cyber.hendryadrian.com
Security News · huntress.com

Huntress and Partners Fund Bug Bounty Program Focused on MSPs

· Original article ↗

Summary

Huntress and partners say they are funding a DIVD bug bounty program focused on MSPs, aiming to attract security researchers to find vulnerabilities in software these providers rely on.

Key points

  • The article says MSPs rely on more than 17 applications on average and often lack the capacity to continuously audit vendors’ application security.
  • It argues that smaller businesses and MSPs are underserved by bug bounty programs that tend to attract researchers to larger companies.
  • Huntress and partners say they are supporting the Dutch Institute for Vulnerability Disclosure (DIVD) and funding a bug bounty program focused on MSPs.
  • The initiative aims to offer payouts competitive with larger programs to attract security researcher attention.
  • The article cites SolarWinds, Kaseya, and Log4Shell as examples of supply-chain security risks affecting organizations.

Article Details

Event Type
Huntress and partner organizations supported the Dutch Institute for Vulnerability Disclosure (DIVD) in creating and funding a bug bounty program focused on managed service providers (MSPs).
Impact
The program aims to fund bug bounty payouts at levels comparable to larger programs, encouraging security researchers to find and responsibly disclose vulnerabilities in software used by MSPs. The article describes MSPs as potential entry points to many small and medium-sized businesses, but reports no specific breach or operational impact from this program.

People

Andrew MorganIdentified as founder of Right of Boom Cyber Summit and contributor of the article's introduction.Garrett GrossNamed as the article's author.Rob SilversQuoted on the likely persistence of organizational exposure to Log4j.

Malware

SUNBURSTThe SolarWinds SUNBURST (2020) and the Kaseya ransomware attack (2021) put such a spotlight on supply chain attacks that both CISA and cyber insurance carriers became incredibly vocal about the massive risk managed

Vendors

AppgateEarlier this year, we partnered with our friends from Appgate, Axcient, Blumira, MSPCFO, OITVoip, Servosity, Taylor Business Group and Unveil Security Group to support DIVD financially as well as create/fund a bugAppleamount that companies are willing to pay out keeps growing. Google paid out more than $8.7M in 2021, and Apple currently offers up to $1M for finding their most critical flaws.AxcientEarlier this year, we partnered with our friends from Appgate, Axcient, Blumira, MSPCFO, OITVoip, Servosity, Taylor Business Group and Unveil Security Group to support DIVD financially as well as create/fund a bugBlumiraEarlier this year, we partnered with our friends from Appgate, Axcient, Blumira, MSPCFO, OITVoip, Servosity, Taylor Business Group and Unveil Security Group to support DIVD financially as well as create/fund a bugBugcrowdThere are even companies out there like Hackerone and BugCrowd that enable companies that may not have the capabilities to manage their own bug bounty programs by connecting them with freelance security researchers andGoogleIn the wake of these supply chain issues, Google has announced a bug bounty program specifically for open-source software. Capitalizing on the fervor associated with these recent security events, Google aims to furtherHackerOneThere are even companies out there like Hackerone and BugCrowd that enable companies that may not have the capabilities to manage their own bug bounty programs by connecting them with freelance security researchers andHuntressThat’s why we’re proud to offer the Huntress Neighborhood Watch Program: a collection of resources and programs to help elevate the broader security community—with a special focus on the 99% of businesses that are oftenMSPCFOEarlier this year, we partnered with our friends from Appgate, Axcient, Blumira, MSPCFO, OITVoip, Servosity, Taylor Business Group and Unveil Security Group to support DIVD financially as well as create/fund a bugOITVoipEarlier this year, we partnered with our friends from Appgate, Axcient, Blumira, MSPCFO, OITVoip, Servosity, Taylor Business Group and Unveil Security Group to support DIVD financially as well as create/fund a bugServosityEarlier this year, we partnered with our friends from Appgate, Axcient, Blumira, MSPCFO, OITVoip, Servosity, Taylor Business Group and Unveil Security Group to support DIVD financially as well as create/fund a bugTaylor Business Groupyear, we partnered with our friends from Appgate, Axcient, Blumira, MSPCFO, OITVoip, Servosity, Taylor Business Group and Unveil Security Group to support DIVD financially as well as create/fund a bug bounty programUnveil Security Groupour friends from Appgate, Axcient, Blumira, MSPCFO, OITVoip, Servosity, Taylor Business Group and Unveil Security Group to support DIVD financially as well as create/fund a bug bounty program focused on MSPs.

Tools

Cobalt Strikethat these exploits will be weaponized immediately following disclosure (via tools like Metasploit, Cobalt Strike, etc.), so due to the lack of technical skills required to operate these tools and launch suchMetasploit Frameworkalso guarantee that these exploits will be weaponized immediately following disclosure (via tools like Metasploit, Cobalt Strike, etc.), so due to the lack of technical skills required to operate these tools and

Industries

Managed service providersMarch 26, 2020, and July 2, 2021, are two dates that will be seen as turning points for the way managed service providers (MSPs) run their businesses.

Related Articles