Penetration Testing vs Bug Bounty: what’s the difference

Penetration Testing and Bug Bounty programs are used to detect vulnerabilities and bugs in web development platforms while simulating the potential attacks and prevent them. But what's the difference between the two and which one should you use? 

What is Penetration Testing?

Penetration Testing or Pen Testing is a type of security testing that is used to find errors, bugs, threats and vulnerabilities in a software system or web application that an attacker can exploit. It is a simulated attack that penetration testers or ethical hackers make in order to find all possible vulnerabilities in a software system and cover them.

More on Penetration testing: 

• Penetration testing: tools or humans?
• Crowdsourced vs. Traditional Penetration Testing

What is bug bounty program?

Bug Bounty program is the incentivized deal offered by many websites, companies and software developers through which the hackers and individual can receive recognition for reporting vulnerabilities and bugs. They are the programs that run continuously for a defined period of time. These programs usually continue for the product’s lifetime and allow the hacker community to find new vulnerabilities as the application changes.

Differences between Pentests and bug bounty

1. COST

Penetration Testing cost range from $4,000 to $100,000 depending upon the nature of the software system, network size and scope of the assessment. Complex and extensive applications can cost even more than this rate. According to RSI and u-tor, on average, a high quality, professional penetration testing can cost from $10,000-$30,000. 

Bug Bounty programs are relatively cheaper than the pentest programs since the hackers are paid per bug found. Companies like Facebook and Apple are known for their investments in bug bounty: 

Facebook offers a minimum payout of $500 for accepted bugs, and no maximum—meaning that there’s no specific upper limit on how valuable a bug could potentially be. So far the largest payout from Facebook's bounty is $50,000, while Apple will pay out up to $1 million for the most valuable iOS bugs.
Source: Wired

Moreover, some bug bounty programs are free and other incentives are given to the researchers that make them rank high on the hosting platform websites. 

2. ADVANTAGES

Advantages of Penetration Testing are as follows:

• It uncovers the vulnerabilities of the system. It generates a report describing all the vulnerabilities and errors of the system.

• It reveals the strategies of hackers that how they can exploit the system. Moreover, it also highlights the parts of the application that needs improvement.

• It uses small dedicated teams to uncover the vulnerabilities faster

• It allows the testers to test both internal systems and external systems

Advantages of Bug Bounty programs are as follows:

• In bug bounty program, you get multiple opinions about your test because there are several researchers and testers with diversified skill sets that are working on it

• It is cheaper than the penetration testing 

• You make boundaries and set rules in order to test the programs. You decide what to test and how far you want to test an application

• You don’t have to pay extra. If your researcher found nothing in the assessment, you don’t have to pay.

3. DISADVANTAGES

Disadvantages of Pentests are as follows:

• If the tests are not done properly they can cost you adverse effects on the system. They can even damage your system or crash the server

• Small group of skilled testers are involved in penetration testing

• It is dependent on time and scope of the project

• Penetration testing is not continuous testing

Disadvantages of Bug Bounty programs are as follows:

• During the bug bounty program, no one takes the ownership of the program as they know that they will be paid only if they uncover the vulnerabilities

• There are several trust issues when handing over the project to a company or individual because you don’t know them initially

• Only test websites and web applications and when they are live for general public

4. SCOPE

The scope of the Pen Testing depends upon the needs of the client. There are several types of pen testing assessments; internal testing, external testing, web application testing, embedded system testing and much more.

The Bug Bounty programs are conducted to test websites and web applications that are available to general public. This is the reason why bug bounty programs are not able to detect the vulnerabilities of the websites and web applications before they are live for the public.

5. LENGTH / DURATION OF THE TEST

Penetration Testing is typically conducted for a short period of time i.e. two or three days, twice a year.

On the other hand, Bug Bounty programs are not dependent on the time frame. This is the main reason why bug bounty programs are used for continuous testing. They are perfect for the companies that release new updates and products on regular intervals.

6. HOW TO DO / METHODOLOGY

STEPS TO PERFORM PENETRATION TESTING

Following steps are involved in penetration testing:

1. Planning phase

2. Discovery phase

3. Attack phase

4. Reporting vulnerability phase

STEPS TO LAUNCH A BUG BOUNTY PROGRAM

Steps to launch a Bug Bounty program are as follows:

1. Set up a vulnerability assessment program

2. Carefully decide the scope and price of the program

3. Decide the type of bug bounty program; private or public

4. Set up a testing environment related to the nature of application

5. Decide the blackout dates and quite periods

6. Gain the support from different related departments

7. Start with a small test

8. Recruit the right staff

9. Market the bug bounty program to general public

10. Ready to solve the vulnerability

    
    
    

7. WHO CONDUCT PEN TESTS?

Pen tests are carried out by experienced ethical hackers employed by specialist cyber security companies. Professional ethical hackers are required to have undertaken qualifications in cyber security, ensuring that they have an in-depth knowledge of the legal, technical, and ethical aspects of testing. Before any work is undertaken by a penetration tester, it is common practice to know the person’s identity and sign a contract to agree the scope of the work.

Bug Bounty programs also attract professional ethical hackers, however, as anyone can sign up to a program, testing will typically be carried out by a mixture of professionals and amateurs, with hugely varied experience, knowledge, and ethics.

8. FEEDBACK

In Penetration Testing, you not only receive a list of vulnerabilities, but good pen testers also give you feedback on your application. Moreover, they provide you with the necessary support to overcome those vulnerabilities.

On the other hand, Bug Bounty programs will only give you a report describing the vulnerability with no feedback at all. Rarely, if some organization strives to work with you then it can give a little feedback.

Constant PenTest? Ask WhiteJar!

WhiteJar is the solution that allows you to run constant pen tests. Corporates and hundreds of experienced ethical hackers meet on WhiteJar's collaboration platform (powered by UNGUESS) to start both short and long-term projects. By relying on a community, companies can finally overcome the existing gap between requested skills and availability on the market. 

Resources

Guru99, Freecodecamp, Vaadata, Hacktrophy, Bugcrowd, The Security Bureau, Cyrextech, Toreon, Stardust, Cram