The rise of ethical hacking and chasing down bug bounties

The word “hacker” might by synonymous with danger for many small businesses, but there are ethical hackers out there – those that search out the bugs and flaws and report them to companies before they are exploited by the “baddies”.

According to the Department of Digital, Culture, Media & Sport, 43% of businesses and 19% of charities have been victim to a cyber security breach or attack in the last 2 months – and it could be time to start fighting fire with fire, as job search platform Joblift has recently reported that there has been a significant increase in both the supply and demand of hacker vacancies in the UK.

Over the last 24 months the number of ethical hacker jobs posted have increased in line with the average for the UK’s whole job market (around 4%), but the number of Google searches for ethical hacker jobs have increased by 12% monthly, on average. Joblift suggests that these figures imply that the demand for jobs is outweighing the supply.

What makes a great hacker

Around 70% of all ethical hacker job advertisements requested official accreditation (CREST/CHECK/CCT/APP/INF). A quarter of the job posts requested knowledge of programming languages, and just over a fifth wanted security checked candidates.

In terms of softer skills, the job advertisements called for: flexibility (21%); innovation (12%); passion (11%); confidence (8%); and communication skills (6%).

Interestingly, only 15% of advertisements called for a university degree.

According to a report by HackerOne, nearly 58% of the hacker community is self-taught. Around 50% have studied computer science at undergraduate or graduate level, but less than 5% have learned hacking skills in a classroom.

Disclosure policies

A bug bounty programme offers a financial reward for ethical hackers to find and report flaws. However, it’s not always money that motivates a hacker.

HackerOne reports that one in four hackers have found a vulnerability that they have not reported because the company in question didn’t have a way to disclose it.

Of course, they can try emailed or sending a message on social media etc., but HackerOne says that implementing a Vulnerability Disclosure Policy (VDP) can be very effective – for example, the US Department of Defense has resolved nearly 3,000 vulnerabilities through their VDP.

Overall – even if a company isn’t looking to take on an ethical hacker full time, it might be worth considering whether there is a proper process in place to report flaws.

After all, if an ethical hacker wants to warn you about something, it would be a good idea to listen – next time you might not be so lucky, and these days businesses need to understand the threat of cyber-attacks.

Share this story