Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 82 views

    Decoding Bug Bounty Programs: Jon Rose

    Uploaded by

    Adil Raza Siddiqui
    Bug bounty programs allow independent security researchers to identify vulnerabilities for companies and receive cash rewards in return. Traditional security testing methods are outdated, while bug bounty programs leverage crowdsourcing to cost-effectively improve security. The document discusses how programs work, common bug types, benefits for companies and researchers, and statistics on payouts from Google's program. It also notes challenges like verifying bugs and maintaining efficient communication with researchers.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Decoding Bug Bounty Programs: Jon Rose

    Uploaded by

    Adil Raza Siddiqui
    82 views72 pages
    Bug bounty programs allow independent security researchers to identify vulnerabilities for companies and receive cash rewards in return. Traditional security testing methods are outdated, while bug bounty programs leverage crowdsourcing to cost-effectively improve security. The document discusses how programs work, common bug types, benefits for companies and researchers, and statistics on payouts from Google's program. It also notes challenges like verifying bugs and maintaining efficient communication with researchers.

    Original Description:

    Rose

    Original Title

    Rose

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Bug bounty programs allow independent security researchers to identify vulnerabilities for companies and receive cash rewards in return. Traditional security testing methods are outdated, while bug bounty programs leverage crowdsourcing to cost-effectively improve security. The document discusses how programs work, common bug types, benefits for companies and researchers, and statistics on payouts from Google's program. It also notes challenges like verifying bugs and maintaining efficient communication with researchers.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    82 views72 pages

    Decoding Bug Bounty Programs: Jon Rose

    Uploaded by

    Adil Raza Siddiqui
    Bug bounty programs allow independent security researchers to identify vulnerabilities for companies and receive cash rewards in return. Traditional security testing methods are outdated, while bug bounty programs leverage crowdsourcing to cost-effectively improve security. The document discusses how programs work, common bug types, benefits for companies and researchers, and statistics on payouts from Google's program. It also notes challenges like verifying bugs and maintaining efficient communication with researchers.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 72

    Decoding Bug

    Bounty Programs

    Jon Rose
    Its all about
    YOU
    What is your Role?

    Builder
    Breaker
    Defender
    Bug Bounty Programs are
    Revolutionizing
    the way businesses
    protect themselves
    O RLY?
    Traditional security
    testing is
    1. Automated tools dont work
    2. Waterfall security isnt Agile
    3. Massive shortage of talent
    4. Cost prohibitive
    Responsible
    Disclosure
    Plus
    CrowdSourcing
    With
    Ca$h
    Google Chrome

    6-2012
    9-2010
    8-2004

    11-2010

    9-2012
    2004 2010 2013

    5-2012
    11-2010

    8-2005

    9-2012
    7-2011

    2002
    3-2009
    No More Free Bugs
    Any Bug Reporters?
    Keys to Running a
    Bug Bounty
    5 Simple
    Rules
    Bug Payouts

    Remote Auth
    Code Bypass
    Execution
    SQL
    Injection
    XSS
    Not all bugs are

    equal
    Disclosure
    Policy
    First In,
    Best
    Dressed
    Well Defined
    Targets and Scope
    Do you pay for valid
    bugs that are
    out of scope?
    5 Major
    Benefits
    Embrace
    Continuous Testing
    Market
    Your Security
    Diversity in
    Tools,
    Techniques,
    Approach
    Only Pay for results
    Only Pay For
    Results
    Are
    companies with
    bug bounties
    MORE
    secure?
    8 Potential
    Problems
    International
    Legal Issues
    Fixing bugs is hard
    and requires
    teamwork
    Spot the difference
    Understanding
    Language Barriers
    FALSE
    POSITIVES
    ARE A
    NECESSARY
    EVIL
    Weak Security
    Foundation
    Unclear Policies
    and Processes
    Hackers
    Cheat
    Bounty
    Hunters
    Helping secure popular
    services, improving my
    skills, the credit, and of
    course the payment for a
    job well done

    @NightRang3r
    Bug Bounty Hunter
    enhances my logical
    bug finding creativity
    and approach. It
    motivates me..

    @AjaySinghNegi
    Bug Bounty Hunter
    First of
    all is the
    challenge, and
    second, the
    acknowledgement
    of researchers hard
    work and rewarding
    them accordingly
    @NightRang3r
    Bug Bounty Hunter
    I like the training
    aspects of bug bounties

    @makash
    Bug Bounty Hunter
    The new challenges
    which I get in the bug
    bounty programs and
    also the appreciation
    by the bug bounty
    security team

    @AjaySinghNegi
    Bug Bounty Hunter
    3
    Benefits
    Prestige
    and fame
    Practice
    Makes
    Perfect
    Cash
    Money
    Pick One:

    Money
    Fame
    Experience
    4
    Problems
    Ahead
    No
    Visibility
    Terms can change at any
    time
    Inefficient
    use of
    testers time
    Fixes Take
    Time
    Free
    Advice
    Be prepared to run
    such a program, have
    the professional man
    power to deal with
    bug submissions and to
    understand them
    @NightRang3r
    Bug Bounty Hunter
    Proper verification,
    timely reply to bugs
    submissions with status

    @AjaySinghNegi
    Bug Bounty Hunter
    Statistics
    dont Lie
    Almost 80% of bug
    submissions are sent in
    by researchers who
    submit less than 10 bugs
    total
    PayPal
    44% percent of all bugs
    are the first and only bug
    sent by a researcher

    PayPal
    10% of the researchers
    submit 25 bugs or more

    PayPal
    Google has paid out
    $806,501 as of
    3/11/2013

    Google
    Almost 70% of valid bugs
    are XSS

    XSRF
    XSS

    Google
    Does it
    Work?
    Google is reporting fewer
    bug submissions

    Harder to find
    Google Bug Hunter
    Crowd-Sourced Security
    is
    changing
    testing
    Outsourcing

    CrowdSecurify Bugwolf
    Submit bugs
    Accept bugs
    Provide Rewards
    Get Secure
    Thank You!
    Dark on Light
    Continuous

    Light on Dark
    Be prepared to run
    such a program, have
    the professional man
    power to deal with
    bug submissions and to
    understand them
    @NightRang3r
    Bug Bounty Hunter
    Callout for Dark
    Dark Grey Text
    POP
    Light Grey

    Callout for Light


    Program Costs

    Analysis
    Tracking
    Development
    Payment
    Crowd Sourcing

    You might also like