Silicon Valley is not quite the “Wild Wild West” anymore; we are technologically evolved, we have systems of checks-and-balances in place, we generally have rules and regulations governing our actions…or do we?
A number of high-profile companies have recently taken what some might consider the rather drastic step to mitigate or prevent the ever-increasing threat of software bugs, malware, ransomware, any type of malicious hacking that can easily ruin the reputation of a company, as well as putting company, consumer and client data at risk. They are calling in the “white hats,” the “ethical hackers,” (or, in keeping with our western theme here, and since there’s often a reward associated with the process), they’re calling in the “bug bounty hunters.”
The phenomenon is not restricted to Silicon Valley…oh no, it has gone global, because this is truly a world-wide issue. Many companies deem it a worthwhile investment to offer as much as thousands of dollars to hunt down bugs, malware, any glaring security gaps in general, in their systems, websites, public platforms and more.
Yelp is the latest high-profile company to publicly put up a “Wanted” poster. The successful review site announced this week that, with the help of HackerOne, it has put together a bounty program which offers $15,000 for the most serious vulnerability risks that white hats can find. Apple and Microsoft are two other large-scale players in the game, with some bounties going as high as $200,000, depending on the nature of the vulnerability discovered.
In this age of weekly — almost daily — security breaches potentially affecting millions of customers, is it any wonder that companies are taking any and all measures available to them to solve their vulnerability issues?
There are alternatives, however, to creating an expensive line-item in the budget for bounties. Prevention and eradication altogether seem to make the most sense. There are endpoint protection solutions available and other more comprehensive products that can alleviate the need for a bounty program, but in a world still dominated by “Default Allow” security systems, perhaps these programs do make sense .
So, until there is more widespread acceptance of the fact that the malware problem has indeed been solved by a true Default Deny Platform, for example, expect to see many more companies going the bounty route, either in a very public, big-dollar way, or on a more discreet level. Either way, it is the ethical hackers who win, collecting the big “bug bounties” for something they enjoy doing, challenging their intellect and abilities in a high-stakes “shoot-out” with the black hats.
Or, are the black hats really the ultimate winners here? If you take a step back, the bounties themselves are indicators that it’s still open season for black hats – serving almost as an implicit acceptance that the black hats can still infiltrate and conduct business as usual. If businesses large and small adopted robust preventative measures instead, the scope of the black hats’ influence would be greatly diminished if not entirely eradicated, and perhaps the bounty line-item would go away, like the 14.4 modem, or the gunfight at high noon on Main Street.
