{"id":34523,"date":"2018-11-13T18:50:48","date_gmt":"2018-11-13T23:50:48","guid":{"rendered":"https:\/\/digital.hbs.edu\/platform-rctom\/submission\/hackers-wanted-crowd-sourced-security-at-the-u-s-department-of-defense\/"},"modified":"2018-11-13T23:39:08","modified_gmt":"2018-11-14T04:39:08","slug":"hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense","status":"publish","type":"hck-submission","link":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\/","title":{"rendered":"Hackers Wanted: Crowd-sourced security at the United States Department of Defense"},"content":{"rendered":"

The U.S. Department of Defense (DoD) has historically relied on internal testing and quality control processes to secure top-secret information and technology. Under Secretary of Defense Ash Carter\u2019s leadership, the DoD shifted the culture of their security program from closed systems to crowd-sourced security. During the launch of the first bug bounty program in Federal government history, Secretary Carter stated, \u201c\u2019Security through obscurity\u201d is often our default position. For many of our networks and applications, there\u2019s good reason for that. But the more friendly eyes we have on some of our systems, networks, websites, and applications, the more gaps we can find, the more vulnerabilities we can fix, the greater security we can provide our warfighters [5]<\/strong>.\u201d<\/p>\n

Hacker-Powered security <\/strong><\/p>\n

Hacker-Powered security utilizes the external hacker community to find unknown security vulnerabilities and reduce cyber risk. These activities are facilitated through bug-bounty programs, which proactively invite security researchers around the world to expose a company\u2019s vulnerabilities in exchange for monetary and reputational rewards. The first bug-bounty program dates back to 1995, when Netscape offered cash for vulnerability reports against its web browser. Fifteen years later, these programs have become industry standard amongst technology companies like Google and PayPal. These bounty programs popularized crowdsourced security and fueled the growth of bug-bounty-focused startups like HackerOne and Bugcrowd, which offer platforms that connect organizations with ethical hackers, known as white-hat hackers. By crowd-sourcing security testing, organizations create an external monitoring system that identifies critical bugs faster than internal controls [6]<\/strong>.<\/p>\n

Launching Hack the Pentagon<\/strong><\/p>\n

In 2016, the DoD invited 1,400 hackers to identify and resolve security vulnerabilities within the Defense Department\u2019s public facing website. It took 13 minutes to discover the first vulnerability and over the course of the next 6 hours, hackers submitted over 200 findings, earning $75,000 in reward money [1]<\/strong>.The success of this pilot led to the expansion of bug-bounty programs to other departments within the DoD. Hack the Air Force paid out $103,883 in bounties to freelance hackers who discovered 106 vulnerabilities over a 20-day period [2]<\/strong>.<\/p>\n

Hack the Army paid $100,000 in bounties for 416 reports \u2013 the first bug was found in 5 minutes. The army asked hackers to target operationally significant websites and discovered a critical vulnerability that enabled attackers to move from a public facing website, www.goarmy.com to an internal DoD website that required special credentials to access. The hackers were able to access the DoD\u2019s internal network through an open proxy, which meant the routing wasn\u2019t shut down the way it should have been. Once reported the Army Cyber Protection Brigade was able to immediately remediate the issue, stopping future attackers from exploiting this chain of vulnerabilities [3]<\/strong>.<\/p>\n

The DoD\u2019s bug-bounty programs have resulted in the successful resolution of 5,000 security vulnerabilities and have since expanded its scope to more sensitive systems like the department\u2019s travel booking system. Defense Travel System (DTS) guards sensitive information for millions of government employees and contractors, making it one of the most widely-used pieces of enterprise software in the U.S. government. Hackers employed a variety of methods, including social engineering, to expose over 100 vulnerabilities [4]<\/strong>.<\/p>\n

Recommendations<\/strong><\/p>\n

While bug-bounty programs are now prevalent across the software industry, the security researchers who participate have faced decades of abuse in the form of formal legal suits filed, inappropriate referrals to authorities, public attacks, and misguided laws that seek to ban or criminalize good faith security research and publication [7]<\/strong>. When considering crowd-sourced security, organizations need to first establish a Vulnerability Disclosure Policy (VDP), which is the legal foundation that enables all bug-bounty programs and outlines a method for receiving vulnerability submissions from the outside world [8]<\/strong>.<\/p>\n

Following the success of their bug-bounty programs, the DoD published a VDP that described the legal avenue for any hacker to disclose vulnerabilities in any DoD public-facing systems. Hackers now have clear guidance on how to legally test for and disclose vulnerabilities in DoD\u2019s websites that may be out of scope of live bug-bounty challenges. This policy is the first of its kind for the U.S. Government and serves as a bold commitment to bringing diverse perspectives to protect and defend the nation\u2019s assets.<\/p>\n

Governments have a responsibility to be responsible caretakers of the private data they guard. Will other branches of the Federal government adopt crowd-sourced security? How will this model work in government agencies that depend heavily on technical contractors? How can bug-bounty programs be implemented at the local level and amongst government-managed institutions like power plants? Trailblazing paths to make society safer is a vital role government need to take. The DoD has taken the opportunity to be leaders in working with the security researcher community. Hack the Pentagon should serve as a model for other government departments to follow, and I believe many more will. [794]<\/strong><\/p>\n

 <\/p>\n

Works cited:<\/strong><\/p>\n

[1]<\/strong> Government – Hack The Pentagon – Hacker Powered Security Testing. (n.d.). Retrieved November 12, 2018, from https:\/\/www.hackerone.com\/resources\/hack-the-pentagon<\/a><\/p>\n

[2]<\/strong> O’Neill, P. H. (2018, May 31). Pentagon’s latest bug bounty program pays out $80,000. Retrieved November 13, 2018, from https:\/\/www.cyberscoop.com\/hack-the-dts-dod-hackerone-bug-bounty-pentagon<\/a><\/p>\n

[3]<\/strong> Hack The Army Results Are In. (2017, January 19). Retrieved November 12, 2018, from https:\/\/www.hackerone.com\/blog\/Hack-The-Army-Results-Are-In<\/a><\/p>\n

[4]<\/strong> Pomerleau, M. (2018, October 26). DoD bug bounty program to expand to more sensitive systems. Retrieved November 13, 2018, from https:\/\/www.fifthdomain.com\/dod\/2018\/10\/24\/dod-bug-bounty-program-to-expand-to-more-sensitive-systems\/<\/a><\/p>\n

[5]<\/strong> Carter, Ash.\u201cThe Pentagon\u2019s First Bug Bounty Exceeded All Expectations.\u201d U.S. Department of Defense, June 17, 2016.<\/p>\n

[6]<\/strong> Wong, C., Shema, M., & Warner, T. L. (2017). Crowdsourced Pen Testing for Dummies (1st ed., Vol. 1, Cobalt Edition). Hoboken, New Jersey: John Wiley & Sons.<\/p>\n

[7]<\/strong> Evans, C. (2018, March 21). Protecting Security Researchers. Retrieved November 13, 2018, from https:\/\/blogs.dropbox.com\/tech\/2018\/03\/protecting-security-researchers\/<\/a><\/p>\n

[8]<\/strong> Vulnerability Disclosure Policy Basics: 5 Critical Components. (2017, August 10). Retrieved November 13, 2018, from https:\/\/www.hackerone.com\/blog\/Vulnerability-Disclosure-Policy-Basics-5-Critical-Components<\/a><\/p>\n

Image source:\u00a0<\/strong>https:\/\/www.synack.com\/hack-the-pentagon\/<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Data breaches and cyber attacks are becoming more prominent and less predictable. To manage ever-increasing cyber risk, the U.S. Department of Defense created a bug bounty program for security vulnerabilities and used crowdsourcing to invite hackers to break into their systems. <\/p>\n","protected":false},"author":11062,"featured_media":34647,"comment_status":"open","ping_status":"closed","template":"","categories":[1195,845,3768,4239],"class_list":["post-34523","hck-submission","type-hck-submission","status-publish","has-post-thumbnail","hentry","category-crowdsourcing","category-cybersecurity","category-department-of-defense","category-open-innovation","hck-taxonomy-organization-united-states-department-of-defense","hck-taxonomy-industry-information-technology","hck-taxonomy-country-united-states"],"connected_submission_link":"https:\/\/d3.harvard.edu\/platform-rctom\/assignment\/rc-tom-challenge-2018\/","yoast_head":"\nHackers Wanted: Crowd-sourced security at the United States Department of Defense - Technology and Operations Management<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hackers Wanted: Crowd-sourced security at the United States Department of Defense - Technology and Operations Management\" \/>\n<meta property=\"og:description\" content=\"Data breaches and cyber attacks are becoming more prominent and less predictable. To manage ever-increasing cyber risk, the U.S. Department of Defense created a bug bounty program for security vulnerabilities and used crowdsourcing to invite hackers to break into their systems.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\/\" \/>\n<meta property=\"og:site_name\" content=\"Technology and Operations Management\" \/>\n<meta property=\"article:modified_time\" content=\"2018-11-14T04:39:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/d3.harvard.edu\/platform-rctom\/wp-content\/uploads\/sites\/4\/2018\/11\/Screen-Shot-2018-11-13-at-6.15.31-PM.png\" \/>\n\t<meta property=\"og:image:width\" content=\"2044\" \/>\n\t<meta property=\"og:image:height\" content=\"496\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\\\/\",\"url\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\\\/\",\"name\":\"Hackers Wanted: Crowd-sourced security at the United States Department of Defense - Technology and Operations Management\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/wp-content\\\/uploads\\\/sites\\\/4\\\/2018\\\/11\\\/Screen-Shot-2018-11-13-at-6.15.31-PM.png\",\"datePublished\":\"2018-11-13T23:50:48+00:00\",\"dateModified\":\"2018-11-14T04:39:08+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\\\/#primaryimage\",\"url\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/wp-content\\\/uploads\\\/sites\\\/4\\\/2018\\\/11\\\/Screen-Shot-2018-11-13-at-6.15.31-PM.png\",\"contentUrl\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/wp-content\\\/uploads\\\/sites\\\/4\\\/2018\\\/11\\\/Screen-Shot-2018-11-13-at-6.15.31-PM.png\",\"width\":2044,\"height\":496},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Submissions\",\"item\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/submission\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Hackers Wanted: Crowd-sourced security at the United States Department of Defense\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/#website\",\"url\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/\",\"name\":\"Technology and Operations Management\",\"description\":\"MBA Student Perspectives\",\"potentialAction\":[{\"@type\":\"性视界Action\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/d3.harvard.edu\\\/platform-rctom\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hackers Wanted: Crowd-sourced security at the United States Department of Defense - Technology and Operations Management","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\/","og_locale":"en_US","og_type":"article","og_title":"Hackers Wanted: Crowd-sourced security at the United States Department of Defense - Technology and Operations Management","og_description":"Data breaches and cyber attacks are becoming more prominent and less predictable. To manage ever-increasing cyber risk, the U.S. Department of Defense created a bug bounty program for security vulnerabilities and used crowdsourcing to invite hackers to break into their systems.","og_url":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\/","og_site_name":"Technology and Operations Management","article_modified_time":"2018-11-14T04:39:08+00:00","og_image":[{"width":2044,"height":496,"url":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-content\/uploads\/sites\/4\/2018\/11\/Screen-Shot-2018-11-13-at-6.15.31-PM.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\/","url":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\/","name":"Hackers Wanted: Crowd-sourced security at the United States Department of Defense - Technology and Operations Management","isPartOf":{"@id":"https:\/\/d3.harvard.edu\/platform-rctom\/#website"},"primaryImageOfPage":{"@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\/#primaryimage"},"image":{"@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\/#primaryimage"},"thumbnailUrl":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-content\/uploads\/sites\/4\/2018\/11\/Screen-Shot-2018-11-13-at-6.15.31-PM.png","datePublished":"2018-11-13T23:50:48+00:00","dateModified":"2018-11-14T04:39:08+00:00","breadcrumb":{"@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/d3.harvard.edu\/platform-rctom\/submission\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\/#primaryimage","url":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-content\/uploads\/sites\/4\/2018\/11\/Screen-Shot-2018-11-13-at-6.15.31-PM.png","contentUrl":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-content\/uploads\/sites\/4\/2018\/11\/Screen-Shot-2018-11-13-at-6.15.31-PM.png","width":2044,"height":496},{"@type":"BreadcrumbList","@id":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/hackers-wanted-crowd-sourced-security-at-the-united-states-department-of-defense\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/d3.harvard.edu\/platform-rctom\/"},{"@type":"ListItem","position":2,"name":"Submissions","item":"https:\/\/d3.harvard.edu\/platform-rctom\/submission\/"},{"@type":"ListItem","position":3,"name":"Hackers Wanted: Crowd-sourced security at the United States Department of Defense"}]},{"@type":"WebSite","@id":"https:\/\/d3.harvard.edu\/platform-rctom\/#website","url":"https:\/\/d3.harvard.edu\/platform-rctom\/","name":"Technology and Operations Management","description":"MBA Student Perspectives","potentialAction":[{"@type":"性视界Action","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/d3.harvard.edu\/platform-rctom\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/hck-submission\/34523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/hck-submission"}],"about":[{"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/types\/hck-submission"}],"author":[{"embeddable":true,"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/users\/11062"}],"replies":[{"embeddable":true,"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/comments?post=34523"}],"version-history":[{"count":0,"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/hck-submission\/34523\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/media\/34647"}],"wp:attachment":[{"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/media?parent=34523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/d3.harvard.edu\/platform-rctom\/wp-json\/wp\/v2\/categories?post=34523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}