Posted On 27 Jan 2022
In order to better protect itself from hostile assaults, the US Department of Homeland Security (DHS) is asking security experts to find weaknesses and hack into its systems.
The Department of Homeland Security (DHS) is establishing the “Hack DHS” bug bounty program to enhance the Department’s cybersecurity resilience.
Hackers will take part in a live hacking competition that the DHS will use to identify and assess lessons learned, as well as make plans for future bug bounties.
According to DHS Secretary Mayorkas, depending on the severity of the problem detected, between $500 and $5000 would be rewarded for each vulnerability revealed. To be eligible for a prize, security researchers must reveal the specifics of the weakness to the DHS, including how it may be exploited and how a bad hacker could use it to steal information.
Bug bounties are nothing new, of course. Many private-sector firms run bug bounty programs to promote responsible vulnerability disclosure, while the US Army and Pentagon have recently introduced financial incentives for pre-approved security researchers to engage in bug hunts.
Rather than creating a new system, “Hack DHS” appears to be building on the foundations of previous efforts, ensuring that clear procedures are in place to avoid confusion.
As a result, “Hack DHS” will likely follow in the footsteps of the bug reward “Hack the Pentagon,” which imposed the following rules:
• Only those who have pre-registered and have been accepted can participate in the program.
• Participants must be eligible to work in the United States.
• You cannot be a citizen of a nation that is currently subject to US trade sanctions. So, hackers from Syria and North Korea are not welcome!
• You can’t be on the US Treasury Department’s list of bad persons and organizations linked to terrorism, drug trafficking, and other crimes.
• Each participant must consent to a background check.
In the grand scheme of things, a maximum $5000 bounty isn’t particularly generous, especially when compared to other initiatives that are designed to seek and remove bugs. However, one imagines that some security researchers will appreciate the kudos they might get for helping the DHS close potentially life-threatening security holes in its systems.
