Researchers Find Bug Bounty Programs Pay Economic Rewards

TheKid7 · Jul 11, 2013

Researchers Find Bug Bounty Programs Pay Economic Rewards:

Bug bounty programs can be as much as 100 times more cost-effective for finding security vulnerabilities than hiring full-time security researchers to do the same thing. New research from the University of California at Berkeley, which focused on bug bounty programs run by Google and Mozilla, found that each of these programs has cost the vendor about $400,000 over the course of three years, far less than it would’ve cost to hire employees to find the same number of vulnerabilities.

Bug bounty programs have been increasing in popularity among vendors for the last few years as security researchers have shown a willingness to report their bugs directly to the vendors in return for guaranteed payouts. The prices that vendors will pay for vulnerabilities varies widely, from a few hundred dollars to tens of thousands of dollars, depending on the severity of the bug and which vendor is involved. Google tends to pay the largest rewards, often in the range of $3,000 to $5,000, and sometimes as high as $20,000. If you include the company’s Pwnium contest at security conferences, some of its rewards can reach $150,000 for serious Chrome vulnerabilities...........
Click to expand...

http://threatpost.com/researchers-find-bug-bounty-programs-pay-economic-rewards/101243

siljaline · Jul 13, 2013

Microsoft to pay first IE 11 Preview bug bounty to BlueHat security contest finalist.

Microsoft has already received several vulnerability reports that qualify for monetary rewards as part of the company's bug bounty program launched in June for the preview version of Internet Explorer 11.

The recipient of the first IE 11 bounty will be Ivan Fratric, a security researcher who earned second place and US$50,000 last year in Microsoft's BlueHat Prize contest for the development of defensive technologies. Fratric's entry into the contest was a system called ROPGuard, which can detect and prevent return-oriented programming (ROP) attacks.
Click to expand...

http://www.cso.com.au/article/52072...bug_bounty_bluehat_security_contest_finalist/

siljaline · Jul 13, 2013

“Bug bounties” are cheap way to keep companies secure, Berkeley study finds. http://www.welivesecurity.com/2013/...o-keep-companies-secure-berkeley-study-finds/

TheKid7 · Aug 14, 2013

After Paying $2M in Rewards, Google Multiplies Some Bug Bounties Five Times:

Google’s bug bounty program has been one of the more successful reward systems of its kind, and the company has regularly modified and expanded the program over the years to keep pace with what’s going on in the industry. Google also has increased the rewards it offers for certain kinds of vulnerabilities several times, and the company is doing it again, raising the lower reward level from $1,000 to $5,000...........
Click to expand...

http://threatpost.com/after-paying-...ultiplies-some-bug-bounties-five-times/101973

Log in or Sign up

Researchers Find Bug Bounty Programs Pay Economic Rewards

TheKid7 Registered Member

siljaline Registered Member

siljaline Registered Member

TheKid7 Registered Member

Log in or Sign up

Researchers Find Bug Bounty Programs Pay Economic Rewards

TheKid7 Registered Member

siljaline Registered Member

siljaline Registered Member

TheKid7 Registered Member

Useful Searches