Concepedia

Bug Bounty Programs for Cybersecurity: Practices, Issues, and Recommendations

IEEE Software · 2019 · 50 citations · 13 references

Concepts

ComputingComputer ScienceCybersecurityComputer SecurityInformation Security ManagementCybersecurity ManagementCybersecurity PolicyCybersecurity StrategySecurity MetricsSecurity Program ManagementSoftware Security EngineeringBest Practices ManagementCrowd ResponseHuman Factors In CybersecuritySubmission Criteria

Abstract

Drawing upon crowdsourcing, bug bounty programs (BBPs) are entering the mainstream security practice in organizations. We analyze and recommend best practices in five main BBP areas: scoping of BBPs, timing of crowd engagement, submission quality, firm-researcher communication, and hacker motivation.

References

13

Grounded Theory Methodology

David L. Rennie · Theory & Psychology · 1998 · 1.4K citations

Humanities, Psychology, Epistemology +9

Improving security using extensible lightweight static analysis

David Evans, David Larochelle · IEEE Software · 2002 · 470 citations

Computing, Computer Science, Cybersecurity +13

Crowdsourcing in Software Engineering: Models, Motivations, and Challenges

Thomas D. LaToza, André van der Hoek · IEEE Software · 2015 · 151 citations

Computing, Computer Science, Requirements Engineering +11

Information security standards focus on the existence of process, not its content

Mikko Siponen · Communications of the ACM · 2006 · 102 citations

Computing, Information Systems, Information Technology +11

An empirical study of vulnerability rewards programs

Matthew Finifter, Devdatta Akhawe, David Wagner · 2013 · 95 citations

Computing, Computer Science, Cybersecurity +8