Google Extends Security Bug Bounty to Gmail, YouTube, Blogger

Google on Monday said it was expanding a program to pay security researchers who discreetly report software flaws in the company’s products. The move appears aimed at engendering goodwill within the hacker community while encouraging more researchers to keep their findings private until the holes can be fixed.


Earlier this year, Google launched a program to reward
researchers who directly report any security holes found
 in the company’s Chrome open-source browser project.

With its announcement today, Google is broadening the program to include bugs reported for its Web properties, including Gmail, YouTube, Blogger and others (the company says its desktop apps – Android, Picasa and Google Desktop, etc.  are not included in the expanded bounty program).

The program is unlikely to attract those who are looking to get rich selling security vulnerabilities, as there are several less reputable places online where critical bugs in important online applications can fetch far higher prices. But the expanded bounty may just win over researchers who might otherwise post their research online, effectively alerting Google to the problem at the same time as the cyber criminal community.

“We already enjoy working with an array of researchers to improve Google security, and some individuals who have provided high caliber reports are listed on our credits page,” Google’s security team wrote on the company’s security blog. “As well as enabling us to thank regular contributors in a new way, we hope our new program will attract new researchers and the types of reports that help make our users safer.”

http://krebsonsecurity.com/2010/11/google-extends-security-bug-bounty-to-gmail-youtube-blogger/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+KrebsOnSecurity+%28Krebs+on+Security%29

Ind. AG sues WellPoint for $300K over data breach

http://www.businessweek.com/ap/financialnews/D9J5JNK00.htm

The Indiana attorney general's office is suing health insurance giant
WellPoint Inc. for $300,000 for waiting months to notify customers
that their medical records, credit card numbers and other sensitive
information may have been exposed online.

The lawsuit filed Friday in Marion County accuses WellPoint of
violating a state law that requires businesses to provide notification
of data breaches in a timely manner.

State officials say the personal records were exposed for at least 137
days between last October and March. The suit says WellPoint learned
of the problem Feb. 22 but didn't start notifying customers until
June.

WellPoint has said 470,000 individual insurance customers might have
been affected.

Messages seeking comment were left with WellPoint spokespeople.