DOD to invite security experts to Hack the Pentagon

The cyber bug bounty program is a first for the federal government, but you'll need to undergo a background check

2297308
 
Credit: Garrett Dipuma/DOD

The U.S. Department of Defense plans to ask computer security experts to Hack the Pentagon as part of a push to improve its cyber defenses.

The initiative is similar to the bug bounty programs run by commercial software companies seeking to reward hackers who report security vulnerabilities in code. The DOD says it's the first cyber bug bounty program in the history of the federal government.

The DOD program, which will launch in April, will ask participants to examine its public Web pages, searching out vulnerabilities and attack launching points.

But the program will only go that far. The DOD's classified networks will be off-limits to the participants, and they won't be free to launch actual attacks on any of the department's public-facing sites.

The Pentagon will recruit participants through crowdsourcing websites, and they'll be required to register and submit to a background check. Once approved, they'll have access to a system chosen by the DOD for a predetermined amount of time.

Participants could be eligible for "monetary awards and other recognition," the DOD said.

Jonathan Cran, vice president of operations at Bugcrowd, which runs bug bounty programs for businesses, said they are a cost-effective way of finding cyber problems.

"For the same amount of money spent on bug bounty where you pay for results rather than paying for effort and time, versus hiring consultants, there’s no better way to do it," he said.

Secretary of Defense Ash Carter has spoken a lot about the need for his department to work more closely with Silicon Valley and emulate some of the ways in which tech start-ups operate and innovate.

The Hack the Pentagon program is a product of just such an initiative: the Defense Digital Service, a small team of engineers, affiliated with the U.S. Digital Service, that seeks to improve the DOD's technological agility. Carter launched the Defense Digital Service last November.

“I am always challenging our people to think outside the five-sided box that is the Pentagon,” he said in a statement. “Inviting responsible hackers to test our cybersecurity certainly meets that test."

The Pentagon said it would offer more details about the program and how to apply in the coming weeks.

To comment on this article and other CIO content, visit us on Facebook, LinkedIn or Twitter.
Download the CIO October 2016 Digital Magazine
Notice to our Readers
We're now using social media to take your comments and feedback. Learn more about this here.