Ethical hacking for boosting IoT vulnerability management: a first look into bug bounty programs and responsible disclosure
Ethical hacking for boosting IoT vulnerability management: a first look into bug bounty programs and responsible disclosure
复制标题
促进物联网漏洞管理的道德黑客：初步探讨错误赏金计划和负责任的披露
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
M. Janssen
中科院分区：
文献类型：
--
作者：
A. Ding;Gianluca Limon De Jesus;M. Janssen
由于面向物联网的安全事件越来越多，物联网的安全备受关注。物联网硬件和软件安全漏洞被利用，影响到许多公司和个人。由于漏洞的原因超出了纯粹的技术措施，因此当今迫切需要揭开物联网“安全情结”的神秘面纱，并为公司、消费者和监管机构制定实用的指导方针。在这篇文章中，我们提出了一项针对物联网中一个未知领域的初步研究，通过说明众包伦理黑客方法在加强物联网漏洞管理方面的潜力。我们专注于Bug Bounty计划(BBP)和负责任的披露(RD)，它们刺激黑客报告漏洞以换取金钱奖励。我们开展了一项定性调查，并辅之以文献调查和专家访谈，以探索BBP和RD如何促进以有效和经济高效的方式识别、分类、优先排序、补救和缓解物联网漏洞的实践。除了为物联网利益相关方提供切实的指导方针外，我们的研究还揭示了将BBP和RD与现有安全实践(例如渗透测试)相结合的系统集成路径，以进一步提高物联网的整体安全性。
The security of the Internet of Things (IoT) has attracted much attention due to the growing number of IoT-oriented security incidents. IoT hardware and software security vulnerabilities are exploited affecting many companies and persons. Since the causes of vulnerabilities go beyond pure technical measures, there is a pressing demand nowadays to demystify IoT "security complex" and develop practical guidelines for both companies, consumers, and regulators. In this paper, we present an initial study targeting an unexplored sphere in IoT by illuminating the potential of crowdsource ethical hacking approaches for enhancing IoT vulnerability management. We focus on Bug Bounty Programs (BBP) and Responsible Disclosure (RD), which stimulate hackers to report vulnerability in exchange for monetary rewards. We carried out a qualitative investigation supported by literature survey and expert interviews to explore how BBP and RD can facilitate the practice of identifying, classifying, prioritizing, remediating, and mitigating IoT vulnerabilities in an effective and cost-efficient manner. Besides deriving tangible guidelines for IoT stakeholders, our study also sheds light on a systematic integration path to combine BBP and RD with existing security practices (e.g., penetration test) to further boost overall IoT security.