HackerOne vs. Tripwire IP360

It is one of the good platforms for security researchers to submit bugs and other vulnerabilities, it however, has some challenges, in terms of un-verified and duplicate submissions.

Incentivized

I think Tripwire IP360 is suited for any environment as long as the leadership is willing to support the outcome.

Incentivized

• Filter for spammy bug reports
• Nice central interface
• Payment/reward system is nice

Incentivized

• I find the Tripwire IP360 reporting features extraordinary. I can run various audit and inventory reports at any point since the inception of the tool. For example, I can execute a report on the history of an asset, which establishes a baseline and can be used to support many security objectives.
• Scan scheduling. This feature allows the tool to run independently without human intervention. I don’t have time to manually run scans of different departments. Therefore, I schedule all my audits and check the report the next day. This has worked brilliantly for 3 years now.
• Automated update of the vulnerability rules. Automatically updating these rules and binding them to the scans preserves the tool relevancy during audits

Incentivized

• A lot of duplicate bugs get reported, although it does offer automatic suggestion of previously reported bugs that may be duplicates, it is far from perfect.
• Anyone can report bugs, a lot of them are not verified before submission. This sometimes leads to a lot of time spent in verifying if the bug is really actionable.
• Each submission has to be treated with equal potential, a lot of time, some time gets invested in vulnerabilities that aren't as important as some others.

Incentivized

• I’d like to see IP360 have the ability to discover additional security appliances such as PaloAlto and Fortinet appliances.

Incentivized

These were very close and we liked HackerOne better. For a time we did have both and we felt the need to consolidate the information into one platform and end of life our internal offering. Overall we've been fairly happy with HackerOne.

Incentivized

I chose Tripwire IP360 because of its flexible reporting features

Incentivized

• Bugs that can't be tracked internally are submitted by external researchers, which is an important factor for security vulnerabilities.
• Even if the bugs reported are duplicates, there still is provision to award reputation points, that keep the researchers engaged.
• It also requires a lot of verification and validation, as a lot of the submissions are unverified to begin with.

Incentivized

• The biggest impact Tripwire has had in the organization is risk reduction. Since the inception of the tool our vulnerabilities have been reduced by 40%.

Incentivized