Feeds

Bug bounty upstart thinks there's BIG MONEY in crowdtesting

They might be onto something by outsourcing it, though

Boost IT visibility and business value

Security startup CrowdCurity is marketing a cloud-based platform that allows businesses to set up and run their own bug bounty and security testing programmes.

Bug bounty programmes have become fairly commonplace across the IT industry over recent years. The schemes reward researchers for reporting flaws to vendors, rather than hawking them through exploit brokers or vulnerability marketplaces.

Google's bug bounties are probably the best known in the industry but many other vendors including Facebook and (most recently) Microsoft have launched comparable programmes. An extensive (but perhaps not exhaustive) list can be found here.

Jakob Storm, co-founder of CrowdCurity, told El Reg that despite these many schemes there was still an extensive market left unaddressed. He added that firms already running bug bounty programmes could benefit from outsourcing the day-to-day administration of the programme to CrowdCurity.

"Some vendors have already launched bug bounty programmes but compared with the total market this is a very small fraction," Storm explained via email. "Apart from this we have been in contact with some companies already doing their own bug bounty programmes, and for many of them it is a pain to: 1) set up the programme with terms etc, 2) pay the testers (these can come from all over the world) 3) attract enough testers (this is mainly for the smaller businesses), and 4) managing the incoming reports."

The Danish start-up is effectively offering a crowd-based penetration testing service. CrowdCurity's service offers to take care of payments to the testers, using Bitcoins and PayPal. Around 400 testers already signed up to CrowdCurity's scheme, a figure Storm said is growing. "We have a build in bug management system where it is easy to get an overview of what has been reported and what [received] feedback," he added.

Storm named Bugcrowd and Synack as CrowdCurity's most obvious competitors. "They however seem to target larger companies and have a slightly different approach, offering more on the consultancy side," he explained.

Storm acknowledged our point that some businesses would want to keep very tight control about knowledge about vulnerabilities in their platform and would therefore be loth to hand over the management of a bug bounty scheme to a third-party cloud-based service. However he argued that such companies are typically either "not very confident about there security level" or outfits such as banks charged with handling sensitive data.

"We have made some features that makes possible for companies to keep tight control - to an extent," Storm explained. "Companies can run their programmes in test/staging environment, so it will not effect the live processes, and they can choose to do a 'soft launch', where only one to three selected security testers are allowed access."

"This will make it more controlled and even if there are many vulnerabilities they will come in in a lower pace and fewer will know about them. But the test will not be as in-depth as one where the whole crowd has access," he added.

Banks should not shy away from vulnerability reward programmes just because of the nature of their business, Storm argued.

"Banks or similar should be careful, but the fact is they already are exposed. They can then choose to hope that they will find all vulnerabilities in-house or they can choose to also run a programme with high rewards, to make sure that IF a vulnerability is found, people have an incentive to report it instead of exploiting it," Storm said.

CrowdCurity's current client roster includes Bitcoin exchanges, that "fit the bill of companies with a lot to lose" and Bitcoin and merchant intermediaries. Apart from Bitcoin businesses, "we see a potential in to targeting established startups, small and medium sized businesses who find it to expensive to hire pentest/security consultants by the hour and want the benefits of running a bug bounty programme, but who do not have the resources like Google and Facebook to handle it in-house," Storm explained.

Other early clients include software-as-a-service firms within HR, logistics and CRM.

More details of how the scheme works can be found in a FAQ and video available on CrowdCurity's site here.

Businesses only pay out for the vulnerabilities they approve with rewards largely pitched between the $100-$1,000 bracket. CrowdCurity takes a 20 per cent service fee for each reward. This sort of incentive is not going to attract elite testers but it might well be of interest to Reg readers who not infrequently tell us about cross-site scripting and SQL injections flaws on websites.

Whether they get a reward or not would, of course, depend on whether the site involved is signed up to CrowdCurity's scheme. ®

The essential guide to IT transformation

More from The Register

next story
The Return of BSOD: Does ANYONE trust Microsoft patches?
Sysadmins, you're either fighting fires or seen as incompetents now
Microsoft: Azure isn't ready for biz-critical apps … yet
Microsoft will move its own IT to the cloud to avoid $200m server bill
Oracle reveals 32-core, 10 BEEELLION-transistor SPARC M7
New chip scales to 1024 cores, 8192 threads 64 TB RAM, at speeds over 3.6GHz
Docker kicks KVM's butt in IBM tests
Big Blue finds containers are speedy, but may not have much room to improve
US regulators OK sale of IBM's x86 server biz to Lenovo
Now all that remains is for gov't offices to ban the boxes
Gartner's Special Report: Should you believe the hype?
Enough hot air to carry a balloon to the Moon
Flash could be CHEAPER than SAS DISK? Come off it, NetApp
Stats analysis reckons we'll hit that point in just three years
Dell The Man shrieks: 'We've got a Bitcoin order, we've got a Bitcoin order'
$50k of PowerEdge servers? That'll be 85 coins in digi-dosh
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.