Welcome to a brand new lecture.
And in this lecture, we are going to actually define a bug bounty program.
The bug bounty program is the most advanced form of Hagop our security.
It provides continuous security testing and vulnerability report from the hacker community.
When a new book bounty program is launched in 77 percent of the cases, hackers find the forced venerability
in the first 24 hours.
Isn't it great?
And that is how fast security can improve when hackers are invited to contribute.
Bug bounty programs can be either public or private.
Public Belmonte programs like Starbucks, GitHub and Airbnb are open to everyone.
While private programs require organizations to invite hackers to participate in public programs and
open to the widest range of hacker diversity and therefore produce superior results on an average public
bug, bounty programs have engaged six times the number of hackers reporting valid vulnerabilities.
That number nearly doubled in 2019, and it is going to triple in next year's private programs, make
up to 79 percent of all bounty programs.
There are public programs, make up the remaining 20 percent.
But starting with a private program, security teams can then work with a smaller group of hackers to
identify a known and easily found vulnerabilities as they optimize internal security processes.
Bug bounty programs are very similar to vulnerability disclosure policy.
That is Redzepi, which we have seen in the last lecture.
LDP's are referred to as the see something, say something of the Internet type bug bounty programs
include incentive structures and processes designed to encourage individuals with a range of experience
and talent to identify and report potential security vulnerabilities so they can be safely resolved
before they are exploited.
No money changes hands until after the vulnerability is reported, once it is validated and determined
to be in the line with the program terms as defined in the policy or security page.
The hackers are paid bounties or rewards.
A vulnerability disclosure policy will help bug bounty hackers to create the process for monitoring,
managing, vetting and responding to fixing vulnerabilities.
It's a great first step to dealing with incoming bug reports and building a team and process for handling
those reports.
In the next lecture, we will see which program should you go for with the public program or private
program.