3 ms·

Even if you spend 10x in Manpower what you spend in bounties, it's still a pittance compared to the cost and negative publicity of one incident per year. And th

Even if you spend 10x in Manpower what you spend in bounties, it's still a pittance compared to the cost and negative publicity of one incident per year. And those engineers are not going to be completely useless, either; They're going to be fixing bugs, finding rough spots, etc, while they investigate those reports.

dsacco 12y ago
This is a strong perhaps. It is obviously dangerous to try to estimate a lower bound for negative publicity related to security, but it is also less obviously dangerous to refrain from estimating an upper bound (or at least attempting to do so). It is fiscally irresponsible to invest too little in security or too much in security. Software security is a nonalgorithmic problem, and the best you can do is risk management. Look at it this way: if you spent 300 engineering hours a month investigating spurious reports and the only valid reports you ever received were for cross-site request forgery attacks on non-sensitive profile actions, it does not matter what the ivory tower ideal of the bug bounty was, you wasted resources. "Given enough eyeballs, all bugs are shallow" is like the worst case scenario for an algorithm. Sure, it works, but at what cost? What if you had an internal team penetration testing everything and a private bug bounty program? What if you exclusively outsource to NCC Group or Accuvant? There is no hard absolute in this. It's generally good to have a bug bounty program, but you really need to be aware of the numbers. For example, Yahoo actually reduced the payments they were giving in bounties for the same vulnerabilities at the same severity because they did not anticipate how many would be found of that type.
blazespin 12y ago
Yes, investigating reports is not a sunk cost. Security engineering is all about doing code reviews, which is what this is. There are also ways to optimize which reports you take seriously. The real reason bug bounties are not in place is mostly a combination of insecurity and arrogance.

dsacco 12y ago

This is a strong perhaps. It is obviously dangerous to try to estimate a lower bound for negative publicity related to security, but it is also less obviously dangerous to refrain from estimating an upper bound (or at least attempting to do so). It is fiscally irresponsible to invest too little in security or too much in security. Software security is a nonalgorithmic problem, and the best you can do is risk management. Look at it this way: if you spent 300 engineering hours a month investigating spurious reports and the only valid reports you ever received were for cross-site request forgery attacks on non-sensitive profile actions, it does not matter what the ivory tower ideal of the bug bounty was, you wasted resources. "Given enough eyeballs, all bugs are shallow" is like the worst case scenario for an algorithm. Sure, it works, but at what cost? What if you had an internal team penetration testing everything and a private bug bounty program? What if you exclusively outsource to NCC Group or Accuvant? There is no hard absolute in this. It's generally good to have a bug bounty program, but you really need to be aware of the numbers. For example, Yahoo actually reduced the payments they were giving in bounties for the same vulnerabilities at the same severity because they did not anticipate how many would be found of that type.

blazespin 12y ago

Yes, investigating reports is not a sunk cost. Security engineering is all about doing code reviews, which is what this is. There are also ways to optimize which reports you take seriously. The real reason bug bounties are not in place is mostly a combination of insecurity and arrogance.