Feeds

Bug bounty upstart thinks there's BIG MONEY in crowdtesting

They might be onto something by outsourcing it, though

Securing Web Applications Made Simple and Scalable

Security startup CrowdCurity is marketing a cloud-based platform that allows businesses to set up and run their own bug bounty and security testing programmes.

Bug bounty programmes have become fairly commonplace across the IT industry over recent years. The schemes reward researchers for reporting flaws to vendors, rather than hawking them through exploit brokers or vulnerability marketplaces.

Google's bug bounties are probably the best known in the industry but many other vendors including Facebook and (most recently) Microsoft have launched comparable programmes. An extensive (but perhaps not exhaustive) list can be found here.

Jakob Storm, co-founder of CrowdCurity, told El Reg that despite these many schemes there was still an extensive market left unaddressed. He added that firms already running bug bounty programmes could benefit from outsourcing the day-to-day administration of the programme to CrowdCurity.

"Some vendors have already launched bug bounty programmes but compared with the total market this is a very small fraction," Storm explained via email. "Apart from this we have been in contact with some companies already doing their own bug bounty programmes, and for many of them it is a pain to: 1) set up the programme with terms etc, 2) pay the testers (these can come from all over the world) 3) attract enough testers (this is mainly for the smaller businesses), and 4) managing the incoming reports."

The Danish start-up is effectively offering a crowd-based penetration testing service. CrowdCurity's service offers to take care of payments to the testers, using Bitcoins and PayPal. Around 400 testers already signed up to CrowdCurity's scheme, a figure Storm said is growing. "We have a build in bug management system where it is easy to get an overview of what has been reported and what [received] feedback," he added.

Storm named Bugcrowd and Synack as CrowdCurity's most obvious competitors. "They however seem to target larger companies and have a slightly different approach, offering more on the consultancy side," he explained.

Storm acknowledged our point that some businesses would want to keep very tight control about knowledge about vulnerabilities in their platform and would therefore be loth to hand over the management of a bug bounty scheme to a third-party cloud-based service. However he argued that such companies are typically either "not very confident about there security level" or outfits such as banks charged with handling sensitive data.

"We have made some features that makes possible for companies to keep tight control - to an extent," Storm explained. "Companies can run their programmes in test/staging environment, so it will not effect the live processes, and they can choose to do a 'soft launch', where only one to three selected security testers are allowed access."

"This will make it more controlled and even if there are many vulnerabilities they will come in in a lower pace and fewer will know about them. But the test will not be as in-depth as one where the whole crowd has access," he added.

Banks should not shy away from vulnerability reward programmes just because of the nature of their business, Storm argued.

"Banks or similar should be careful, but the fact is they already are exposed. They can then choose to hope that they will find all vulnerabilities in-house or they can choose to also run a programme with high rewards, to make sure that IF a vulnerability is found, people have an incentive to report it instead of exploiting it," Storm said.

CrowdCurity's current client roster includes Bitcoin exchanges, that "fit the bill of companies with a lot to lose" and Bitcoin and merchant intermediaries. Apart from Bitcoin businesses, "we see a potential in to targeting established startups, small and medium sized businesses who find it to expensive to hire pentest/security consultants by the hour and want the benefits of running a bug bounty programme, but who do not have the resources like Google and Facebook to handle it in-house," Storm explained.

Other early clients include software-as-a-service firms within HR, logistics and CRM.

More details of how the scheme works can be found in a FAQ and video available on CrowdCurity's site here.

Businesses only pay out for the vulnerabilities they approve with rewards largely pitched between the $100-$1,000 bracket. CrowdCurity takes a 20 per cent service fee for each reward. This sort of incentive is not going to attract elite testers but it might well be of interest to Reg readers who not infrequently tell us about cross-site scripting and SQL injections flaws on websites.

Whether they get a reward or not would, of course, depend on whether the site involved is signed up to CrowdCurity's scheme. ®

The Essential Guide to IT Transformation

More from The Register

next story
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
EU's top data cops to meet Google, Microsoft et al over 'right to be forgotten'
Plan to hammer out 'coherent' guidelines. Good luck chaps!
US judge: YES, cops or feds so can slurp an ENTIRE Gmail account
Crooks don't have folders labelled 'drug records', opines NY beak
FLAPE – the next BIG THING in storage
Find cold data with flash, transmit it from tape
Seagate chances ARM with NAS boxes for the SOHO crowd
There's an Atom-powered offering, too
Gartner: To the right, to the right – biz sync firms who've won in a box to the right...
Magic quadrant: Top marks for, er, completeness of vision, EMC
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.