Secunia Launches Independent Vulnerability Reward Program
12:00 CET on the 2nd November 2011 Entry written by Secunia.
- Researchers to be rewarded for coordinating software vulnerabilities
Copenhagen, Denmark, 2nd November 2011 - Vulnerability researchers are being invited by Secunia, the leading provider of vulnerability intelligence and vulnerability management tools, to participate in a new program launched today under which Secunia, independently of any software vendor, will confirm vulnerability discoveries and handle coordination with the vendor on the researchers’ behalf.
The program, entitled The Secunia Vulnerability Coordination Reward Program (SVCRP) is open to any researcher who has discovered vulnerability in any software and would like a third party to confirm their findings and handle the co-ordination process with the software vendor for them. As part of the program, Secunia will offer rewards to researchers who contact them with vulnerabilities they have found and who wish Secunia to coordinate them with the vendor. This comprehensive program is designed to be complementary to those run by other organisations and will cover all vulnerabilities as long as they meet Secunia’s criteria.
Carsten Eiram, Chief Security Specialist at Secunia, explains, "The fun part of vulnerability research is the actual process of discovering and understanding the vulnerabilities as well as creating proof of concepts or exploits; and not the sometimes extensive coordination and liaison process that follows with the vendor in order to fix the problem. Under the new program we will both confirm vulnerability discoveries and handle the coordination process, allowing researchers to focus on the more exciting aspects of vulnerability research."
He continued, "Other major vulnerability coordination offerings exist but most have a business model wrapped around them. SVCRP is designed to be a complementary service to these. Most other schemes pay researchers for their discoveries, and, while these offerings are excellent for researchers, the companies are, naturally, very selective in which vulnerabilities they wish to purchase and coordinate. This leaves a huge gap for researchers, who either do not want to sell their vulnerabilities or discover vulnerabilities not fulfilling the requirements of the existing initiatives, but who would still like an independent third party to confirm their discoveries and handle coordination.
Some of these researchers have in the past turned to Secunia for help on an informal basis and we now want to encourage even more researchers to allow us to help coordinate their vulnerability discoveries by providing this reward incentive."
The main benefit to independent researchers is that Secunia offers the expertise to assess and validate the vulnerability, and saves them time and effort in coordinating directly with the vendor to fix the vulnerability, thus allowing them to deal with other priorities as well as giving added weight to their findings.
Benefits to vendors include the fact that vulnerability discoveries from the researchers will be confirmed in great detail by Secunia to determine the core problem in the code. As a result, vendors will receive very precise information about the vulnerability, and Secunia will also work with them to find a complete fix, providing feedback and helping them confirm that their new patches are properly addressing the vulnerabilities prior to release. This should mean quicker investigation and thorough fix of the software problem. In addition, both researchers and vendors will benefit from having a trusted and independent third party such as Secunia to act as an intermediary.
Users will benefit since, as Secunia is able to undertake comprehensive and extensive coordination of vulnerabilities discovered by the researcher, there is likely to be an increase in the number being coordinated with the vendor. This should in turn lead to a greater number of complete solutions to software problems, ultimately leading to more reliable software and therefore more efficient working.
All classes of vulnerability across most products are eligible for the SVCRP program as long as the following criteria are met:
The vulnerability affects a stable product
The vulnerability affects the latest version of the product
The product is actively supported by the vendor
The vulnerability is not already publicly known
Secunia Research is able to confirm the reported vulnerability.
No Secunia customers will receive any advance notification about the vulnerabilities coordinated by Secunia, whether they are internal discoveries or vulnerabilities coordinated via this reward incentive. All customers, as well as the community at large, will receive the information simultaneously when the Secunia advisory is published. Researchers will continue to receive any payments to which they are entitled from vendors for coordinating vulnerabilities. Secunia will confirm the vulnerabilities through testing in their extensive and independent laboratory testing facilities, but will not receive any money or other reward from vendors either for confirming or for coordinating the vulnerability on behalf of the researcher.
The rewards on offer will range from top-of-the range merchandise to two major annual rewards such as free hotel accommodation and entry to an IT security conference chosen from a list of the most popular global security conferences. The latter rewards will be given for the first time in January 2012. One reward will be given to the researcher who coordinates the most interesting vulnerability as judged by Secunia in the form of a prize under the Most Interesting Coordination Report category. Criteria will include complexity, impact, level and level of detail. The other will be given to the researcher who has been consistently coordinating correct, clearly detailed vulnerability reports that are quick and easy to confirm as judged by Secunia. The researcher will be given the title, ‘Most Valued Contributor’ by Secunia. Other rewards will be continuously given to researchers coordinating their discoveries through Secunia based on their individual performance.
There is no charge or enrolment process for researchers to participate in the program, which forms part of several initiatives from Secunia to benefit the community.
Read the supporting blog by Secunia's Chief Security Specialist, Carsten Eiram here.
About Secunia Founded in 2002, Secunia is the leading provider of IT security solutions that help businesses and private individuals globally manage and control vulnerability threats and risks across their networks and endpoints. Secunia's proven, complementary portfolio aids businesses in their handling of complex IT security risks and compliance requirements across industries and sectors - a key component in corporate risk management assessment, strategy, and implementation. Secunia plays an important role in the IT security ecosystem, and is the preferred supplier for enterprises and government agencies worldwide, counting Fortune 500 and Global 2000 businesses among its customer base.