MODEL FOR CALCULATING THE COSTS OF A BUG BOUNTY PROGRAM FOR TESTING SECURITY VULNERABILITIES

Abstract

The article describes the ways of researching bug bounties of programs and proposes a new approach for calculating the score of the found vulnerabilities. The paper begins with an introduction to the understanding of vulnerability management processes and the concept of an attack surface. The paper analyzes the statistics of all vulnerabilities found in information systems over the past ten years, which are divided according to the standard CVSS score. The types and vectors of attacks are analyzed in the example of the financial sector. Additionally, hacking and incidents are categorized by attack vectors in the financial sector. The following is the ratio of the most popular types and vectors of attacks to the criticality of information systems. A rating of critical and high vulnerabilities of one of the bug bounty platforms is presented with a detailed description of the types of attacks and exploitation techniques. An integral part of the vulnerability management process is the categorization of importance and impact on the organization. Possible life cycle scenarios for the identified vulnerability in an information system are also presented through the eyes of the owner of the vulnerability information and the owner of such an information system. A comparative quantitative and qualitative analysis of the maturity of bug bounty programs from the moment of launch and over the years, as well as the factors influencing the maturity of the program, are carried out. The statistics of vulnerabilities found in public bug bounty programs over the past six years are analyzed. The author proposes her approach to calculating the effective cost of a bug bounty program and conducts an experimental test on three programs. The factors influencing the calculation of the effective cost of vulnerabilities are highlighted. Approaches to vulnerability assessment and validation by bug bounty platforms and the stages of arbitration between the owner of the information system and the vulnerability researcher are considered. The study concludes with recommendations for achieving a higher level of maturity in vulnerability management processes. The forging highlights the continuity of the emergence and disappearance of additional factors in vulnerability management processes, in which bug bounty programs are an integral part. The interdependence of the maturity of the company’s processes and its bug bounty program requires the attraction of sufficient resources for its effectiveness.