Bug Auctions: Vulnerability Markets Reconsidered

This paper argues that a vulnerability market in which software producers receive a time-variable reward to free-market testers who identify vulnerabilities can best be considered as an auction; auction theory is used to tune the structure of this ‘bug auction’ forency and to better defend against attacks.

Abstract

Measuring software security is difficult and inexact; as a result, the market for secure software has been compared to a ‘market of lemons.’ Schechter has proposed a vulnerability market in which software producers offer a time-variable reward to free-market testers who identify vulnerabilities. This vulnerability market can be used to improve testing and to create a relative metric of product security. This paper argues that such a market can best be considered as an auction; auction theory is then used to tune the structure of this ‘bug auction ’ for efficiency and to better defend against attacks. The incentives for the software producer are also considered, and some fundamental problems with the concept are articulated.