Personnel Today
  • Home
    • All PT content
  • Email sign-up
  • Topics
    • HR Practice
    • Employee relations
    • Learning & training
    • Pay & benefits
    • Wellbeing
    • Recruitment & retention
    • HR strategy
    • HR Tech
    • The HR profession
    • Global
    • All HR topics
  • Legal
    • Case law
    • Commentary
    • Flexible working
    • Legal timetable
    • Maternity & paternity
    • Shared parental leave
    • Redundancy
    • TUPE
    • Disciplinary and grievances
    • Employer’s guides
  • AWARDS
    • Personnel Today Awards
    • The RAD Awards
  • Jobs
    • Find a job
    • Jobs by email
    • Careers advice
    • Post a job
  • Brightmine
    • Learn more
    • Products
    • Free trial
    • Request a quote
  • Webinars
  • Advertise
  • OHW+

Personnel Today

Register
Log in
Personnel Today
  • Home
    • All PT content
  • Email sign-up
  • Topics
    • HR Practice
    • Employee relations
    • Learning & training
    • Pay & benefits
    • Wellbeing
    • Recruitment & retention
    • HR strategy
    • HR Tech
    • The HR profession
    • Global
    • All HR topics
  • Legal
    • Case law
    • Commentary
    • Flexible working
    • Legal timetable
    • Maternity & paternity
    • Shared parental leave
    • Redundancy
    • TUPE
    • Disciplinary and grievances
    • Employer’s guides
  • AWARDS
    • Personnel Today Awards
    • The RAD Awards
  • Jobs
    • Find a job
    • Jobs by email
    • Careers advice
    • Post a job
  • Brightmine
    • Learn more
    • Products
    • Free trial
    • Request a quote
  • Webinars
  • Advertise
  • OHW+

HR practice

Idappcom warns `pay-for-bugs’ approach by ITsec vendors sends out the wrong message

by Personnel Today 12 Nov 2010
by Personnel Today 12 Nov 2010

Reports that Barracuda Networks is offering in excess of $3,000 for details of serious bugs in its IT security products is the latest stage in a worrying new trend, says vulnerability and testing security specialist Idappcom.

Anthony Haywood, Idappcom’s  CTO, says that even though Barracuda is billing the bug bounty scheme as in the best interests of customer, there is a significant danger that it will attract developers into researching the vendor’s products and then offering them to the highest bidder.

“And, of course, if the bug is a really serious one that cybercriminals can exploit to generate fraudulent revenue, there is a significant danger of the exploit information falling into the dark ecosystem that black hat hackers – as well as cybercriminals – now inhabit,” he said.

“Whilst even organisations like Google and Mozilla offer juicy sums of money for bugs in their software, you are going to get other vendors following suit. But just because it is becoming the norm for the IT industry, does not make it in the long-term interests of our market sector,” he added.

The Idappcom CTO went on to say that the bug bounty schemes offered by a growing number of IT players has parallels in the `litigate for free’ industry that has sprung up on both side of the Atlantic’s legal industry over the last decade or so.

The law firms, he says, argue that their litigate-for-free service is really in the best interests of the consumer, but the problem is that a while new industry has been created, that has ended up pushing insurance premiums up for most businesses.

Someone, somewhere, has to pay for these types of services, and, Haywood observes, the same conclusions apply to the bug bounty programs offered by IT vendors.

The irony of the situation, he explained, is that, as well as paying indirectly for the bug bounty schemes, end users of IT security systems, software and services also end up `paying’ as the tide of malware and other electronic mayhem rises as a result.

“This is a cause and effect situation. No one really wins in the longer term from bug bounty programs. And that’s why we say that they are not in the real interests of our industry,” said Haywood.

“In the short term they make a good story – and perhaps even a good event like CanSecWest’s Pwn2Own cracking contest in North America – but the bottom line is that it’s not in our industry’s best interests to offer such large sums of money. For that reason we give a definite thumbs down to such practices,” he added.

Sign up to our weekly round-up of HR news and guidance

Receive the Personnel Today Direct e-newsletter every Wednesday

OptOut
This field is for validation purposes and should be left unchanged.

For more the latest bug bounty scheme: http://bit.ly/b6wIiF

 

Personnel Today

Personnel Today articles are written by an expert team of award-winning journalists who have been covering HR and L&D for many years. Some of our content is attributed to "Personnel Today" for a number of reasons, including: when numerous authors are associated with writing or editing a piece; or when the author is unknown (particularly for older articles).

previous post
Alliance Learning has been awarded the Training Quality Standard
next post
CIPD 2010 closing keynote: Performance management a key issue in challenging times

You may also like

What do HR specialists enjoy most about their...

21 Mar 2025

King’s College London get top marks for HR...

20 Nov 2024

Personnel Today Awards 2024: The shortlists in full

13 Nov 2024

CIPD launches HR support pilot scheme for SMEs

7 Oct 2024

Are managers equipped to handle workplace conflict?

24 Sep 2024

Reimagining the employee lifecycle as a public sector...

5 Sep 2024

Employers urged to take action during riots

7 Aug 2024

HR changes save NHS Wales board £740k and...

6 Aug 2024

HR ‘unprepared’ for AI workforce revolution

29 May 2024

Tarantula-pranking train driver reinstated and awarded £40k

28 Feb 2024

  • 2025 Employee Communications Report PROMOTED | HR and leadership...Read more
  • The Majority of Employees Have Their Eyes on Their Next Move PROMOTED | A staggering 65%...Read more
  • Prioritising performance management: Strategies for success (webinar) WEBINAR | In today’s fast-paced...Read more
  • Self-Leadership: The Key to Successful Organisations PROMOTED | Eletive is helping businesses...Read more
  • Retaining Female Talent: Four Ways to Reduce Workplace Drop Out PROMOTED | International Women’s Day...Read more

Personnel Today Jobs
 

Search Jobs

PERSONNEL TODAY

About us
Contact us
Browse all HR topics
Email newsletters
Content feeds
Cookies policy
Privacy policy
Terms and conditions

JOBS

Personnel Today Jobs
Post a job
Why advertise with us?

EVENTS & PRODUCTS

The Personnel Today Awards
The RAD Awards
Employee Benefits
Forum for Expatriate Management
OHW+
Whatmedia

ADVERTISING & PR

Advertising opportunities
Features list 2025

  • Facebook
  • Twitter
  • Instagram
  • Linkedin


© 2011 - 2025 DVV Media International Ltd

Personnel Today
  • Home
    • All PT content
  • Email sign-up
  • Topics
    • HR Practice
    • Employee relations
    • Learning & training
    • Pay & benefits
    • Wellbeing
    • Recruitment & retention
    • HR strategy
    • HR Tech
    • The HR profession
    • Global
    • All HR topics
  • Legal
    • Case law
    • Commentary
    • Flexible working
    • Legal timetable
    • Maternity & paternity
    • Shared parental leave
    • Redundancy
    • TUPE
    • Disciplinary and grievances
    • Employer’s guides
  • AWARDS
    • Personnel Today Awards
    • The RAD Awards
  • Jobs
    • Find a job
    • Jobs by email
    • Careers advice
    • Post a job
  • Brightmine
    • Learn more
    • Products
    • Free trial
    • Request a quote
  • Webinars
  • Advertise
  • OHW+