss?

This is why it makes sense to sign up to a bug bounty program to ensure that the system gets tested by a vast range of freelance security experts, not just one team. Bug bounty programs also ensure that the system is always being tested, not just at one point in time. This ensures that bugs introduced by new features or updates get caught and fixed before they get exploited by black-hat hackers.

What are ethical hackers?

An ethical hacker is a security expert skilled in testing the security of websites, mobile apps and IT systems to identify bugs and vulnerabilities. These professional bounty hunters employ the same techniques used by black-hat hackers, but do so legitimately, with the permission of the owner. This helps identify and resolve any vulnerabilities before they are found by hackers who are rather less ethical.

Many companies attempt to run their own bug bounty programs, but finding and managing a team of freelance hackers isn’t simple. Are they ethical? Are they skilled? Will they be bothered to work for you? And are the bugs that they uncover genuine problems?

This is why even huge companies do not run their own bug bounty programs in-house, choosing to run them through a bug bounty platform. However, these platforms are very expensive to start with, as they are geared toward such big companies. And that’s where bug-bounty.com comes in.

How does the bug bounty service work?

The bug-bounty.com service is aimed at small and medium-size businesses that don’t have the time, budget or resources to build and maintain their own ethical hacking teams. The service gives companies access to a large number of experts who can probe defenses and look for vulnerabilities.

Customers pay a small monthly fee, with no set-up costs. Hackers are rewarded when they discover a new bug. More on how they are rewarded in a moment.

Bug-bounty.com also employs its own team of ethical hackers to review and validate the submitted bugs, and only forwards valid problems to customers. If the bug isn’t real, or if it has already been fixed by a software update, the customer doesn’t get notified because it isn’t going to affect them.

Are bug bounties dangerous?

Not at all. Giving security freelancers free rein of your systems may seem counterintuitive or even risky at first, but these skilled ethical hackers work with your permission and within pre-agreed constraints and conditions. For example, the freelance hackers will be contractually obliged not to keep any sensitive customer data that they might uncover.

It’s important to keep in mind that you are not giving these ethical hackers any advantage over other internet users. All you are doing is agreeing with them that if they find a hole in your defenses, they won’t exploit it, and you will reward them for telling you about it.

Do small companies really need a bug bounty?

Every organization needs this type of service. Many smaller companies use standard software provided by major companies. Most of the time, that software is going to be relatively secure if it’s set up securely. However, a lot of major data breaches are caused by oversights and misconfigurations.

Working with bug-bounty.com means that even if you haven’t set up your systems 100% perfectly, you are limiting risk of a data breach by ensuring that systems are regularly tested by experts. As mentioned earlier, it also ensures that new updates and new features are tested.

What do the ethical hackers get out of this?

Freelance ethical hackers have a variety of motives. Some simply enjoy searching for bugs, while others do it for the money. One particular tech company is known to have paid out £5m to ethical hackers in 2020, with the largest single reward being about £100,000.

That’s a lot of money—more than many can afford. But with bug-bounty.com, it’s up to you how much compensation to offer. Too little, of course, and most security experts won’t bother to help. But it needn’t be expensive. Many freelance ethical hackers are building a career, and finding a bug that is validated as genuine adds to their CV.

Instead of paying out a small monetary reward for finding a bug, some companies may prefer to pay with “points” that are displayed on a leaderboard. This method of gamification encourages competition among bounty hunters, leading to even more vulnerabilities being found.

The bottom line

Why sign up for this service? Simple. We’ve all been warned about genuine vulnerabilities in IT systems. Each bug you are notified about has been validated by professionals, so there are no false alarms to waste time. In addition, it doesn’t cost a fortune. You just pay a small monthly fee plus a little extra each time a serious bug is found.

—Industry view from zSecurity

To find out more about how the service works and to sign up, contact Bug Bounty.

This article originally appeared on Business Reporter. Image credit: iStock id1092821610 Animated image credit: Courtesy of zSecurity