Menu
LinkedIn says private bug bounty program works for it better

LinkedIn says private bug bounty program works for it better

Vetting researchers prior to submitting bugs means getting higher quality reports, LinkedIn said

LinkedIn says it will keep its bug bounty program private, saying it cuts down on erroneous reports.

LinkedIn says it will keep its bug bounty program private, saying it cuts down on erroneous reports.

LinkedIn plans to continue closely vetting researchers for its bug bounty rewards program, saying it reduces the number of distracting erroneous and irrelevant reports.

The decision to keep its program private "gives our strong internal application security team the ability to focus on securing the next generation of LinkedIn's products while interacting with a small, qualified community of external researchers," wrote Cory Scott, LinkedIn's director of information security, in a blog post.

Security researchers with vetted backgrounds are invited to participate, which allow them to have the same experience as if they were on LinkedIn's internal security team, Scott wrote.

Many large technology companies such as Google, Yahoo and Facebook have public bug bounty programs, which pay rewards for valid security vulnerabilities usually based on their severity.

Scott wrote that the vast majority of bugs reported to LinkedIn from the general public "were not actionable or meaningful." The private program, launched last October, "has a signal-to-noise ratio of 7:3, which significantly exceeds the public ratios of popular public bug bounty programs."

The professional networking site will still review bugs submitted through its catch-all security email address, security@linkedin.com, he wrote.

LinkedIn uses HackerOne for its bug program, which is a company that has a secure platform that manages security vulnerability information and handles disclosure information and rewards. LinkedIn has paid out US$65,000 since the program launched, Scott wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags LinkedInExploits / vulnerabilities

Featured

Slideshows

The making of an MSSP: a blueprint for growth in NZ

The making of an MSSP: a blueprint for growth in NZ

Partners are actively building out security practices and services to match, yet remain challenged by a lack of guidance in the market. This exclusive Reseller News Roundtable - in association with Sophos - assessed the making of an MSSP, outlining the blueprint for growth and how partners can differentiate in New Zealand.

The making of an MSSP: a blueprint for growth in NZ
Reseller News Platinum Club celebrates leading partners in 2018

Reseller News Platinum Club celebrates leading partners in 2018

The leading players of the New Zealand channel came together to celebrate a year of achievement at the inaugural Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months, with more than ​​50 organisations in the spotlight.​​​

Reseller News Platinum Club celebrates leading partners in 2018
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP has honoured its leading partners in New Zealand during 2018, following 12 months of growth through the local channel. Unveiled during the fourth running of the ceremony in Auckland, the awards recognise and celebrate excellence, growth, consistency and engagement of standout Kiwi partners.

Meet the top performing HP partners in NZ
Show Comments