is known Facebook to offer bounties to security researchers who discover and report vulnerabilities to its engineers. According to the social network, in 2013 it paid out $1.5 million for reporting bugs in the website's code. The company says that amount will increase in 2014.
According to Facebook, 14,763 bugs were reported in its code in 2013, a 246% increase from 2012. However, Facebook's security team says that many of these were false positives, and only 687 of them turned out to be worth fixing. Fortunately, about six percent were classified as high-severity issues.
“Most reports are not for valid security issues, but we assume they are until we fully evaluate them. This makes it more difficult to triage high-priority issues,” said Collin Greene, a Facebook security engineer.
“We have managed to reduce the average resolution time for high-severity issues to 6 hours and continue to focus on efficiency as the number of bug reports grows.”
Most of the valid bug reports were submitted from India, but they appear to be of low value. Facebook had 136 reports from India and paid an average of $1,353 for each.
American researchers discovered 92 bugs, and were paid $2,272 each, while British researchers discovered 40 valid bugs and received an average of $2,950 each. The highest payment from Facebook was to a Brazilian researcher (Reginaldo Silva), who earned $33,500 for finding an external XML vulnerability in a PHP page.
Of course, to the above amounts, the funding amounts for the social network's technical workers should be added, who, in addition to correcting the errors discovered by others, continue to scan and optimize the website's code.
So why is security an expensive sport? But it remains cheaper than a possible serious breach in the social network. A hacking scenario, with possible data leaks, would be the worst that could happen, as in addition to downtime, the trust of its members would also be shaken.
