Veracode Studies the Effectiveness of Bug Bounty Programs
Feb 01, 2013 (Close-Up Media via COMTEX) --
Veracode, Inc., a company focusing on cloud-based application security testing, has released an infographic that examines the success of bug bounty programs.
According to a release, the past decade has witnessed major growth in demand for bug hunters, with online giants such as Google, Mozilla, Facebook, and PayPal turning to bug bounty programs to improve the security of their products. Organizations are currently paying security researchers anywhere from hundreds to tens of thousands of dollars per vulnerability; however, this approach still leaves many applications vulnerable to attacks.
Veracode's infographic, titled "Can Bug Hunters Keep the Internet Safe " takes a look at which companies are relying on bounty programs for security findings, and compares market rates for discovering and reporting different types of vulnerabilities. In addition to paid bounty programs, the infographic details which companies have implemented unpaid bug hunting or responsible disclosure programs.
The infographic uses data from Veracode scans to demonstrate the current state of security in vendor-supplied web applications and concludes with Veracode's recommendations for creating effective vendor application security testing programs.
"The fact that we're seeing all of these bug bounty programs shows that more organizations are getting serious about security, which is a positive sign." said Chris Eng, vice president of research, Veracode. "But implementing a bounty program is only one step towards creating a comprehensive security program."
Veracode recommends developing a programmatic approach to vendor software security that is built on thorough policies, open communication, vendor education, and collaboration between vendors and enterprises.
((Comments on this story may be sent to firstname.lastname@example.org))
[ Back To TMCnet.com's Homepage ]