漏洞发现和漏洞赏金计划的好处：Chromium和Firefox的案例研究
The Benefits of Vulnerability Discovery and Bug Bounty Programs: Case Studies of Chromium and Firefox
摘要：
最近，漏洞赏金计划越来越受欢迎，并成为许多组织安全文化的重要组成部分。漏洞赏金计划使组织能够通过利用外部安全专家群体的各种专业知识（即，臭虫猎人）。尽管如此，量化bug奖励计划的好处仍然难以捉摸，这对管理它们提出了重大挑战。以前的研究侧重于衡量他们的好处，在报告的漏洞的数量或根据报告的漏洞的属性，如严重性或可利用性。然而，除了这些固有的属性，报告的价值还取决于漏洞被内部专家发现和修补它之前被威胁行为者发现的可能性。在本文中，我们提出了一个数据驱动的研究铬和火狐浏览器的可靠性奖励计划。首先，我们估计发现一个漏洞的难度，使用重新发现的概率作为一个新的度量。我们的研究结果表明，漏洞发现和修补通过使威胁行为者难以找到漏洞来提供明显的好处;然而，我们也发现了改进的机会，例如激励漏洞猎人更多地关注开发版本。其次，我们比较了内部与外部发现的漏洞类型以及被威胁行为者利用的漏洞类型。我们观察到外部漏洞猎人，内部安全团队和外部威胁行为者发现的漏洞之间存在显着差异，这表明漏洞奖励计划通过补充内部团队的专业知识提供了重要的好处，但也应该激励外部猎人更多地关注可能被威胁行为者利用的漏洞类型。
英文摘要：
Recently, bug-bounty programs have gained popularity and become a significant part of the security culture of many organizations. Bug-bounty programs enable organizations to enhance their security posture by harnessing the diverse expertise of crowds of external security experts (i.e., bug hunters). Nonetheless, quantifying the benefits of bug-bounty programs remains elusive, which presents a significant challenge for managing them. Previous studies focused on measuring their benefits in terms of the number of vulnerabilities reported or based on the properties of the reported vulnerabilities, such as severity or exploitability. However, beyond these inherent properties, the value of a report also depends on the probability that the vulnerability would be discovered by a threat actor before an internal expert could discover and patch it. In this paper, we present a data-driven study of the Chromium and Firefox vulnerability-reward programs. First, we estimate the difficulty of discovering a vulnerability using the probability of rediscovery as a novel metric. Our findings show that vulnerability discovery and patching provide clear benefits by making it difficult for threat actors to find vulnerabilities; however, we also identify opportunities for improvement, such as incentivizing bug hunters to focus more on development releases. Second, we compare the types of vulnerabilities that are discovered internally vs. externally and those that are exploited by threat actors. We observe significant differences between vulnerabilities found by external bug hunters, internal security teams, and external threat actors, which indicates that bug-bounty programs provide an important benefit by complementing the expertise of internal teams, but also that external hunters should be incentivized more to focus on the types of vulnerabilities that are likely to be exploited by threat actors.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
