US government launches first VDP program for federal civilian agencies

Jessica Haworth 08 June 2021 at 12:41 UTC

Bug bounty vendor Bugcrowd to oversee the project

The US Cybersecurity and Infrastructure Security Agency (CISA) has launched its first federal civilian vulnerability disclosure policy (VDP) program in partnership with Bugcrowd.

The federal government agency launched the program today (June 8) with government IT contractor Endyna and the bug bounty platform, which will administer the scheme.

Researchers will be asked to test for vulnerabilities in Federal Civilian Executive Branch (FCEB) agencies, which Bugcrowd hopes “will set a new precedent for federal civilian enterprise-wide security”, it announced in a press release.

Read more of the latest bug bounty news

It will be the first time that US civilian agencies will work with the hacker community to secure their networks. Endyna will provide software-as-a-service (SaaS) platform to the program.

The press release reads: “In addition to the CISA-funded VDP platform service, FCEB agencies can also accelerate digital transformation strategies and implement their own bug bounty programs from Bugcrowd and Endyna, enabling them to ensure that security assessments become part of their software development lifecycle (SDLC), also commonly called [known] as ‘Shifting Left’.”

Covering a ‘distributed attack surface’

Ashish Gupta, CEO at Bugcrowd, told The Daily Swig that the partnership with CISA was the result of the Binding Operational Directive 20-01, which requires all federal agencies to develop a Vulnerability Disclosure Policy (VDP).

The agency put out a request for proposals, Gupta said, and chose Bugcrowd to provide operational management of the resulting program.

Gupta added: “Technology has become more distributed, and the attack surface has expanded as a result.

“Just like enterprises, government agencies need to embrace a layered approach to better secure their digitally connected assets.

“We are excited to be able to offer Federal Civilian Executive Branch (FCEB) agencies a proven crowdsourced cybersecurity platform that allows them to leverage the wealth of information from ethical researchers to identify vulnerabilities and better protect critical government systems and public data.”

YOU MAY ALSO LIKE GitHub changes policy to welcome security researchers