{"id":7242,"date":"2021-02-24T11:30:59","date_gmt":"2021-02-24T11:30:59","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7242"},"modified":"2021-02-24T11:31:00","modified_gmt":"2021-02-24T11:31:00","slug":"can-bug-bounty-programmes-replace-pen-testing","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/can-bug-bounty-programmes-replace-pen-testing\/","title":{"rendered":"Can Bug Bounty Programmes Replace Pen Testing?"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7242\" class=\"elementor elementor-7242\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p><span style=\"font-weight: 400;\">Security vulnerabilities are a real problem for software developers everywhere, and the organisations that employ them. Many issues are annoying but harmless, but the worst vulnerabilities in a piece of software could compromise security, and cause it to be <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/us-treasury-cyber-attack-suppliers-in-the-spotlight\/\"><span style=\"font-weight: 400;\">vulnerable to a breach<\/span><\/a><span style=\"font-weight: 400;\">, which if realised, could cause untold damage to the organisation. The traditional approach to checking for vulnerabilities is <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/application-security\/penetration-testing\/\"><span style=\"font-weight: 400;\">penetration testing<\/span><\/a><span style=\"font-weight: 400;\"> (or pen testing), but bug bounty programmes are increasingly being used by organisations to discover issues in their live products.<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;\">\u00a0<\/p><p><span style=\"font-weight: 400;\">Bug bounty programmes are gaining traction, increasingly used to uncover vulnerabilities by some of the <\/span><a href=\"https:\/\/www.guru99.com\/bug-bounty-programs.html\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">biggest names in technology<\/span><\/a><span style=\"font-weight: 400;\">, including <\/span><a href=\"https:\/\/msrc-blog.microsoft.com\/2020\/08\/04\/microsoft-bug-bounty-programs-year-in-review\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Microsoft<\/span><\/a><span style=\"font-weight: 400;\">, <\/span><a href=\"https:\/\/www.zdnet.com\/article\/google-paid-6-7-million-to-bug-bounty-hunters-in-2020\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Google<\/span><\/a><span style=\"font-weight: 400;\">, and even the US Government with their <\/span><a href=\"https:\/\/www.hackerone.com\/hack-the-pentagon\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Hack the Pentagon<\/span><\/a><span style=\"font-weight: 400;\"> program. These organisations pay out millions of dollars a year to bug bounty hunters, but can bug bounty programmes really replace penetration tests? Or can they serve a different, but complimentary, purpose?<\/span><\/p><h2><span style=\"font-weight: 400;\">What are bug bounty programmes?<\/span><\/h2><p><span style=\"font-weight: 400;\">Bug bounty programmes are used by organisations of all shapes and sizes to challenge independent security professionals to discover new vulnerabilities in their applications, software, websites, APIs, and more. Any security professional who finds a bug that has never been reported before will receive a bounty, or reward. Bug bounty programs provide a way for organisations to use their cyber security budget more effectively and only pay for results.<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;\">\u00a0<\/p><p><span style=\"font-weight: 400;\">Bug bounty programs are often hosted on <\/span><a href=\"https:\/\/thehackernews.com\/2021\/02\/top-5-bug-bounty-programs-to-watch-in.html\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">bug bounty platforms<\/span><\/a><span style=\"font-weight: 400;\"> such as HackerOne, BugCrowd, or Synack. The organisation defines the goals and scope of the program, and sets bounties for different levels of bug, The program is then hosted on the bug bounty platforms open to all security professionals who are registered on them.<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;\">\u00a0<\/p><p><span style=\"font-weight: 400;\">The reasons why an organisation will create a bug bounty program are varied, but they include: Getting continuous insight into the security of key systems; Utilising the skills of people outside the organisation, and getting access to very different skills that they might otherwise not access; Exposing the systems to people from outside the organisation who are not invested in it, and can therefore provide a realistic picture of the security situation; and ultimately to find bugs and resolve them before hackers do, and they become victims of a zero day attack.<\/span><\/p><h2><span style=\"font-weight: 400;\">Penetration tests: The traditional, but ultimately effective security testing method<\/span><\/h2><p><span style=\"font-weight: 400;\">Like bug bounty programs <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/application-security\/penetration-testing\/\"><span style=\"font-weight: 400;\">penetration testing<\/span><\/a><span style=\"font-weight: 400;\"> uses third party ethical hackers to \u201cattack\u201d applications testing them for flaws and weaknesses. However, unlike bug bounty hunters, the penetration testers are usually accredited, and work within a cyber security company.<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;\">\u00a0<\/p><p><span style=\"font-weight: 400;\">Penetration testing takes place within a defined scope and time frame, during which the tester is expected to uncover as many flaws as they can find, and provide a detailed security assessment of the application, website, or system being tested, including a list of flaws, and recommended mitigations to fix them. The penetration tester or cyber security company may also continue to work with the organisation, supporting the development team on an ongoing basis.<\/span><\/p><h2><span style=\"font-weight: 400;\">Bug bounty vs pentest<\/span><\/h2><p><span style=\"font-weight: 400;\">Both bug bounty programs and penetration tests are forms of <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/offensive-security\/ethical-hacking\/\"><span style=\"font-weight: 400;\">ethical hacking<\/span><\/a><span style=\"font-weight: 400;\"> used by organisations to improve the security of their products and systems. While the two testing models have similar end goals, below is a summary of some of the main differences between them.<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;\">\u00a0<\/p><table><tbody><tr><td><p><b>Bug bounty programmes<\/b><\/p><\/td><td><p><b>Penetration tests<\/b><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">Pay for success &#8211; testers are only paid if they find proven bugs before anyone else<\/span><\/p><\/td><td><p><span style=\"font-weight: 400;\">Pay for time &#8211; testers are paid for a set of hours or days or by project<\/span><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">Bug hunters are freelancers or contractors, registered on bug bounty platforms<\/span><\/p><\/td><td><p><span style=\"font-weight: 400;\">Pen testers work in cyber security companies<\/span><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">Bug bounty hunters choose the projects they work on &#8211; the company has no control over who does the testing<\/span><\/p><\/td><td><p><span style=\"font-weight: 400;\">Organisations sign a contract with a specific company or tester to carry out the penetration tests<\/span><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">Usually carried out on publicly accessible, published, or live products<\/span><\/p><\/td><td><p><span style=\"font-weight: 400;\">Can be used earlier in the process, before a product goes live<\/span><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">Less defined or rigid scope for testing<\/span><\/p><\/td><td><p><span style=\"font-weight: 400;\">Conducted based on the specific terms of the client<\/span><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">No specific deadlines for a programme enabling continuous testing<\/span><\/p><\/td><td><p><span style=\"font-weight: 400;\">Carried out as a snapshot in time, usually 2 or 3 weeks<\/span><\/p><\/td><\/tr><tr><td><p><span style=\"font-weight: 400;\">Focused on discovering vulnerabilities with little to no follow up<\/span><\/p><\/td><td><p><span style=\"font-weight: 400;\">Testers provide feedback, mitigation recommendations, and even ongoing support<\/span><\/p><\/td><\/tr><\/tbody><\/table><p dir=\"ltr\" style=\"line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;\">\u00a0<\/p><p><span style=\"font-weight: 400;\">Table 1: Bug bounty programmes vs penetration testing. Which one is right for you?<\/span><\/p><h2><span style=\"font-weight: 400;\">The limitations of bug bounty programs<\/span><\/h2><p><span style=\"font-weight: 400;\">While bug bounty programs several key benefits for organisations looking to improve the security of their products, there are some limitations to consider.<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;\">\u00a0<\/p><p><b>Loss of control over what is tested or reported<\/b><\/p><p><span style=\"font-weight: 400;\">The organisations commissioning the bug bounty program simply define the program and then withdraw, leaving whoever is out there to do their thing. Therefore they do not have any say which bugs are being hunted. On some programs, hackers may be focused on more lucrative bugs, not identifying or reporting the bugs which attract smaller bounties, which could remain undetected until they are <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/vulnerability-chaining-gives-access-us-gov-networks\/\"><span style=\"font-weight: 400;\">used to carry out an attack<\/span><\/a><span style=\"font-weight: 400;\">. In other programs, the bug bounty hunters may lack the skills to test more difficult systems choosing instead to <\/span><a href=\"https:\/\/www.cyberscoop.com\/bug-bounty-pen-testing-hackerone-synack-bugcrowd\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">focus on websites<\/span><\/a><span style=\"font-weight: 400;\"> which are easier to check rather than operating systems, which are more complex.\u00a0<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;\">\u00a0<\/p><p><b>Security concerns limit testing to published systems only<\/b><\/p><p><span style=\"font-weight: 400;\">Bug bounty programmes are open to any independent security professional to test, and the system being checked is vulnerable to them. As a result, most organisations limit the systems being tested to ones that are already open to the public. Penetration testing by contrast can be carried out on applications before they are published, when it is more cost effective to fix vulnerabilities, and more secure overall.<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;\">\u00a0<\/p><p><b>No support for fixing vulnerabilities<\/b><\/p><p><span style=\"font-weight: 400;\">When it comes to improving the security of a system or application, bug bounty programmes only carry out half the task. The bug bounty hunter will submit the bug, including a proof of concept of how they discovered it, but unlike a penetration testing team, they are not required to provide remediation advice, nor are they available to support the development team in recreating the vulnerability or remediating it. This requires the organisation to still have a level of skill and cyber security competence in order to fix the identified vulnerabilities.<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;\">\u00a0<\/p><p><b>They do not replace secure software development practices<\/b><\/p><p><span style=\"font-weight: 400;\">The best way to secure a product is to <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/application-security\/secure-software-development-life-cycle-ssdlc\/\"><span style=\"font-weight: 400;\">build it securely from the start<\/span><\/a><span style=\"font-weight: 400;\">. Bug bounty programmes are a patch delivered on final products rather than coming into the process at an earlier stage before the vulnerability is released into the wild. As such, bug bounty programmes are not a replacement for a vulnerability management program which takes every element of the product, from development to ongoing monitoring into consideration.<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;\">\u00a0<\/p><p><b>Bug bounty programmes are not widely accepted by compliance frameworks<\/b><\/p><p><span style=\"font-weight: 400;\">While bug bounty programs do demonstrate a commitment to security, and can help improve security overall, they sit outside the usual compliance framework. Many auditors, regulators, and even customers will not recognise bug bounty programs as an effective vulnerability management tool, and may require the organisation to carry out penetration tests by a certified tester in addition to the program, making the organisation pay twice for the same bugs.<\/span><\/p><h2><span style=\"font-weight: 400;\">Creating a comprehensive approach to testing products<\/span><\/h2><p><span style=\"font-weight: 400;\">Bug bounty programmes and <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/application-security\/penetration-testing\/\"><span style=\"font-weight: 400;\">penetration testing<\/span><\/a><span style=\"font-weight: 400;\"> both work towards the same goal &#8211; improving the security posture of systems and applications. They both have a place in any organisation\u2019s vulnerability management, but while an organisation may choose to just use penetration tests in their security management cycle, bug bounty programmes alone are not enough.<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;\">\u00a0<\/p><p><span style=\"font-weight: 400;\">Where bug bounty programmes are a good way to get regular feedback on different areas of an organisation\u2019s infrastructure, penetration tests carried out by a trusted professional with whom there is an ongoing relationship, and who is on hand to support mitigation efforts will provide more lasting benefits.<\/span><\/p><p dir=\"ltr\" style=\"line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;\">\u00a0<\/p><p><span style=\"font-weight: 400;\">Stay safe<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Security vulnerabilities are a real problem for software developers everywhere, and the organisations that employ them. Many issues are annoying but harmless, but the worst vulnerabilities in a piece of software could compromise security, and cause it to be vulnerable to a breach, which if realised, could cause untold damage to the organisation. The traditional&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7246,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7242"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7242"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7246"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}