Since I'm getting some positive feedback, I'll go even further and say that there should be security bounties established by law:
If a certified red-team of security researches breaches a company's system and discloses appropriately, the law should require the company to pay a security bounty.
The bounty doesn't have to be crippling to the company, but it should be large enough that the security researchers will be paid well and can live on collecting security bounties. We want an entire industry of good guys testing the security of everything.
There can be some regulation to. Like, it's not okay to run a massive DDoS to test systems. We want the red-teams doing constructive things, not just breaking everything. It should be legal for the red-teams to be annoying, but not purposely destructive.
alt Hacker News
Since I'm getting some positive feedback, I'll go even further and say that there should be security bounties established by law:
If a certified red-team of security researches breaches a company's system and discloses appropriately, the law should require the company to pay a security bounty.
The bounty doesn't have to be crippling to the company, but it should be large enough that the security researchers will be paid well and can live on collecting security bounties. We want an entire industry of good guys testing the security of everything.
There can be some regulation to. Like, it's not okay to run a massive DDoS to test systems. We want the red-teams doing constructive things, not just breaking everything. It should be legal for the red-teams to be annoying, but not purposely destructive.