WHITE PAPERS SPONSORED PROFILES JOB BOARD WEBINAR CENTER FREE SOFTWARE BZ RESEARCH ALMSHAREPOINT EVENTS CALENDAR PRINT/PDF EDITION PRINT/PDF BACK ISSUES

SUBSCRIBE TODAY CUSTOMER SERVICE EDITORIAL BEATS GUEST VIEW GUIDE SD TIMES 100 GUIDE EVENTS CALENDAR ADVERTISING ARTICLE REPRINTS REPORT A BUG SITE MAP

ABOUT US BZ MEDIA NEWS BZ RESEARCH NEWS ON MONDAY SPTECHREPORT SPTECHWEB SPTECHCON IPHONE/IPAD DEVCON ANDROID DEVCON PRIVACY POLICY CONTACT US

HOME >> OPINIONS

A bounty on your applications

By Anthony Haywood

January 19, 2011 — (Page 1 of 3)
In the last year, there have been a number of organisations offering rewards, or "bounty" programs, for discovering and reporting bugs in applications. Mozilla currently offers up to US$3,000 for crucial bug identification. Google pays out $1,337 for flaws in its software. Deutsche Post is currently sifting through applications from "ethical" hackers to approve teams who will go head-to-head and compete for its Security Cup in October. The winning team can hold aloft the trophy if they find vulnerabilities in its new online secure messaging service—that’s comforting to current users. Are these incentives the best way to make sure your applications are secure?

No. These sorts of schemes are nothing short of a publicity stunt and, in fact, can be potentially dangerous to an end user's security.

Inviting hackers to trawl all over a new application prior to its launch simply grants them more time to interrogate it and identify weaknesses, which they may decide are more valuable if kept to themselves. Once the first big announcement is made detailing who has purchased the application, with the time and location the product is to go live, the hacker can use this insight to breach the system and steal the corporate jewels.

A further worry is that while on the surface it may seem that these companies are being open and honest, if a serious security flaw were identified, would the developers raise the alarm and warn people? It’s my belief that they’d fix it quietly, release a patch and hope no one hears about it. The hacker would happily claim the reward, promise a vow of silence, and then "sell" the details on the black market, leaving any user with a great big security void in their defenses just waiting to be exploited while the patch is being developed, if the patch even succeeds at all.

Sometimes it’s not even a flaw in the software that can cause problems. If an attack is launched against the application, causing it to fail and reboot, then this denial of service attack can be just as costly to your organisation as if the application were breached and data was stolen.

Related Search Term(s): security

Pages 1 2 3

Share this link: http://sdt.bz/35181

Most Read Latest News Blog Resources

Android is the focus of two new design tools
Anywhere Software and Xamarin provide ways for developers to create and test their applications on PCs

LEADTOOLS HTML5 add-on modules released
Including New HTML5 Zero Footprint Viewer, JavaScript Libraries and RESTful Web Services for Document and Medical SDKs

How to speed up your Cukes
Using a five-step process derived from Six Sigma, Cucumber tests can go much faster

WhiteSource offers open-source license management as a service
Software gives companies insight into the open-source components in products

SmartBear rolls out new quality solution: API Complete
Software gives organizations ability to write test scripts and monitor APIs by bridging the DevOps divide

Android is the focus of two new design tools
Anywhere Software and Xamarin provide ways for developers to create and test their applications on PCs

WhiteSource offers open-source license management as a service
Software gives companies insight into the open-source components in products

Top five devices you can integrate with your applications
A five-fingered list of common, household items with which you can talk to (via software, of course)

Slick...but who needs it?
compilr.com is a well-designed site and the folks behind it seem to have their heart in the right place. But...who needs it?

How to be a better software developer
Want to be a better developer? You won't get there by mastering an interesting language or learning a new set of APIs.

Wooing Galatea
Do yourself a favor and check out Galatea 2.2, a wonderful book by novelist Richard Powers.

The world as story
An artificial-intelligence system at Carnegie Mellon seeks to understand the world by making statements about it.

Five SCM Best Practices Two-thirds of all software projects fail, according to the Standish Group’s CHAOS study. Improper usage of software configuration management...

Best Practices for Branching and Merging Patterns

Development teams often create a branching pattern, usually drawn out on a white board or in a Visio document, that is used as a model to...

Automated Error Reporting We invite you to read a short e-zine that tells you all about automated error reporting for .NET applications. This 8-page e-zine is packed...

The End of Application Redeploys Imagine that every time you wanted to write, send or receive an email, you needed to restart your computer. How much time would this take, a...

Technorati

Digg

Slashdot

Facebook

Friendfeed

Twitter

del.icio.us

Cigital Develops Ready-to-Use Tools for Securing the Smart Grid Cigital Inc. announced the release of the Guide to Developing a Cyber Security and Risk Mitigation Plan.

Department of Homeland Security lays down security suggestions Common Weakness Enumeration version 2.0 highlights flaws in software development practices

Metadata Security for SharePoint Adds Security Permissions Titus Metadata Security for SharePoint allows permissions to be assigned based on the recipient's Active Directory properties

Add comment

Name*
Email*
Country

Comment

Cigital Develops Ready-to-Use Tools for Securing the Smart Grid
Cigital Inc. announced the release of the Guide to Developing a Cyber Security and Risk Mitigation Plan Read More...

News on Monday
more>>
SharePoint Tech Report
more>>

Download Current Issue
MAY 2012 PDF ISSUE

Need Back Issues?
DOWNLOAD HERE

Want to subscribe?

Slick...but who needs it?
compilr.com is a well-designed site and the folks behind it seem to have their heart in the right place. But...who needs it?
05/16/2012 12:45 PM EST

How to be a better software developer
Want to be a better developer? You won't get there by mastering an interesting language or learning a new set of APIs.
05/14/2012 12:18 PM EST

Wooing Galatea
Do yourself a favor and check out Galatea 2.2, a wonderful book by novelist Richard Powers.
05/12/2012 07:05 PM EST

The world as story
An artificial-intelligence system at Carnegie Mellon seeks to understand the world by making statements about it.
05/10/2012 06:39 AM EST

The Rise of the Brogrammer, or the Rise of the Sexist Programmer?
Women in Silicon Valley get vocal about sexist ads and campaigns that contribute to a tense work environment.
05/09/2012 03:14 PM EST

Retriever Communications Releases RADE3
Organizations concerned about the growing popularity of bring your own device to work policies may be comforted by the release of RADE3.
05/09/2012 11:46 AM EST