Podcast: How to hack the Pentagon
Bug bounty programs are a big part of the Pentagon鈥檚 push to solve complex IT problems.听
But starting programs that allow vetted outside security researchers to search for software flaws was not easy in the bureaucratic and failure-averse institution, say Chris Lynch, the director of the Defense Digital Service,听and Lisa Wiswell, the group鈥檚 digital security lead.听
On the听,听Mr. Lynch said his team went so far as to schedule meetings in conference rooms to which "naysayers" did not have access.
"One of the strategies we had to resort to was literally physically getting some people out of the meetings that we had, because they were so disruptive," Mr. Lynch tells podcast cohosts听New America's Peter W. Singer and Passcode's Sara Sorcher.听
"They were worried about their own careers, right?" he continued. "There's a belief in the Department of Defense that comes from the idea that failure is not an option, so when you do a bug bounty, if [researchers] find vulnerabilities, that's considered a failure. That's the wrong way to think about it."听After all, you can't fix software flaws if you can't find them.听
Check out the podcast on:听听|听听|听
