论文标题
建立信息安全市场：在线平台在错误赏金计划中的作用
Making Markets for Information Security: The Role of Online Platforms in Bug Bounty Programs
论文作者
论文摘要
安全是运作数字市场和社区的基础。如果用户怀疑共享在线的数据是否会保持安全，他们将退出平台。即使公司认真对待这些风险，安全专业知识也很昂贵，脆弱性本质上是多种多样的。公司和政府越来越多地转向Bug Bounty计划（BBPS）来众包网络安全，其中他们向个人付款以报告其系统中的脆弱性。尽管近年来，BBP的使用已大大增长，但对该市场的参与者的研究及其激励措施仍然有限。本文使用交易成本经济学的镜头研究了参与BBP的公司和研究人员的激励措施（有时称为黑客）。我们研究了在这个新兴市场中组织BBP扮演的集中平台的关键作用。我们对Hackerone BBP平台进行了分析，该数据集使用了14,000多个研究人员的新数据集，从2014年到2021年底，向超过500家公司报告了超过500家公司的公共脆弱性。我们概述了Hackerone等平台如何通过减少信息安全性来降低信息安全性信息，从而减少信息安全性漏洞，并降低信息的信息差异和相关的交易成本。
Security is an essential cornerstone of functioning digital marketplaces and communities. If users doubt that data shared online will remain secure, they will withdraw from platforms. Even when firms take these risks seriously, security expertise is expensive and vulnerabilities are diverse in nature. Increasingly, firms and governments are turning to bug bounty programs (BBPs) to crowdsource their cybersecurity, in which they pay individuals for reporting vulnerabilities in their systems. And while the use of BBPs has grown significantly in recent years, research on the actors in this market and their incentives remains limited. Using the lens of transaction cost economics, this paper examines the incentives of firms and researchers (sometimes called hackers) participating in BBPs. We study the crucial role that centralized platforms that organize BBPs play in this emerging market. We carry out an analysis of the HackerOne BBP platform, using a novel dataset on over 14,000 researchers reporting over 125,000 public vulnerabilities to over 500 firms from 2014 to the end of 2021. We outline how platforms like HackerOne make a market for information security vulnerabilities by reducing information asymmetries and their associated transaction costs.
