Ministry of Defence (MoD) launches bug bounty programme

guest · Dec 10, 2020

MoD launches bug bounty programme
December 10, 2020
https://www.itpro.co.uk/security/358083/mod-launches-bug-bounty-programme

The Ministry of Defence (MoD) has introduced its own bug bounty programme through which white hat hackers can disclose vulnerabilities to the UK government department without fear of prosecution.

Partnering up with HackerOne, the MoD has published a submission form that security researchers can use to report any bugs or flaws with systems or platforms managed by the UK’s defence authorities. Unlike bug bounty programmes commonly run by private companies, however, there is no monetary reward available for disclosure.

“If you believe you have found a vulnerability on any MOD system, you can report using the Hacker One: submit a vulnerability report,” the MoD said.
Click to expand...

The MoD will then report back when the vulnerability is fixed, with researchers invited to confirm the solution fixes the problem adequate. Future public disclosure arrangements will then be subject to co-ordination between researchers and the MoD.
Researchers seeking to report a vulnerability must abide by a set of strict protocols, however.
Click to expand...

The MoD claims its policy is compatible with common industry-wide vulnerability disclosure practices, and that it does not give white hat hackers or security researchers permission to act in any way that’s inconsistent with the law.

The government department will not, however, seek prosecution of any researcher who reports vulnerabilities on MoD services or systems where they’ve acted in good faith and in accordance with the disclosure policy.
Click to expand...

GOV.UK: Report a vulnerability on an MOD system

Guidance on how to report a security vulnerability on any Ministry of Defence service or system, such as the websites of the Royal Air Force, British Army and Royal Navy.
Click to expand...

guest · Aug 7, 2021

MoD Boosts Cyber-Resilience with Ethical Hacker Project
August 4, 2021
https://www.infosecurity-magazine.com/news/mod-ethical-hacker-project/

The UK’s Ministry of Defence (MoD) has just completed a 30-day bug bounty challenge which opened its systems to probing by ethical hackers.

This is the first initiative of its kind the MoD has run and it claimed the exercise had been “extremely valuable” in helping to find and remediate vulnerabilities across the department’s networks and 750,000 devices.
The MoD said it will continue to run bug bounty programs alongside other initiatives to boost cyber-resilience and share any relevant lessons learned with the government.
Click to expand...

MoD CISO, Christine Maxwell, argued that the initiative is part of the department’s commitment to transparency and security-by-design principles.

“It is important for us to continue to push the boundaries with our digital and cyber development to attract personnel with skills, energy and commitment. Working with the ethical hacking community allows us to build out our bench of tech talent and bring more diverse perspectives to protect and defend our assets,” she added.
“Understanding where our vulnerabilities are and working with the wider ethical hacking community to identify and fix them is an essential step in reducing cyber risk and improving resilience.”

The project was run by US firm HackerOne, which has also contributed to the Hack the Pentagon initiative over the past few years.
Click to expand...

GOV.UK: Ethical hackers collaborate with Defence to strengthen cyber security

In a first for the Ministry of Defence, 26 ethical hackers have taken part in a Bug Bounty programme in collaboration with US based organisation HackerOne. The 30-day challenge aimed to identify and fix vulnerabilities in cyber systems to strengthen Defence’s security and to ensure better resilience.
Click to expand...

Log in or Sign up

Ministry of Defence (MoD) launches bug bounty programme

guest Guest

guest Guest

Log in or Sign up

Ministry of Defence (MoD) launches bug bounty programme

guest Guest

guest Guest

Useful Searches