4

I recently discovered a major security vulnerability (SQL injection) in one of my companies projects in my free time. I'm working there as a developer, not as a security researcher, but after developing a lot of stuff, you know where to search for vulnerabilities :)

As it is a big company, I'm not actually working on the vulnerable project and no one I know is.

To report the vulnerability, I used the "responsible disclosure" program open to the public. It basically is a way to report a vulnerability, give them reasonable time for them to fix it and get recognized for it. I'm not aware of any other processes inside the company to report vulnerabilities.

I was however surprised to find that employees are excluded from the "responsible disclosure program" in terms of reward (ie. being listed on the disclosure program website as a contributor and/or getting monetary compensation)

On the one hand, there might be conflicts of interest. Employees working on projects might add security vulnerability on purpose to later claim the reward or conspire with coworkers to do so. And it's probably in the best interest of the employee to report security issues as these might affect the reputation of the company and in the worst case may even cost his job.

On the other hand, it doesn't matter where the employee is working if the vulnerability is spotted while being off clock. Rewards might encourage employees to search for vulnerabilities off-clock which benefits the company by removing security issues and only paying for the research if actual issues are found. Employees might also rather look for security issues at other companies that do reward findings.

I'm not complaining about the fact that I wasn't rewarded. I enjoy searching for security issues and it was fun enough already and my work is great. But I'm trying to understand the reasoning behind this policy and if this is usual in the industry.

Improve this question
6
  • I would imagine it's up to the specific company
    – Kilisi ♦
    May 22, 2016 at 1:57
  • @Kilisi It is indeed up to the company. They can create policies as they see fit. Just wanted to see if this is usual and is reasonable.
    – Simon
    May 22, 2016 at 2:07
  • 3
    In most places finding bugs is considered your job if you are a software developer. If the chef in the company's cafeteria finds a security bug, they will much more likely get a reward.
    – gnasher729
    May 22, 2016 at 7:00
  • @gnasher729 True indeed.
    – Simon
    May 22, 2016 at 13:11
  • 1
    If you're an employee you probably have access to a bug tracking system. Next time use that rather than a public facing reporting system. That way you will get recognised by that team as able to report important bugs.
    – Brandin
    May 23, 2016 at 6:28

2 Answers 2

Reset to default
12

General policy is that, _ no, _ companies will not pay employees for finding bugs, since some idiots take that as encouragement to create bugs they can later "find" and claim the reward for.

Bug-finding and -fixing is simply part of your job. You're already being paid for that time.

If you really feel a need to be rewarded for this, remember that detecting and repairing a serious issue will look wonderful on your year-end evaluation.

Improve this answer
3
  • As I said, I wasn't really expecting to get rewarded for this, I just wanted to see if this is normal. I'm not working on the project though, won't be involved in the fix and this won't be reflected on my evaluation. Good point on creating bugs to find them though.
    – Simon
    May 22, 2016 at 2:03
  • 1
    Indeed a good answer, accepted it. Just too much of a conflict of interest and I'm already getting paid to find bugs. Thanks for your confirmation, I was thinking along the lines from the beginning, but just wanted to be sure (maybe one day I'll manage a company and have to decide such an issue)
    – Simon
    May 22, 2016 at 13:13
  • To add to this answer, it wouldn't even necessarily need someone deciding to CREATE bugs for it to become an issue... it would also create am incentive for ignoring the bugs you find while on the clock, and then pretending you found them off the clock later on. Why announce an issue ASAP or fix it right away while on the clock if you can get paid more to say you found it off the clock?
    – Andrew Whatever
    May 27, 2016 at 22:36
0

Not for own products, but it is nice if otherwise.

Not in their own software products, because the employees are already paid for maintaining them. Even if the employee is from department not directly developing the product, their contribution (not only suggestions, but also reporting issues) is expected not to be paid.

But it is nice if they reward reporting any other security vulnerabilities. This way they are motivating the people's proactive approach to security issues. Perhaps not all responsible disclosures deserve rewarding, but security ones often do. For example, let's say that an employee accidentally finds out relatively easy way to access any information stored in company's HR system powered by internally deployed 3rd-party software product and reports it without delays. I've seen such things happening, for example after the upgrade. By early warning the employee can save the company lot of troubles. (Their concern is: Maybe another employee could find it without reporting and potentially misuse it.) Then employee's manager or department in charge of security of that program can decide on some incentive. Either direct (some money) or at least indirect (hey, we've found some extra funds in our budget so you can order that 27" display for your workplace if you'd appreciate it). I have seen this happening as well.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .