‘Bug bounty’ programmes a boon for travel sector

So-called bug bounty programmes that alert companies of potential hacks or security threats are catching on in cyber security and will prove a real boon in the travel sector, an expert says. Bug bounty programmes may be particularly useful in the hotel and airline industries, where large amounts of transactions and information such as client and credit card details are processed online and can be extracted using malware, Tony Lee, a consultant at internet content security company Trend Micro Hong Kong, told Business Traveller Asia-Pacific. Lee’s comments follow a Washington Post report on Jordan Wiens, a software vulnerability researcher who was rewarded 1.25 million frequent flyer air miles by United Airlines when he discovered and alerted the airline to its system’s defects. Earlier this year, Mandarin Oriental released a statement that the point-of-sale systems at several of its hotels had been infected with data-extracting malware, resulting in the potential leak of guests’ credit card details. Lee said companies launch the bug bounty programmes to incentivise independent researchers to find vulnerabilities that may otherwise go unnoticed by a firm’s in-house team. The programmes are likely to be a growing trend adopted by Fortune 500 companies as an effective preventative measure against malicious cyber activities, he added. While this sort of programme might be new to the travel industry, it has been around for some time among tech companies to ensure the integrity of their systems. Tech giants like Facebook, Twitter and Dropbox offer monetary rewards to those who alert them to onsite security problems, while Google’s Vulnerability Research Grants programme even offers researchers a “no strings attached” grant of approximately US$3,000 to find vulnerabilities. Joyce Lau