Devising Effective Policies for Bug-Bounty Platforms and Security Vulnerability Discovery
Abstract
Bug-bounty programs have the potential to harvest the effort and diverse knowledge of thousands of independent security researchers, but running them at scale is challenging due to misaligned incentives and misallocation of effort. In our research, we discuss these challenges in detail and present relevant empirical data. We develop an economic framework consisting of two models that focus on evaluating different policies for improving the effectiveness of bug-bounty programs. Further, we discuss regulatory-policy challenges and questions related to vulnerability research and disclosure, such as mandatory bug bounties and the relation to other cyber-security policies.
Type
Venue
Journal of Information Policy, 7, 372–418. Penn State University Press, 2017
Authors
Associate Professor
Aron Laszka is an Associate Professor in the College of Information Sciences and Technology at the Pennsylvania State University. Previously, he was an Assistant Professor at the University of Houston, a Research Assistant Professor at Vanderbilt University, and a Postdoctoral Scholar at the University of California, Berkeley.
His research interests revolve around artificial intelligence and cyber-physical systems, focusing on machine learning for decision making and optimization, with applications in smart and connected communities, critical infrastructure, and cybersecurity.
His research is funded by the National Science Foundation, the Department of Energy, the Department of Transportation, and other agencies.