Submitted by: Shivyanshi Shukla

Bug bounty, a big name among cybersecurity analysts and tech giants, has gained tremendous fame over time. This article will help you know the reason behind the exponential rise in the popularity of bug bounty programs. But before I take you to the beating heart of the action, for those of you who are not aware of bug bounty let me brief you and make it a cakewalk for you.

What is Bug Bounty?

In layman’s language, the term bug bounty can be explained as a reward offered to an individual who successfully identifies vulnerabilities and/or errors in a computer program or system. Bug bounty programs happen to be deals offered by websites, organisations and software companies to promote individuals related to information security and cybersecurity to report bugs that pose a threat of breach in the security of the program. The organisations offer cash rewards along with recognition to the people who are successful in reporting bugs and vulnerabilities that exploit security.

If an analyst or ethical hacker brings to light the bugs, they are required to submit a report to the respective organisation via platforms like HackerOne. The organisation then along with the individual works on the vulnerability to validate it and hence continues to patch it.

Now that we have gotten rid of the monkey on the back, let us now learn about the reasons why bug bounty is trending and sought after by multinational organisations. Bug Bounty programs are becoming increasingly popular programs among the giants for finding security bugs. Organisations like Google, Facebook, Yahoo, PayPal, Microsoft, Reddit and many others promote bug bounty programs to find bugs that pose a threat to these giants by creating loopholes for the hackers.

History

The Bug Bounty program was initiated in 1983 by Hunter and Ready for their Versatile Real-Time Executive operating system. As a reward, the person who reported a bug would get a Volkswagen Beetle.

Then in 1995, Netscape launched the Bug Bounty program for reporting security bugs in Netscape Navigator 2.0 Beta. Those who were able to find bugs were offered cash rewards by Netscape. This program was started to produce the highest quality by promoting an extensive search for identifying the bugs as quickly as possible.

Furthermore, in 2004 the Mozilla Firefox launched its Bug Bounty program which offered $500 as a reward for identifying and reporting critical vulnerabilities in Firefox. In 2010, Google initiated Bug Bounty for web applications.

This was followed by the Facebook Whitehat program in the year 2011, it awarded $500 for reporting bugs and vulnerabilities. Both Google and Facebook Bug Bounty program continues to date and openly welcomes security and non-security analysts to find bugs about security.

Reasons for The Popularity of Bug Bounty Programs

Vulnerability Detection

Bug Bounty programs help organisations in the identification of vulnerabilities and exceptions found in the application, followed by the process of fixing. This helps them to fix the bugs before they are discovered by the cyber con-mans which in turn lessens the impact on the organisation. Bug Bounty programs increase the probability of identifying vulnerabilities before a threat turns into an attack.

Cost-Effectiveness

Cost savings play an instrumental role in the popularity of Bug Bounty programs. The leading factor for it is that paying individuals for the discovery of the vulnerability is much cheaper than the price an organisation has to pay for a data breach or a cyber-attack.

The benefit of the Bug Bounty program is that the amount to be paid as bounties to the pupils coming up with bugs in the applications of the organisation, even the highest bounty paid is cheaper than the money to be paid to in-house pen-testers or contractors for the same task of finding security bugs. The money is only paid to the analysts or ethical hackers if they are successful in finding bugs whereas, in the case of contractors and in-house pen-testers, the money is to be paid irrespective of the fact whether or not a vulnerability is discovered. In some cases, organisations have to pay the contractors on an hourly basis which is not the case with Bug Bounty programs. In Bug Bounty programs, the amount of bounty to be paid is proportional to the severity of the security bug found.

Easier Talent Hunt

Bug Bounty programs provide an extensive platform for people to showcase their talents and earn bounties and recognition. It provides organisations the access to talents that remain unnoticed and unreachable. The participating individuals range from amateur analysts to highly skilled and specialised bug identifiers.

Organisations are benefitted from these programs, as a bulk of vulnerability hunters are provided to them without having to recruit them as a part of the organisation. Programs such as the Facebook Whitehat program and google bug bounty, attract thousands of ethical hackers to contribute to the search of security bugs in web applications. With a Bug Bounty program, bug hunters with a great range of skills are made available for penetration testing and vulnerability scan.

Promotion of Information security culture

As the tech giants like Facebook, Google, Yahoo, etc now promote Bug Bounty programs, it has created an aura of openness towards the open-source community and also the information security practices. The bug bounty programs attract millions of ethical hackers each year, in the quest for searching bugs and getting paid higher rewards. This in turn has created awareness among the people about cyber threats and attacks that can be prevented if the loopholes are discovered before they fall prey to cybercriminals and is fixed and patched ahead of a major data breach that can cause monetary loss to organisations. People are welcomed from all over the world, to contribute to the hunt and emerge out victorious.

CONCLUSION

The aforementioned reasons and many more contribute to the prevailing and everlasting reputation of Bug Bounty programs in the cyberworld. In the year 2020, we saw an exponential rise in cybercrimes due to the loopholes prevalent that went unnoticed. According to a report by the FBI and Crime Complaint Centre, cybercrime had hit an all-time high.  A total of 791,790 cases were reported in 2020.

Since the pandemic has hit the entire world, the epochal shift to the online paradigm has made it of utmost importance to do away with security bugs.  Bug Bounty programs have proved to be fruitful in the discovery and fixture of the bugs to help prevent future threats. It has attracted thousands of ethical hackers and penetration testers to enhance their skills. However, not romanticising the idea of a bounty, it surely has its own shortcomings. The bug bounty program needs to be analysed and verified before it is successfully declared that a bug has been discovered. In addition to this, the hackers are paid handsome amount if the scope is not defined properly. Thus, it requires a well-defined scope to make a bug bounty program successful, and save an ugly negotiation with the vulnerability detector.

 Submitted by WiCyS member, Shivyanshi Shukla

Bio: “Hello all, I am a cybersecurity enthusiast and a beginner exploring the vast cyber space. I currently am a student, sophomore year; learning and discovering new arenas each day”