Bug bounties to become part of Swiss cyber-security arsenal

After a pilot project in 2021, authorities now want to systematically draw on the skills of “ethical hackers” to find flaws in government IT systems. “Often, standardised security tests are no longer sufficient to uncover hidden loopholes” in official websites or software components, the finance ministry wrote on Wednesday. As a result, a centralised platform for bug bounty programmes – initiatives which offer financial rewards to hackers to identify cyber vulnerabilities – will be set up and run by the National Cybersecurity Centre (NCSC). This latter will work with Bug Bounty Switzerland SA, a company with expertise in the area and a large existing community of ethical hackers. The goal is to extend the schemes to cover “as many Federal Administration systems as possible”, with the first projects to start already this year, the finance ministry said. The decision follows a pilot project run over two weeks in May 2021 which uncovered ten vulnerabilities – one of them critical –...