Cloud Security

Google Offering Higher Bonuses for Cloud Platform Vulnerabilities

Google announced on Wednesday that it’s prepared to pay out an extra $313,337 for interesting Cloud Platform vulnerabilities submitted in 2020.

Eduard Kovacs

March 12, 2020

Google announced on Wednesday that it’s prepared to pay out an extra $313,337 for interesting Cloud Platform vulnerabilities submitted in 2020.

Researchers who find vulnerabilities in Google Cloud Platform (GCP) and disclose them through the company’s Vulnerability Reward Program (VRP) can earn up to $31,337.

However, last year Google announced that it would be offering an extra $100,000 for the most interesting vulnerabilities discovered in its cloud platform in an effort to encourage researchers to analyze it.

The GCP VRP prize for last year went to Wouter ter Maat, who discovered several Cloud Shell vulnerabilities.

For this year, the total GCP VRP prize amount has been increased to $313,337, which will be split among the six most interesting submissions. The first prize is $133,337, the second and third place get $73,331, fourth place receives $31,337, and the last two will be awarded $1,000 each.

“Like last year, submissions should have public write-ups in order to be eligible for the prize. The number of vulnerability reports in a single write-up is not a factor. You can even make multiple submissions, one for each write-up,” Harshvardan Sharma, information security engineer at Google, wrote in a blog post.

Researchers will have to nominate their vulnerabilities for the prize by filling out a form before January 1, 2021. White hat hackers interested in analyzing GCP products can sign up for a free tier.

Google reported in January that it paid out more than $6.5 million through its bug bounty programs in 2019, with a total of over $21 million since the launch of its first program in 2010.

Written By Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Latest News

Click to comment

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George

Why CISOs Make Great Board Members

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make for successful board members.

Galina Antova

A Change in Mindset: From a Threat-based to Risk-based Approach to Security

A threat-based approach to security often focuses on a checklist to meet industry requirements but overlooked the key component of security: reducing risk.

Marie Hattar

Secrets to a Good Security Webinar or Conference Presentation

Tips for making a presentation that will help improve the state of security programs and reflect favorably on the presenters and their companies

Joshua Goldfarb

Application Security

Source Code Security Firm Cycode Launches With $4.6 Million in Funding

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Eduard KovacsSeptember 24, 2019