Others
Fact sheet: Ministry of Defence (MINDEF) Bug Bounty Programme
12 December 2017
This article has been migrated from an earlier version of the site and may display formatting inconsistencies.
Background
The MINDEF Bug Bounty Programme is the Singapore Government's first bug bounty programme. Selected white-hat hackers will test major MINDEF Internet-facing systems for vulnerabilities (or "bugs"), and will receive rewards (or "bounties") for doing so. The programme will be facilitated by a reputable bug bounty company, HackerOne, which has facilitated similar programmes for other government agencies like the United States Department of Defense, and major companies like Intel and Twitter.
Singapore is constantly exposed to the increasing risk of cyberattacks, and MINDEF is an attractive target for malicious cyber activity. It is not possible to fully secure modern day computer software systems, and new vulnerabilities are discovered every day. As hackers with malicious intent find new methods to breach networks, MINDEF must constantly evolve and improve its defences against cyber threats.
Details
The programme will run from 15 January to 4 February 2018, involving some 300 selected white-hat hackers from around the world. The hackers will be invited to find bugs in MINDEF's Internet-facing systems, and thereafter disclose these vulnerabilities to MINDEF. Eight Internet-facing systems will be involved in the programme, as shown in Table 1 below(1).
Table caption
S/N | System | Remarks |
|---|---|---|
1 | MINDEF Website | Ministry of Defence website |
2 | NS Portal | e-Services for NSFs and NSmen |
3 | CMPB Website | Central Manpower Base website |
4 | DSTA Website | Defence Science and Technology Agency website |
5 | eHealth | Portal for MINDEF/SAF personnel for medical purposes |
6 | Defence Mail | MINDEF/SAF Internet email service and I-Net |
7 | LearNet 2 Portal | Learning resource portal for trainees |
8 | myOASIS Portal | NSmen administration portal |
Table 1: List of systems involved in the MINDEF Bug Bounty Programme
Hackers will be financially rewarded for disclosing valid and unique vulnerabilities to MINDEF, with more critical vulnerabilities receiving larger bounties. The reward can range from about S$150 to about S$20,000 based on previous programmes organised by HackerOne. The total amount paid out in rewards is dependent on the number and quality of the vulnerabilities discovered, and is expected to cost significantly less than hiring a dedicated commercial cybersecurity vulnerability assessment team.
Conclusion
It is important to strengthen our defences against the increasing number and sophistication of cyberattacks. The programme uses an innovative, effective and fast, yet responsible crowd-sourcing approach to test and enhance Singapore's defence networks and systems against cyber threats.
(1) The SAF's operational systems, which are not Internet-facing, will not be included in the programme.