Operating a bug bounty program may seem intimidating to a
newcomer, but the reality is even a smaller firm can successfully create and
run one with the end result being a stronger and safer product.Adam Ruddermann, practice director, bug bounty services for
NCC Security, in a talk at what was part of the inaugural bug bounty summit
held at Black Hat gave a run down on some of the basics that an organization
needs to have in place to have a functional program. The most important and
first step that needs to be taken is dispensing with some of the basic fears
associated with actively recruiting people to find flaws in a product or
service. Adam Ruddermann This particularly comes to light when a severe problem is
disclosed and finds its way into the news. Ruddermann said many companies worry
about what the world at large will think.
“Bug bounties are opportunities, not risks. It is a time
when you can demonstrate an organizations commitment to improve and make the
internet safer,” he said.However, before this point is reached there are several structures that need to be put in place by the company.First is deciding whether or not to make it a public or private bug bounty program and how to integrate it into a regular vulnerability disclosure program (VDP). Ruddermann said a bug bounty program and a VDP have many similarities, but are really two different animals with the latter having a monetary incentive attached.For most companies a public program will work fine, but a
private set up, which entails reaching out to a specific group of researchers,
can be better for testing a specific piece of software. The goals and scope of
the program must also be set with some opting for a limited run program for a
certain project or to simply leave it broad and open ended.Once the decision is made to move forward a channel has to
be created for bounty hunters to contact the company with their findings.
Ruddermann said this can range from posting an email address to having a submission
form online.Other factors that have to be taken into consideration once
bugs are being reported is how to deal with them internally. People have to be
assigned to accept the finding, prove it is truly an issue, triage and then fix
the issue and finally push it through to be resolved.While these steps are being taken, it’s important for the
company not to lose touch with the hunter. Rudermann pointed out how vulnerable
these people can feel as the bug they found percolates through a company’s
system. He believes regular communications with the finders is extremely important
and could stop them from going public with the bug they found before the
company is ready.This communication can be as simple as a form email that
just notifies the hunter that they have not been forgotten and that the company
will be in contact with them shortly. Also, letting the person know it’s ok for
them to get in contact with the company to discuss any fears.
