DoD Effort Aligns With Private Sector

The Hack the Pentagon pilot was the first bug bounty in the history of the federal government, officials said.

Using vetted hackers, DoD used a similar method to that of commercial-sector crowdsourcing, which identifies security vulnerabilities in DoD’s systems. ”Hack the Pentagon” was modeled after similar competitions conducted by some of the nation’s biggest companies to improve the security and delivery of networks, products, and digital services, according to officials.

When Hack the Pentagon results were released in June, the department recognized a need to provide a standard avenue for researchers to report vulnerabilities, said DoD’s Cyber Policy Senior Advisor, Charley Snyder and Defense Digital Service Bureaucracy Hacker Lisa Wiswell in a briefing with reporters Nov. 18.

The new policy, effective today, allows for a safe, secure, and legal opportunity for researchers to report such vulnerabilities, Snyder and Wiswell said.

While private industry produces similar policies, DoD’s initiative is the first in the federal government, officials said.

DoD consulted with the Justice Department’s criminal division when developing DoD’s Vulnerability Disclosure Policy, and Leslie Caldwell, DOJ’s assistant attorney general, called the initiative “a laudable way to help computer security researchers use their skills in an effective, beneficial and lawful manner to reduce security vulnerabilities.”

‘Hack The Army’ Debuts Today

The second initiative launching today is “Hack the Army,” the second bug-bounty challenge in DoD, Wiswell said, adding the Army’s initiative is modeled after the initial “Hack the Pentagon” challenge. Registration for the program begins today.

The Army bug bounty challenge will employ about 500 vetted security researchers, and will focus more on operationally relevant web sites, particularly those that affect Army recruiting, officials noted.

Army Secretary Eric Fanning announced his department’s cyber security challenge earlier this month as it partners with DoD’s Defense Digital Service.

“The security of these foundational systems is incredibly important to me, and security is everyone’s responsibility,” Fanning said.

The Army’s bug bounty program, much like DoD’s effort, will provide incentives to researchers to focus on specific high-priority networks and systems.

Officials said DoD has focused on efforts to modernize security, and to find ways to tap into sources of talent across the country. Both the Army and DoD programs and policies align with those goals, they added.

Information about the Vulnerability Disclosure Policy and the Hack the Army bug bounty challenge are available at the links above.

(Follow Terri Moon Cronk on Twitter: @MoonCronkDoD)