Bug bounty platforms are becoming a standard solution for detecting vulnerabilities in an increasingly complex networked economy. Serving as intermediaries between organizations and ethical hackers, they crowdsource offensive information security and show significant improvements in the detection of vulnerabilities. In some sense, they can be likened to platforms of the gig economy. However, they stand out in one major regard: they do not have a pre-existing workforce. While platforms of the gig economy can rely on unqualified, often migrant, workers eager to earn the little money it provides, bug hunting platforms require highly qualified workers in a field where formal training is often lacking. This pushes bug bounty platforms to not only serve as intermediaries, but to also actively create the workforce they need. This paper discusses the efforts needed for the establishment of such a labor supply. Four key requirements are identified. First, the workers are required to undergo proper training. The platforms thus design educational tools aimed at ensuring a skilled workforce. Second, bug hunting must be routinised. A precise set of actions, as well as standard software is suggested that largely automate the job. This allows for efficient vulnerability detection. Third, platforms must ensure competition among bug hunters in order to secure a loyal workforce. To this end, they will design gamification schemes, made of rewards and rankings. Fourth, platforms seek to embed bug hunting into formal careers. By building alliances with the industry, higher education institutions, or the army, they make bug hunting economically appealing.
Read full abstract