NAB crowdsources cyber security with bug bounty program

The National Australia Bank on Friday launched a bug bounty program in partnership with crowdsourced cyber security platform Bugcrowd to strengthen its cyber posture.

Vetted security researchers with an ‘Elite Trust Score’ on Bugcrowd will be able to work in live environments to help test the bank’s security.

NAB is the first of the ‘Big Four’ banks to include a bug bounty program in its security strategy as part of a proactive response to an era of ‘hyperconnectivity’ where new threats are constantly emerging, NAB executive enterprise security Nick Mckenzie said.

He said the controlled crowdsourcing methods would bring new perspectives to the bank’s cyber practice and rewards security researchers who uncover previously undisclosed vulnerabilities at the bank.

“Controlled, crowdsourced cyber security brings together uniquely skilled testers and security researchers with fresh perspectives to uncover vulnerabilities in our defences that traditional assessment might have missed,” McKenzie said in a statement.

“Diversity is a critical yet often overlooked factor in security and controls strategies.

“Moving to a ‘paid bounty’ gives us the ability to attract a wider pool of ethically-trained security researchers from across the globe,” he said.

Bugcrowd CEO Ashish Gupta said the partnership with NAB would help improve on its existing security strategy.

“In addition to being one of the first in Australian banking to use the power of a crowdsourced security model, NAB has deployed an impressive layered security approach that is now complemented by Bugcrowd’s crowd of security researchers and platform which assists in finding security vulnerabilities faster and gather actionable insights to increase their resistance to cyber attacks,” Gupta said.

Researchers working in NAB’s live environments won’t have access to any customer data, the bank said, and activities will not impact customers’ banking experience.

Other financial institutions to run bug bounty programs with Bugcrowd include Mastercard and Jack Dorsey’s payments processing provider Square.