Security breaches can lead to damage to a business’s finances, operations and reputation. What many companies might fear most is the latter: damage to their reputation. This may explain why 65% of organizations want to be seen as infallible, as per a recent HackerOne survey. Meanwhile, 64% maintain a culture of security through obscurity, and 38% aren’t open about their cybersecurity practices at all.

The continued practice of security through obscurity is harmful. When a group denies vulnerability and does not seek help, it leaves the door open for damaging attacks. Still, it’s not easy to open up about your weaknesses. So, where does this leave the ethical hacker? They may become the target of a criminal investigation.

Psychology versus reality

The truth is that attackers could breach any company on earth. Still, business leaders are like any other human being. It’s hard for us to admit our weaknesses. In the corporate world, this refusal to admit vulnerability may be pathologic. Only 12% of those surveyed have departments (outside of security and IT) that make cyber awareness and training a core focus, according to the survey. And only 29% of boards get “deeply involved” in cybersecurity strategy.

None of this helps fix the problem of weak security. It’s key that business leaders know the risks. Also, teamwork through vulnerability reporting helps others to improve their security posture as well. But none of this happens if you don’t look under the hood.

Are ethical hackers the cure?

Ethical hacking involves an authorized attempt to gain unauthorized access to a computer system, app or data. This can mean copying the strategies and actions of malicious attackers. Ethical hacking helps find security vulnerabilities, which the team can then fix before a threat actor has the chance to exploit them.

On the surface, this sounds like a good thing. But many companies are reluctant to work with ethical hackers. Even if these hackers are part of an internal team, management might force them to work in obscurity. A full 67% of those surveyed said they prefer to accept software vulnerabilities rather than work with hackers.

Where resistance comes from

Why do companies resist this type of scrutiny? On one hand, many believe fixing security flaws hampers innovation or hurts operations. In fact, due to pressure to deliver products faster, 81% of developers at large organizations admit to knowingly releasing vulnerable applications.

So, are bug bounty programs worth it? It depends on the details. If the bounty hunters discover and remedy a major vulnerability, that’s a good thing. Still, a company should seek advice from legal when crafting a program. The last thing anyone wants is a weak set of terms and conditions through which a hired offensive security tester could stray (by mistake or on purpose) and target out-of-bounds systems.

Don’t do me any favors

Consider the case of the St. Louis Post-Dispatch exposing a problem at the Missouri Department of Elementary and Secondary Education. It turns out the agency’s website had displayed over 100,000 Social Security numbers for school teachers, administrators and counselors in its HTML source code. The reporters informed the agency of the blunder before releasing the story, which gave the school plenty of time to take the pages down.

The result? Missouri Governor Mike Parson launched a criminal investigation of the reporter behind the story. Was it ethical hacking to protect personal information? Or did the reporter launch a political hit job? As we said earlier, nobody likes to have their weakness exposed.

Remove security obscurity

Each organization must accept the level of risk involved on both ends: that is, the risk of security breach versus the risk of ethical hacking assistance. HackerOne believes the risk of undiscovered vulnerability is much higher.

Some of their suggestions include:

  • Encourage regulators to provide liability protections that promote incident disclosure
  • Provide third-party security researchers with clear guidelines for reporting weaknesses
  • Reward / incentivize developers for fixing issues and involve them in security processes
  • Require robust security checks on suppliers.

The worst thing a company can do is ignore the problem. Plus, it all starts at the top. The organizations that develop a comprehensive security strategy with executive buy-in have the best chance to come out with their reputations intact.

More from Risk Management

What should Security Operations teams take away from the IBM X-Force 2024 Threat Intelligence Index?

3 min read - The IBM X-Force 2024 Threat Intelligence Index has been released. The headlines are in and among them are the fact that a global identity crisis is emerging. X-Force noted a 71% increase year-to-year in attacks using valid credentials.In this blog post, I’ll explore three cybersecurity recommendations from the Threat Intelligence Index, and define a checklist your Security Operations Center (SOC) should consider as you help your organization manage identity risk.The report identified six action items:Remove identity silosReduce the risk of…

Obtaining security clearance: Hurdles and requirements

3 min read - As security moves closer to the top of the operational priority list for private and public organizations, needing to obtain a security clearance for jobs is more commonplace. Security clearance is a prerequisite for a wide range of roles, especially those related to national security and defense.Obtaining that clearance, however, is far from simple. The process often involves scrutinizing one’s background, financial history and even personal character. Let’s briefly explore some of the hurdles, expectations and requirements of obtaining a…

Ransomware payouts hit all-time high, but that’s not the whole story

3 min read - Ransomware payments hit an all-time high of $1.1 billion in 2023, following a steep drop in total payouts in 2022. Some factors that may have contributed to the decline in 2022 were the Ukraine conflict, fewer victims paying ransoms and cyber group takedowns by legal authorities.In 2023, however, ransomware payouts came roaring back to set a new all-time record. During 2023, nefarious actors targeted high-profile institutions and critical infrastructure, including hospitals, schools and government agencies.Still, it’s not all roses for…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today