Bug bounties: How federal agencies can learn from Apple

With this year’s Hack the Pentagon program, the Department of Defense launched the federal government’s first bug bounty -- and with impressive results. All in all, 1,410 hackers submitted more than 1,000 vulnerability reports. Now DOD wants to expand Hack the Pentagon and recommends that other federal agencies follow suit.

Even with the clear benefits offered by bug bounty programs, however, many organizations still hesitate to invite outsiders into their systems. Federal agencies are not alone in their reluctance to pay bug bounties.

For years, Apple -- a company known for embracing risk and innovation -- held out, much to the chagrin of security experts. Then in April 2015, the FBI said that it paid hackers more than $1 million to crack the iPhone used by an attacker in the mass shooting at a hospital in San Bernardino, Calif.

Three months later at Black Hat 2016, Apple announced the launch of its own bug bounty program . Its invitation-only, quality-over-quantity approach provides a model federal agencies can -- and should -- follow.

To catch a thief

When FBI agents wanted to infiltrate the Gambino crime family in 1991, they enlisted “Sammy the Bull” Gravano as an informant. When they wanted to fight bank fraud, they turned to legendary scam artist Frank Abagnale. If, as the saying goes, it takes a thief to catch a thief, who better than hackers to help organizations prevent cyberattacks? Enter the bug bounty program model.

Also known as vulnerability rewards programs, the bug bounty concept is hardly new. The practice dates back 20 years, when Netscape first invited a group of software engineers to identify and fix bugs in its products. Today, many of the biggest tech companies -- including Facebook, Google and Microsoft -- offer their own bounties.

By employing expert white-hat hackers to identify bugs, exploits and vulnerabilities, organizations learn how a particular bug was found, the information revealed, how to fix it and, ideally, how to prevent it from happening again.

Exclusivity breeds comfort

With Hack the Pentagon, the Defense Department took a surprisingly open approach. The only conditions were that participants be U.S. citizens, pass a background check and not be on any terrorist lists.

In contrast, Apple’s new bug bounty program is significantly more exclusive, involving just a few dozen hackers on an invitation-only basis. It’s a tactic that federal agencies -- particularly the most risk-averse -- could embrace.

Bug bounty programs don’t need to be a free-for-all. They can operate on a sliding scale of openness, depending on the organization’s tolerance for risk. And, the more select and exclusive the group, the more motivated those bounty hunters might be.  Additionally, by providing the right accesses and background checks, agencies could recruit hackers they trust not to sell vulnerabilities to the highest bidder.

Balancing budgets with rewards

With federal budgets under constant scrutiny, it’s difficult for many agencies to implement a bug bounty without strict cost controls. A closed-door program, however, allows those groups to provide lucrative rewards without exhausting their budgets.

In fact, limiting the number of hackers allows organizations to offer much larger rewards for a select group of specific vulnerabilities, thus pursuing the most critical threats. At reportedly $200,000, Apple’s maximum compensation is 10 times higher than Google’s maximum $20,000 reward and double Microsoft’s $100,000.

No insiders equals objective insights

For commercial and federal organizations alike, internal bug hunting programs aren’t easy to develop -- nor are they always the most effective. Consider a bounty program from the standpoint of agency systems engineers. Their job is to maintain network uptime, not to shut it down to patch exploits. Moreover, identifying vulnerabilities means acknowledging imperfections or weaknesses in systems agency IT staff may have developed themselves.

Apple, however, forbids its own employees from participating in its bounty program, thus ensuring objective bug hunters devoid of personal motivations, while simultaneously deepening the company’s intelligence pool. This is a particularly attractive approach for federal agencies, which already rely on external contractors and consultants and where stricter, more regimented cultures might hamper objective, outside-the-box thinking.

Specificity is key

Apple only invites individual experts to target precise vulnerabilities in specific Apple products and services. Only a finite number of people have the skills to do that.

This approach directly relates to the federal space, given that a large proportion of the deployed technology is either government built or developed specifically for the government, as opposed to commercial off-the-shelf software.

Often, federal agencies don’t want to share their bespoke software with the public. But a controlled bounty program would allow agencies to open systems to only those with the right skill sets.

Not all bugs matter

Apple ranks its software vulnerabilities and offers just a few high-value rewards for those deemed most important. Additionally, it only invites hackers with relevant skills to help identify bugs in iCloud or Apple’s Secure Enclave Processor.

Similarly, by focusing on only the most high-priority vulnerabilities, agencies could reap the benefits of bug bounties -- all while reducing waste and respecting budget constraints.

In short…

Tasked with protecting everything from sensitive citizen data to classified intelligence, federal agencies -- perhaps more than any other organizations -- have a critical obligation to protect themselves and, by extension, the people they serve. Finding bugs is critical to that. And while the Pentagon has proved it can be done in a federal environment, Apple provides a template for those agencies not yet ready to embrace such an open approach.