English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Zendy Plus

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Zendy Tools

Zendy Open

Recently, bug-bounty programs have gained popularity and become a significantpart of the security culture of many organizations. Bug-bounty programs enableorganizations to enhance their security posture by harnessing the diverseexpertise of crowds of external security experts (i.e., bug hunters).Nonetheless, quantifying the benefits of bug-bounty programs remains elusive,which presents a significant challenge for managing them. Previous studiesfocused on measuring their benefits in terms of the number of vulnerabilitiesreported or based on the properties of the reported vulnerabilities, such asseverity or exploitability. However, beyond these inherent properties, thevalue of a report also depends on the probability that the vulnerability wouldbe discovered by a threat actor before an internal expert could discover andpatch it. In this paper, we present a data-driven study of the Chromium andFirefox vulnerability-reward programs. First, we estimate the difficulty ofdiscovering a vulnerability using the probability of rediscovery as a novelmetric. Our findings show that vulnerability discovery and patching provideclear benefits by making it difficult for threat actors to findvulnerabilities; however, we also identify opportunities for improvement, suchas incentivizing bug hunters to focus more on development releases. Second, wecompare the types of vulnerabilities that are discovered internally vs.externally and those that are exploited by threat actors. We observesignificant differences between vulnerabilities found by external bug hunters,internal security teams, and external threat actors, which indicates thatbug-bounty programs provide an important benefit by complementing the expertiseof internal teams, but also that external hunters should be incentivized moreto focus on the types of vulnerabilities that are likely to be exploited bythreat actors.

The Benefits of Vulnerability Discovery and Bug Bounty Programs: Case Studies of Chromium and Firefox