{"id":4021,"date":"2019-08-06T16:34:55","date_gmt":"2019-08-06T20:34:55","guid":{"rendered":"https:\/\/solutionsreview.com\/endpoint-security\/?p=4021"},"modified":"2019-08-06T16:34:55","modified_gmt":"2019-08-06T20:34:55","slug":"exploring-bug-bounties-with-microsofts-bug-bounty-challenge","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/endpoint-security\/exploring-bug-bounties-with-microsofts-bug-bounty-challenge\/","title":{"rendered":"Exploring Bug Bounties With Microsoft’s Bug Bounty Challenge"},"content":{"rendered":"

\"Exploring<\/p>\n

Recently, at the Black Hat 2019 conference, technology giant and cybersecurity provider<\/a> Microsoft made two startling announcements:\u00a0<\/span><\/p>\n

    \n
  1. Over the past year, Microsoft paid hackers a grand total of $4.4 million.\u00a0<\/span><\/li>\n
  2. They issued an outright challenge to hackers who feel confident and aggressive to attack them.\u00a0<\/span><\/li>\n<\/ol>\n

    While both announcements appear shocking, in context Microsoft\u2019s action actually make complete sense. The key is to filter their actions and statements through the filter of a bug bounty program.\u00a0<\/span><\/p>\n

    \t\t\t

    \"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/span><\/p>\n

    What is a bug bounty program? How does Microsoft\u2019s actions compare to other bug bounty programs? Should your enterprise implement a bug bounty program?<\/span><\/p>\n

    What is a Bug Bounty Program?\u00a0<\/b><\/h2>\n

    First, we need to define bug bounties for the uninitiated.<\/span><\/p>\n

    A bug bounty program refers to a deal offered by enterprises to individuals who discover bugs on their networks. By definition, \u201cbugs\u201d can include anything from security holes to exploits and other digital vulnerabilities. Usually, enterprises use their bug bounty programs to discover and close vulnerabilities before they become public knowledge.\u00a0<\/span><\/p>\n

    Generally, bug bounties tend to offer money for the discovery of security. In fact, some companies have run into trouble as a result of trying to avoid paying its bug discoverers. Famously, Yahoo tried to pay its white-hat hackers with t-shirts.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/p>\n

    However, this leads to another question enterprises need to understand\u2026.\u00a0<\/span><\/p>\n

    Who Participates in Bug Bounty Programs? <\/b>\u00a0<\/span><\/h2>\n

    Many people conflate hackers with all digital threat actors. Indeed, the editors of Solutions Review also tend to fuel this discourse. However, that doesn\u2019t quite bear out in reality.\u00a0<\/span><\/p>\n

    The term \u201chacker\u201d simply refers to any individual who breaks into computer systems and software. This can include white-hat hackers\u2014which include security researchers looking for bugs\u2014and threat actors. Ultimately, the intention and actions of the hacker determine which identity they possess. If the actor comes to your enterprise with news of a bug and didn\u2019t exploit it, they qualify as a white-hat hacker.\u00a0<\/span><\/p>\n

    For years, white-hat hackers received rather unfair treatment; some enterprises and institutions threatened them with legal recourse. Yet white-hat hackers only seek to help enterprises stay strong. Bug bounty programs don\u2019t invite malicious hackers any more than any other vulnerability; in fact, you could say hackers would try to attack regardless.<\/span><\/p>\n

    With both of these facts in mind, we come across another question: how should your enterprise handle its\u2019 own bug bounty program?\u00a0<\/span><\/p>\n

    How to Run A Program of Your Own<\/b><\/h3>\n

    To establish your enterprise\u2019s own bug bounty program, follow these steps:\u00a0<\/span><\/p>\n