As I was reading the article, I was fascinated, and had no idea about bug bounty<\/p>\n\n\n\n
policies or programs’ real effect at the business scale. I can understand why a lot of<\/p>\n\n\n\n
businesses are dubious about third-party companies reporting cybersecurity flaws and<\/p>\n\n\n\n
vulnerabilities. Nobody wants to get strangers into their own backyards and find out their<\/p>\n\n\n\n
most intimate secrets per say, this fear is preventing companies from finding blind spots.<\/p>\n\n\n\n
As I keep on reading, the point of view is swiftly changing to the point that it is becoming<\/p>\n\n\n\n
a big business that has reached hundreds of millions of dollars in bounty revenue.<\/p>\n\n\n\n
Companies are even taking things a step further by taking part in bug bounty markets,<\/p>\n\n\n\n
where independent security researchers\u2014also known as ethical hackers\u2014are hired to<\/p>\n\n\n\n
locate flaws in business IT systems, and code bases and persuasively communicate<\/p>\n\n\n\n
vulnerabilities for them to be able to create better cybersecurities in their systems.<\/p>\n\n\n\n
But again companies are trying to keep their evaluations and vulnerabilities private,<\/p>\n\n\n\n
which prevents future studies, the lack of paperwork is limited to none, is not publicly<\/p>\n\n\n\n
available, and there is a struggle to establish research so it has to be based on<\/p>\n\n\n\n
observations which might not be as effective as the raw data from a valid report.<\/p>\n\n\n\n
Learning how big companies are being successful by implementing these policies, and<\/p>\n\n\n\n
how ethical hackers are getting compensated, I might want to head in that job field to<\/p>\n\n\n\n
get hefty rewards while companies still maintain a cost-effective budget, like stated in<\/p>\n\n\n\n
the reading it is cheaper than hiring two full time IT positions.<\/p>\n\n\n\n
This research paper has the economic principles written all over it, by literally explaining<\/p>\n\n\n\n
how beneficial cost-benefit analysis comes into play by deciding the reward money and<\/p>\n\n\n\n
the loss by limiting hacks that will interrupt operations for the company. It is just amazing<\/p>\n\n\n\n
how everything comes into play all together.<\/p>\n\n\n\n
The findings of the research are fascinating, stating the obvious. That bug bounties are<\/p>\n\n\n\n
very effective tools, no matter the size of the company, it discovered that depending on<\/p>\n\n\n\n
the type of company, some might receive fewer reports.<\/p>\n\n\n\n
Companies need to make an effort to make at least some of the findings available, to be<\/p>\n\n\n\n
able to create a better understanding, because we know very little about this market. By<\/p>\n\n\n\n
increasing our knowledge, ethical hacking might be a new way to combat cyberattacks,<\/p>\n\n\n\n
enhancing our comprehension of an increasingly needed new cybersecurity tool.Resource:<\/p>\n\n\n\n
Kiran Sridhar, Ming Ng, Hacking for good: Leveraging HackerOne data to develop an<\/p>\n\n\n\n
economic model of Bug Bounties, Journal of Cybersecurity<\/em>, Volume 7, Issue 1, 2021,<\/p>\n\n\n\n tyab007, https:\/\/doi.org\/10.1093\/cybsec\/tyab007<\/p>\n","protected":false},"excerpt":{"rendered":" As I was reading the article, I was fascinated, and had no idea about bug bounty policies or programs’ real effect at the business scale. I can understand why a lot of businesses are dubious about third-party companies reporting cybersecurity flaws and vulnerabilities. Nobody wants to get strangers into their own backyards and find out… <\/p>\n