Bug Bounties Aren't Silver Bullet for Better Security: Report

Infosecurity Magazine | January 15, 2019

Many organizations may find they’re better off hiring pen testers and in-house security researchers directly than running bug bounty programs, according to new MIT research. The New Solutions for Cybersecurity paper features a surprising analysis of bug bounty programs in the chapter, Fixing a Hole: The Labor Market for Bugs. It studied 61 HackerOne bounty programs over 23 months — including those run for Twitter, Coinbase, Square and other big names — and one Facebook program over 45 months. It claimed that, contrary to industry hype, organizations running these programs don’t benefit from a large pool of white hats probing their products. Instead, an elite few produce the biggest volume and highest quality of bug reports across multiple products, earning the biggest slice of available rewards. It’s also claimed that even these elite “top 1%” ethical hackers can’t make a decent wage by Western standards.

Spotlight

Information security has evolved from an obscure topic of conversation among techies to a center-stage concern in the C-suite. Its influence is growing in every aspect of business. Budgets reflect greater weight on security; staffing and training show new distinctions; battling potential breaches is now a collaborative effort; and the cloud continues to create conversation.

Spotlight

Information security has evolved from an obscure topic of conversation among techies to a center-stage concern in the C-suite. Its influence is growing in every aspect of business. Budgets reflect greater weight on security; staffing and training show new distinctions; battling potential breaches is now a collaborative effort; and the cloud continues to create conversation.

Related News

DATA SECURITY

Palo Alto Networks and Deloitte Deepen Strategic Alliance

Palo Alto Networks | May 17, 2022

Palo Alto Networks and Deloitte announced today the advancement of their existing strategic partnership to provide managed security services to their shared U.S. clients, making Palo Alto Networks' leading cybersecurity technology portfolio accessible in Deloitte's outcome-based, managed offerings. Many businesses are turning to managed security service providers (MSSPs) and managed detection and response (MDR) providers to run and elevate high-impact cyber defensive capabilities employing modern technologies that assist in handling continually developing cyberthreats. "Our customers are asking for managed secure access service edge (SASE), cloud, and threat detection and response capabilities. By offering our innovative security solutions portfolio as a managed service through Deloitte, we're providing newly extended support to customers who want their cyber programs to truly enable their critical business initiatives." Prem Iyer, vice president, Global Systems Integrator Ecosystems for Palo Alto Networks Kieran Norton, Deloitte Risk & Financial Advisory infrastructure solution leader and principal, Deloitte & Touche LLP said that "We're advising our clients every day on how cybersecurity can help empower their strategic business priorities but building it all in-house can be challenging and costly. Together with Palo Alto Networks, we are able to advise, equip and operate security capabilities for organizations as they work to manage cyber threats with agility and resilience." Deloitte Cyber and Palo Alto Networks first announced their strategic alliance in July 2021, with the goal of providing comprehensive cybersecurity solutions to shared customers. Managed services will feature expanded solutions such as: Deloitte and Palo Alto Networks help companies move to a Zero Trust framework by combining cyber technology platforms and professional services. Deloitte's Cloud Security solution includes the industry's most complete Cloud Native Security Platform, Palo Alto Networks Prisma® Cloud, and CortexXSOAR. Palo Alto Networks' Prisma Cloud and Prisma Cloud Compute are part of Deloitte's OpenCloud, which is the management plane for Deloitte's Cloud Management Platform. Presently, 5G-native security from Deloitte and Palo Alto Networks includes 5G security blueprints, data, control, and cellular signaling domain integration, and network protection.

Read More

PLATFORM SECURITY

Axonius Adds Key Integrations with AWS

Axonius | July 25, 2022

Axonius, a cybersecurity asset management provider, today announced integrations with Amazon Macie, Amazon GuardDuty, and AWS SecurityHub while extending its Amazon Inspector functionality. These new integrations will help customers to better understand and manage vulnerabilities across their Amazon Web Services (AWS) infrastructure. By connecting to both AWS first-party and ISV-third party security solutions, Axonius provides comprehensive visibility and management of assets across AWS cloud, multi-cloud, and on-premises. The latest integrations provide the following capabilities: Identify Exposed Amazon S3 Buckets: Axonius fetches findings from Amazon Macie to help customers identify exposed Amazon S3 buckets to maintain data integrity and compliance. Detecting Malicious Activity & Compromised Security Controls: By integrating with Amazon GuardDuty, Axonius helps customers detect malicious activity to protect AWS accounts, workloads, and data and help them understand which assets have compensating security controls. Helping Meet Security Best Practices: With insights from AWS SecurityHub, customers can compare against correlated data to verify whether assets that don't meet best practice standards have a compensating security control. Comprehensive View of Cloud Security Posture: Axonius delivers a complete inventory of assets from more than 450 correlated data sources giving customers a comprehensive view of their cloud security, including vulnerability data from Amazon Inspector. "As companies continue to shift workloads to the cloud, they're also increasingly leveraging cloud provider-native security service offerings. "Yet customers are still exhausted by the highly-manual, slow, and error-prone processes that negatively impact their risk mitigation, threat management, and compliance. With Axonius and AWS, customers finally have a unified view of their assets while dramatically strengthening their security posture." Mark Daggett, Vice President of Worldwide Channels and Alliances at Axonius About Axonius Axonius is the cybersecurity asset management platform that gives organizations a comprehensive asset inventory, uncovers gaps, and automatically validates and enforces policies. Deployed in minutes, the Axonius cyber asset attack surface management (CAASM) solution integrates with hundreds of data sources to give customers the confidence to control complexity by mitigating threats, navigating risk, decreasing incidents, automating response actions, and informing business-level strategy. Cited as one of the fastest growing cybersecurity startups, with accolades from CNBC, Forbes, and Fortune, Axonius covers millions of devices for customers around the world.

Read More

SOFTWARE SECURITY

McGill and Partners Choose CyberCube for Cyber Risk Analytics

CyberCube | July 14, 2022

CyberCube, the provider of the world’s leading cyber risk analytics for the insurance industry, today announces that McGill and Partners, the specialist (re)insurance broker, is using its Portfolio Manager and Broking Manager cyber risk analytics platforms. Launched in 2019 by insurance veteran Steve McGill, McGill and Partners is rapidly growing to become a major force in the insurance and reinsurance market, quickly developing its offering in both cyber reinsurance and insurance. Today the firm has over 430 staff and offices in the UK, US, Bermuda and Ireland. The deal with CyberCube is part of McGill and Partners’ continued development of its cyber (re)insurance strategy. CyberCube’s Portfolio Manager is a scenario-based data-driven model that enables risk professionals to develop insights for their senior leadership and teams. Portfolio Manager stress tests portfolios of insurance and reinsurance risks against a range of systemic cyber-related scenarios including data breaches, cloud outages, global ransomware attacks and financial fraud. Broking Manager is the first software-as-a-service application CyberCube has built specifically for the insurance broking community. It offers a streamlined approach to analyzing potential financial exposure impacts arising from cyber events that helps clients make informed decisions on coverages and limits. “We are excited to be working with the team at McGill and Partners and be part of the company’s cyber (re)insurance growth strategy on both the direct insurance side via Broking Manager and on its reinsurance side via Portfolio Manager.” Alejandra Donoso, CyberCube’s Principal Client Account Manager Neil Sharma, Partner – Reinsurance at McGill and Partner, said: “We are looking to bring all stakeholders in the cyber value chain together; collaborating between our insurance and reinsurance teams and partnering with CyberCube’s platforms which help deepen our understanding of the risks allowing us to provide best-in-class solutions to our clients.” About CyberCube CyberCube delivers the world’s leading cyber risk analytics for the insurance industry. With best-in-class data access and advanced multi-disciplinary analytics, the company’s cloud-based platform helps insurance organizations make better decisions when placing insurance, underwriting cyber risk and managing cyber risk aggregation.

Read More