You are a member of the Human Resources Department of a three-year-old software manufacturerthat has several products and annual revenue in excess of $500 million. You’ve just received arequest from the manager of software development to hire three notorious crackers to probe yourcompany’s software products in an attempt to identify any vulnerabilities. The reasoning is that ifanyone could find a vulnerability in your software, they could. This will give your firm a head starton developing patches to fix the problems before anyone can exploit them. You’re not sure, andyou feel uneasy about hiring people with criminal records and connections to unsavory membersof the hacker/ cracker community. What would you do?
The job for hired people will be to report bugs in the software. Hackers are generally septicle about their image online. If someone else exploits software other than them their online image declines. In this respect they might discover bug faster than anyone else. That is one benefit. When hackers get paid more than they will make from exploitation, most probably they won't put exploit online. After the patch fix is done, company could reward their online image by mentioning bug and hacker who found it.
There are lot of hackers and crackers hired by big giants like Facebook, Google after their big exploits of software! Examples Johnny Chung Lee, Jeff Moss, Chris Putnam, Ashley Towns etc.
You are a member of the Human Resources Department of a three-year-old software manufacturerthat has several...
IT's About Business 4.1 The Heartbleed Bug What Is Heartbleed? OpenSSL, an open-source software package, is a popular type of transport layer security (TLS) software (discussed later in this chapter) that secures numerous websites around the world. Web servers use OpenSSL to encrypt sites. Such sites show up in browsers with a “lock” icon and the “https” prefix in the address bar. The encryption protects Internet sites offering banking, shopping, email, and other private communications. Roughly two out of three...
Risk management in Information Security today Everyday information security professionals are bombarded with marketing messages around risk and threat management, fostering an environment in which objectives seem clear: manage risk, manage threat, stop attacks, identify attackers. These objectives aren't wrong, but they are fundamentally misleading.In this session we'll examine the state of the information security industry in order to understand how the current climate fails to address the true needs of the business. We'll use those lessons as a foundation...