Bug bounty programs \u2013 in which an agency or organization lets freelance hackers test their systems and report vulnerabilities for cash \u2013 are becoming all the rage in the public sector. Beginning with the Defense Department\u2019s Hack the Pentagon program to the IRS\u2019s managed crowdsource approach to the General Services Administration\u2019s 18F standing up a software-as-a-service platform, the trend is spreading.<\/p>\n\n\n\n
But, as with every new thing, there is a learning curve. During the 2017 Black Hat conference in Las Vegas, bug bounty program managers with three major companies \u2013 Indeed, Salesforce and Silent Circle \u2013 offered some advice to organizations standing up a program for the first time.<\/p>\n\n\n\n
Be Social<\/b><\/p>\n\n\n\n
While the financial incentives are typically what define bug bounty programs, participants are rarely just in it for the money.<\/p>\n\n\n\n
\u201cIt\u2019s super important to go out into the community and find out what motivates them,\u201d said Lori Rangel, director of product management for Silent Circle.<\/p>\n\n\n\n
\u201cOne of the biggest challenges is understanding the value of a vulnerability,\u201d she said. \u201cMy initial thought was that the dollar amount \u2013 the payout for a bounty \u2013 was the most important thing to the user community. [Now I\u2019m] understanding the differences between a dollar value and reputation value.\u201d<\/p>\n\n\n\n
For many researchers in the bounty community, the prestige of finding a well-hidden flaw can be as important as the bounty itself, as reputation can lead to more opportunities in the future.<\/p>\n\n\n\n
\u201cFind out what their concerns are,\u201d Rangel added. \u201cThat really builds your reputation, as well.\u201d<\/p>\n\n\n\n
Be Human<\/b><\/p>\n\n\n\n
Charles Valentine, vice president of technology services for the jobs website Indeed, pointed out that these are individuals, not companies you\u2019ll be dealing with.<\/p>\n\n\n\n
\u201cThis is not a business you\u2019re talking with; it\u2019s an individual,\u201d he said. \u201cSo having somebody in place who has really good customer service skills to be able to communicate with that external person and bring it to a human level. So, not acting like a corporation. The communication should not be filtered by a legal department; it should be a human-to-human communication.\u201d<\/p>\n\n\n\n
Another important note: \u201cIn many cases \u2026 English is probably not their first language,\u201d so be prepared.<\/p>\n\n\n\n
Be Mature<\/b><\/p>\n\n\n\n
Finally, if your internal security team isn\u2019t equipped to remediate the bugs as they are discovered, what\u2019s the point?<\/p>\n\n\n\n
\u201cOne of the key things you need to have is a very mature OpSec practice,\u201d said Angelo Prado, senior product security manager for Salesforce. \u201cYou need to have a very mature set of individuals who are able to understand risk, impact and are able to fix any vulnerabilities that come your way. Because, without that, you\u2019re doing yourself a disservice. If you don\u2019t have strong application security engineers, your program is not going to be successful.\u201d<\/p>\n\n\n\n
During the 2017 Black Hat conference in Las Vegas, bug bounty program managers with three major companies \u2013 Indeed, Salesforce and Silent Circle \u2013 offered some advice to organizations standing up a program for the first time.<\/p>\n","protected":false},"author":7,"featured_media":45760,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[106,33],"tags":[],"coauthors":[2349],"class_list":["post-31888","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"SJ4PGLSP7NHSNHPR62UX6F4TQE","arc_canonical_url":"\/workforce\/education-training\/2017\/07\/27\/3-tips-for-starting-bug-bounty-programs-be-social-be-human-be-mature-black-hat-2017\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n