Access your Pro+ Content below.
Private market growing for zero-day exploits and vulnerabilities
This article is part of the Information Security magazine issue of Dec. 2012/Volume 14 / No. 10
In 2011, vulnerability researcher Luigi Auriemma discovered more than six dozen vulnerabilities in a variety of enterprise software packages, selling each software bug for a modest bounty to the Zero Day Initiative, a group set up by TippingPoint, and now a subsidiary of Hewlett-Packard. A well-known white-market buyer for software vulnerabilities, HP’s TippingPoint, uses the information to protect its customers while working with the vendor whose software is affected to close the security hole. While the company does not disclose how much it pays researchers, payments typically fall between $1,000 and $5,000, with most less than $2,000, according to sources. Yet, with penetration testers, industrial spies, law enforcement, intelligence agencies and the military all looking for exploits to undisclosed flaws to fuel their cyber-operations, such modest bounties are no longer the incentive they once were. Vulnerability researchers, once starved for a market for their security flaws, now have new options. Aureimma, for example, ...
Access this PRO+ Content for Free!
Features in this issue
System that helps law enforcement track down fugitives was tested thoroughly to prove to CTOs and IT teams that the company is serious about security.
Exploitable vulnerabilities are becoming harder to find in popular software, but information on such flaws is increasingly valuable, and many security researchers are no longer willing to give it up for free.
Information Security magazine discussed critical infrastructure protection with three experts and explore whether any near-term solutions can be implemented to bolster network defenses.
Biometric authentication helps ensure only authorized smartphone users can access a network. David Jacobs weighs the pros and cons of three methods.
Columns in this issue
Information Security Magazine examines key security concerns in the field of critical infrastructure protection and explores options for mobile biometric authentication because you’ll need to think about a new security strategy as mobile devices outnumber desktops in the enterprise.
A trusted advisor and a strong communicator and promoter, a good CISO should be a jack-of-all-trades to rally the IT security team to support the business needs by minimizing risk.
Security expert and Information Security magazine columnist goes one-on-one with Aaron Turner, co-founder of security consulting firm N4Struct.