Security breaches can lead to damage to a business’s finances, operations and reputation. What many companies might fear most is the latter: damage to their reputation. This may explain why 65% of organizations want to be seen as infallible, as per a recent HackerOne survey. Meanwhile, 64% maintain a culture of security through obscurity, and 38% aren’t open about their cybersecurity practices at all.

The continued practice of security through obscurity is harmful. When a group denies vulnerability and does not seek help, it leaves the door open for damaging attacks. Still, it’s not easy to open up about your weaknesses. So, where does this leave the ethical hacker? They may become the target of a criminal investigation.

Psychology Versus Reality

The truth is that attackers could breach any company on earth. Still, business leaders are like any other human being. It’s hard for us to admit our weaknesses. In the corporate world, this refusal to admit vulnerability may be pathologic. Only 12% of those surveyed have departments (outside of security and IT) that make cyber awareness and training a core focus, according to the survey. And only 29% of boards get “deeply involved” in cybersecurity strategy.

None of this helps fix the problem of weak security. It’s key that business leaders know the risks. Also, teamwork through vulnerability reporting helps others to improve their security posture as well. But none of this happens if you don’t look under the hood. 

Are Ethical Hackers the Cure?

Ethical hacking involves an authorized attempt to gain unauthorized access to a computer system, app or data. This can mean copying the strategies and actions of malicious attackers. Ethical hacking helps find security vulnerabilities, which the team can then fix before a threat actor has the chance to exploit them.

On the surface, this sounds like a good thing. But many companies are reluctant to work with ethical hackers. Even if these hackers are part of an internal team, management might force them to work in obscurity. A full 67% of those surveyed said they prefer to accept software vulnerabilities rather than work with hackers.

Where Resistance Comes From

Why do companies resist this type of scrutiny? On one hand, many believe fixing security flaws hampers innovation or hurts operations. In fact, due to pressure to deliver products faster, 81% of developers at large organizations admit to knowingly releasing vulnerable applications.

So, are bug bounty programs worth it? It depends on the details. If the bounty hunters discover and remedy a major vulnerability, that’s a good thing. Still, a company should seek advice from legal when crafting a program. The last thing anyone wants is a weak set of terms and conditions through which a hired offensive security tester could stray (by mistake or on purpose) and target out-of-bounds systems. 

Don’t Do Me Any Favors

Consider the case of the St. Louis Post-Dispatch exposing a problem at the Missouri Department of Elementary and Secondary Education. It turns out the agency’s website had displayed over 100,000 Social Security numbers for school teachers, administrators and counselors in its HTML source code. The reporters informed the agency of the blunder before releasing the story, which gave the school plenty of time to take the pages down.

The result? Missouri Governor Mike Parson launched a criminal investigation of the reporter behind the story. Was it ethical hacking to protect personal information? Or did the reporter launch a political hit job? As we said earlier, nobody likes to have their weakness exposed.

Remove Security Obscurity 

Each organization must accept the level of risk involved on both ends: that is, the risk of security breach versus the risk of ethical hacking assistance. HackerOne believes the risk of undiscovered vulnerability is much higher. 

Some of their suggestions include:

  • Encourage regulators to provide liability protections that promote incident disclosure
  • Provide third-party security researchers with clear guidelines for reporting weaknesses
  • Reward / incentivize developers for fixing issues and involve them in security processes
  • Require robust security checks on suppliers.

The worst thing a company can do is ignore the problem. Plus, it all starts at the top. The organizations that develop a comprehensive security strategy with executive buy-in have the best chance to come out with their reputations intact.

More from Risk Management

Did Brazil DSL Modem Attacks Change Device Security?

From 2011 to 2012, millions of Internet users in Brazil fell victim to a massive attack against vulnerable DSL modems. By configuring the modems remotely, attackers could redirect users to malicious domain name system (DNS) servers. Victims trying to visit popular websites (Google, Facebook) were instead directed to imposter sites. These rogue sites then installed malware on victims' computers. According to a report from Kaspersky Lab Expert Fabio Assolini citing statistics from Brazil's Computer Emergency Response Team, the attack ultimately…

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…

Worms of Wisdom: How WannaCry Shapes Cybersecurity Today

WannaCry wasn't a particularly complex or innovative ransomware attack. What made it unique, however, was its rapid spread. Using the EternalBlue exploit, malware could quickly move from device to device, leveraging a flaw in the Microsoft Windows Server Message Block (SMB) protocol. As a result, when the WannaCry "ransomworm" hit networks in 2017, it expanded to wreak havoc on high-profile systems worldwide. While the discovery of a "kill switch" in the code blunted the spread of the attack and newly…

Why Operational Technology Security Cannot Be Avoided

Operational technology (OT) includes any hardware and software that directly monitors and controls industrial equipment and all its assets, processes and events to detect or initiate a change. Yet despite occupying a critical role in a large number of essential industries, OT security is also uniquely vulnerable to attack. From power grids to nuclear plants, attacks on OT systems have caused devastating work interruptions and physical damage in industries across the globe. In fact, cyberattacks with OT targets have substantially…