Feeds

Bug bounty upstart thinks there's BIG MONEY in crowdtesting

They might be onto something by outsourcing it, though

Designing a Defense for Mobile Applications

Security startup CrowdCurity is marketing a cloud-based platform that allows businesses to set up and run their own bug bounty and security testing programmes.

Bug bounty programmes have become fairly commonplace across the IT industry over recent years. The schemes reward researchers for reporting flaws to vendors, rather than hawking them through exploit brokers or vulnerability marketplaces.

Google's bug bounties are probably the best known in the industry but many other vendors including Facebook and (most recently) Microsoft have launched comparable programmes. An extensive (but perhaps not exhaustive) list can be found here.

Jakob Storm, co-founder of CrowdCurity, told El Reg that despite these many schemes there was still an extensive market left unaddressed. He added that firms already running bug bounty programmes could benefit from outsourcing the day-to-day administration of the programme to CrowdCurity.

"Some vendors have already launched bug bounty programmes but compared with the total market this is a very small fraction," Storm explained via email. "Apart from this we have been in contact with some companies already doing their own bug bounty programmes, and for many of them it is a pain to: 1) set up the programme with terms etc, 2) pay the testers (these can come from all over the world) 3) attract enough testers (this is mainly for the smaller businesses), and 4) managing the incoming reports."

The Danish start-up is effectively offering a crowd-based penetration testing service. CrowdCurity's service offers to take care of payments to the testers, using Bitcoins and PayPal. Around 400 testers already signed up to CrowdCurity's scheme, a figure Storm said is growing. "We have a build in bug management system where it is easy to get an overview of what has been reported and what [received] feedback," he added.

Storm named Bugcrowd and Synack as CrowdCurity's most obvious competitors. "They however seem to target larger companies and have a slightly different approach, offering more on the consultancy side," he explained.

Storm acknowledged our point that some businesses would want to keep very tight control about knowledge about vulnerabilities in their platform and would therefore be loth to hand over the management of a bug bounty scheme to a third-party cloud-based service. However he argued that such companies are typically either "not very confident about there security level" or outfits such as banks charged with handling sensitive data.

"We have made some features that makes possible for companies to keep tight control - to an extent," Storm explained. "Companies can run their programmes in test/staging environment, so it will not effect the live processes, and they can choose to do a 'soft launch', where only one to three selected security testers are allowed access."

"This will make it more controlled and even if there are many vulnerabilities they will come in in a lower pace and fewer will know about them. But the test will not be as in-depth as one where the whole crowd has access," he added.

Banks should not shy away from vulnerability reward programmes just because of the nature of their business, Storm argued.

"Banks or similar should be careful, but the fact is they already are exposed. They can then choose to hope that they will find all vulnerabilities in-house or they can choose to also run a programme with high rewards, to make sure that IF a vulnerability is found, people have an incentive to report it instead of exploiting it," Storm said.

CrowdCurity's current client roster includes Bitcoin exchanges, that "fit the bill of companies with a lot to lose" and Bitcoin and merchant intermediaries. Apart from Bitcoin businesses, "we see a potential in to targeting established startups, small and medium sized businesses who find it to expensive to hire pentest/security consultants by the hour and want the benefits of running a bug bounty programme, but who do not have the resources like Google and Facebook to handle it in-house," Storm explained.

Other early clients include software-as-a-service firms within HR, logistics and CRM.

More details of how the scheme works can be found in a FAQ and video available on CrowdCurity's site here.

Businesses only pay out for the vulnerabilities they approve with rewards largely pitched between the $100-$1,000 bracket. CrowdCurity takes a 20 per cent service fee for each reward. This sort of incentive is not going to attract elite testers but it might well be of interest to Reg readers who not infrequently tell us about cross-site scripting and SQL injections flaws on websites.

Whether they get a reward or not would, of course, depend on whether the site involved is signed up to CrowdCurity's scheme. ®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
Apple fanbois SCREAM as update BRICKS their Macbook Airs
Ragegasm spills over as firmware upgrade kills machines
Attack of the clones: Oracle's latest Red Hat Linux lookalike arrives
Oracle's Linux boss says Larry's Linux isn't just for Oracle apps anymore
THUD! WD plonks down SIX TERABYTE 'consumer NAS' fatboy
Now that's a LOT of porn or pirated movies. Or, you know, other consumer stuff
EU's top data cops to meet Google, Microsoft et al over 'right to be forgotten'
Plan to hammer out 'coherent' guidelines. Good luck chaps!
US judge: YES, cops or feds so can slurp an ENTIRE Gmail account
Crooks don't have folders labelled 'drug records', opines NY beak
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
FLAPE – the next BIG THING in storage
Find cold data with flash, transmit it from tape
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.