The Department of Defense has been lauded as the first agency in the federal government to institute a bug bounty program. While limited in scope as compared to private-sector programs, Hack the Pentagon, as it\u2019s known, sought to invite vetted hackers into its doors with the aim of discovering vulnerabilities within their websites and systems.<\/p>\n\n\n\n
Since then, many security experts have expressed the need for similar programs to take place within the other federal agencies.<\/p>\n\n\n\n
Mike Chung, who helped run Hack the Pentagon for DoD within the Defense Digital Service, now works at Bugcrowd, a vulnerability assessment company and is looking for more federal agencies to institute bug bounty programs. He talked to Fifth Domain about the challenges of wide-scale government adoption.<\/p>\n\n\n\n
Fifth Domain<\/b>: What are the obstacles to bringing bug bounty programs to other agencies and the larger federal government?<\/i><\/p>\n\n\n\n
Mike Chung<\/b>: The idea of running bug bounty programs is still new in the federal space. During my time running Hack the Pentagon, we learned a lot about how to better implement these programs at other agencies and organizations. Initial challenges faced concerned the comfort level of bringing in outside researchers to evaluate applications and systems for exploits, but that isn\u2019t as much of a concern anymore. With new exploits surfacing every day, most organizations are constrained by a lack of resources. Leveraging a crowd of researchers is an effective approach that every agency should turn to.<\/p>\n\n\n\n
Fifth Domain<\/b>: What lessons can be learned from the Hack the Pentagon program and associated bug bounties with the services?<\/i><\/p>\n\n\n\n
Chung<\/b>: Partnering with premier vendors that provide valuable services and products can help agencies scale their security needs. There are not enough resources for an agency to do this alone. The economics make sense. Cost is a factor when selecting a vendor, and can be something that wasn\u2019t taken into consideration when initial contracts were set up. Also, not all contractors are created equal and it\u2019s important to understand what you\u2019re paying for and how the bounties are laid out.<\/p>\n\n\n\n
Fifth Domain<\/b>: How important to overall security is instituting a bug bounty program within other federal agencies?<\/i><\/p>\n\n\n\n
Chung<\/b>: It\u2019s a must. I would also recommend implementing a continuous vulnerability disclosure program (VDP) to get the full breadth of assessing exploits and vulnerabilities. Programs like these have been around a few years in the private sector and it\u2019s absolutely necessary for federal agencies to have these programs in place. It\u2019s not a major investment compared to other security services out there, and it\u2019s important to leverage the knowledge of professional researchers to reduce the damage done by enemy hackers today.<\/p>\n","protected":false},"excerpt":{"rendered":"
A leader from the Hack the Pentagon bug bounty program describes the challenges associated with bringing bug bounties to the rest of the federal government.<\/p>\n","protected":false},"author":7,"featured_media":45760,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":16,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[10,16],"tags":[],"coauthors":[3268],"class_list":["post-17221","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber","category-it-networks"],"acf":{"subheadline":"","legacy_arc_id":"NFMWFK7ZURFAPJRJAK2YPI54RM","arc_canonical_url":"\/civilian\/2018\/01\/09\/why-more-agencies-arent-starting-bug-bounty-programs\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n