| Title | Cybersecurity Innovation in Government: A Case Study of U.S. Pentagon's Vulnerability Reward Program |
| Publication Type | Conference Paper |
| Year of Publication | 2017 |
| Authors | Chatfield, A. T., Reddick, C. G. |
| Conference Name | Proceedings of the 18th Annual International Conference on Digital Government Research |
| Publisher | ACM |
| Conference Location | New York, NY, USA |
| ISBN Number | 978-1-4503-5317-5 |
| Keywords | bug bounty program, cybersecurity, Department of Defense, E-Government, government cybersecurity, Human Behavior, policy-based governance, pubcrawl, resilience, Resiliency, U.S. Pentagon, Vulnerability reward program |
| Abstract | The U.S. federal governments and agencies face increasingly sophisticated and persistent cyber threats and cyberattacks from black hat hackers who breach cybersecurity for malicious purposes or for personal gain. With the rise of malicious attacks that caused untold financial damage and substantial reputational damage, private-sector high-tech firms such as Google, Microsoft and Yahoo have adopted an innovative practice known as vulnerability reward program (VRP) or bug bounty program which crowdsources software bug detection from the cybersecurity community. In an alignment with the 2016 U.S. Cybersecurity National Action Plan, the Department of Defense adopted a pilot VRP in 2016. This paper examines the Pentagon's VRP and examines how it may fit with the national cybersecurity policy and the need for new and enhanced cybersecurity capability development. Our case study results show the feasibility of the government adoption and implementation of the innovative concept of VRP to enhance the government cybersecurity posture. |
| URL | http://doi.acm.org/10.1145/3085228.3085233 |
| DOI | 10.1145/3085228.3085233 |
| Citation Key | chatfield_cybersecurity_2017 |
Cybersecurity Innovation in Government: A Case Study of U.S. Pentagon's Vulnerability Reward Program