What Is Crowdsourced Security?
Reading Time: 4 minutesWhen new software hits the market, it’s tested for vulnerabilities. One way is through crowdsourcing. But is that reliable? Is it actually safe?
Before a new software product hits the market, it is tested for vulnerabilities. Every responsible company carries out these tests, in order to protect both its customers and itself from cyber threats.
In recent years, developers have increasingly relied on crowdsourcing to conduct security investigations. But what exactly is crowdsourced security? How does it work, and how does it compare to other common risk assessment methods?
How Crowdsourced Security Works
Organizations of all sizes have traditionally utilized penetration testing to secure their systems. Pen testing is essentially a simulated cyberattack that is meant to expose security flaws, just like a real attack would. But unlike in a real attack, once discovered, these vulnerabilities are patched up. This boosts the overall security profile of the organization in question. Sounds simple.
But there are some glaring issues with penetration testing. It is typically performed annually, which is simply not enough, given that all software is updated regularly. Secondly, because the cybersecurity market is rather saturated, pen testing companies sometimes ‘find’ vulnerabilities where there really aren’t any in order to justify charging for their services and stand out from their competition. Then there are also budgetary concerns—these services can be quite costly.
Crowdsourced security works on an entirely different model. It revolves around inviting a group of individuals to test software for security issues. Companies that use crowdsourced security testing extend an invitation to a group of people, or the public as such, to probe their products. This can be done directly, or through a third-party crowdsourcing platform.
Though anyone can join these programs, it is primarily ethical hackers (white hat hackers) or researchers, as they’re called within the community, that participate in them. And they participate because there’s usually a decent financial award for discovering a security flaw. Obviously, it’s up to each company to determine the sums, but it can be argued that crowdsourcing is cheaper and more effective in the long run than traditional penetration testing.
Compared to pen testing and other forms of risk assessment, crowdsourcing has many different advantages. For a start, no matter how good of a penetration tester firm you hire, a large group of people consistently looking for security vulnerabilities is far more likely to discover them. Another obvious advantage of crowdsourcing is that any such program can be open-ended, which means that it can run continually, so vulnerabilities can be discovered (and patched up) all year round.
3 Types of Crowdsourced Security Programs
Most crowdsourced security programs are centered around the same basic concept of financially rewarding those who discover a flaw or vulnerability, but they can be grouped into three main categories.
1. Bug Bounties
Virtually every tech giant—from Facebook, over Apple, to Google—has an active bug bounty program. How they work is pretty simple: discover a bug, and you’ll receive a reward. These rewards range from a couple of hundred dollars to a few million, so it’s no wonder some ethical hackers earn full-time incomes discovering software vulnerabilities.
2. Vulnerability Disclosure Programs
Vulnerability disclosure programs are very similar to bug bounties, but there is one key difference: these programs are public. In other words, when an ethical hacker discovers a security flaw in a software product, that flaw is publicized so that everyone knows what it is. Cybersecurity firms often participate in these: they spot a vulnerability, write a report about it, and offer recommendations for the developer and end user.
3. Malware Crowdsourcing
What if you download a file, but aren’t sure if it’s safe to run? How do you check if it’s malware? If you managed to download it in the first place, your antivirus suite failed to recognize it as malicious, so what you can do is head over to VirusTotal or a similar online scanner and upload it there. These tools aggregate dozens of antivirus products to check if the file in question is harmful. This, too, is a form of crowdsourced security.
Some argue cybercrime is a form of crowdsourced security, if not the ultimate form of it. This argument certainly has merit, because nobody is more incentivized to find a vulnerability in a system than a threat actor looking to exploit it for monetary gain and notoriety.
At the end of the day, criminals are the ones inadvertently forcing the cybersecurity industry to adapt, innovate, and improve.
The Future of Crowdsourced Security
According to the analytics firm Future Market Insights, the global crowdsourced security market will continue to grow in the years to come. In fact, estimates say it will be worth around $243 million by 2032. This is not just due to private sector initiatives, but also because governments around the world have embraced crowdsourced security—multiple US government agencies have active bug bounty and vulnerability disclosure programs, for example.
These predictions can certainly be useful if you want to gauge in which direction the cybersecurity industry is moving, but it doesn’t take an economist to figure out why corporate entities are adopting a crowdsourcing approach to security. Whichever way you look at the issue, the numbers check out. Plus, what could possibly be the harm in having a group of responsible and trustworthy people monitor your assets for vulnerabilities 365 days a year?
In short, unless something dramatically changes in the way software is penetrated by threat actors, we are more than likely to see crowdsourced security programs popping up left and right. This is good news for developers, white hat hackers, and consumers, but bad news for cybercriminals.
Crowdsourcing Security to Protect Against Cybercrime
Cybersecurity has been around since the first computer. It has taken on many forms over the years, but the goal has always been the same: to protect against unauthorized access and theft. In an ideal world, there would be no need for cybersecurity. But in the real world, protecting yourself makes all the difference.
All of the above applies to both businesses and individuals. But while the average person can stay relatively safe online as long as they follow basic security protocols, organizations require an all-encompassing approach to potential threats. Such an approach should primarily be founded on zero trust security.
Reference: https://www.makeuseof.com/crowdsourced-security/
Ref: makeuseof
MediaDownloader.net -> Free Online Video Downloader, Download Any Video From YouTube, VK, Vimeo, Twitter, Twitch, Tumblr, Tiktok, Telegram, TED, Streamable, Soundcloud, Snapchat, Share, Rumble, Reddit, PuhuTV, Pinterest, Periscope, Ok.ru, MxTakatak, Mixcloud, Mashable, LinkedIn, Likee, Kwai, Izlesene, Instagram, Imgur, IMDB, Ifunny, Gaana, Flickr, Febspot, Facebook, ESPN, Douyin, Dailymotion, Buzzfeed, BluTV, Blogger, Bitchute, Bilibili, Bandcamp, Akıllı, 9GAG