Bug Auctions: Vulnerability Markets Reconsidered

Abstract

Measuring software security is difficult and inexact; as a result, the market for secure software has been compared to a `market of lemons.' Schechter has proposed a vulnerability market in which software producers offer a time-variable reward to free-market testers who identify vulnerabilities. This vulnerability market can be used to improve testing and to create a relative metric of product security. This paper argues that such a market can best be considered as an auction; auction theory is then used to tune the structure of this `bug auction' for efficiency and to better defend against attacks. The incentives for the software producer are also considered, and some fundamental problems with the concept are articulated.