Sponsored by

Guide

Ultimate Guide to Offensive Security Testing in the Public Sector

Government agencies reported a 40% increase in targeted attacks, and vulnerability submissions to government sector programs surged 151% over the past year. This guide explains how public sector organizations use offensive security testing, and the global community of researchers behind it, to find weaknesses before adversaries do. It covers the four main approaches, vulnerability disclosure programs, bug bounties, red teaming and penetration testing, and the legal changes that made them workable for government: the Supreme Court's 2021 Van Buren decision narrowing the Computer Fraud and Abuse Act, and Department of Justice guidance protecting good-faith research. It traces the path from Hack the Pentagon in 2016 to CISA's Binding Operational Directive 20-01, which requires federal civilian agencies to publish a VDP, and to the platform CISA launched with Bugcrowd in response, which onboarded more than 40 agencies, including NASA, the Treasury and Homeland Security, and has since received more than 15,000 vulnerability reports.