An Unlikely Romance: The Current State of Bug Bounties (Keynote)

Our current approach to application security assessment is inherently flawed. Automation tools only detect what they’re programmed to find and penetration testing is extremely limited by the selected firm and individual testers. Bug bounties build upon and improve upon these existing application security testing tools, bridging the gap between two parties that historically suck at getting along. By harnessing the human
creativity of the whitehat researcher community with a 'pay-for-results' model, bug bounties uncover more critical and exploitable vulnerabilities than traditional security testing–but it takes work and understanding.
As a cybersecurity industry veteran, Casey will analyze the evolution of the application security space over the past several years and address why the existing tools and practices are falling short. With data from hundreds of bug bounty programs, he will inspect the unlikely romance between companies who need to find security flaws before they’re exploited, and the hackers ready to help.

Transcript

1. September 2016 AN UNLIKELY ROMANCE THE CURRENT STATE OF BUG BOUNTIES
2. 1/24/17 2 FOUNDER & CEO PEN TESTER HACKER FATHER YOUR SPEAKER
3. Financial Services Consumer Tech Retail & Ecommerce Infrastructure Technology Automotive Security Technology Other WIDE ADOPTION OF CROWDSOURCED SECURITY
4. WHAT IS A BUG BOUNTY? 4
5. 5 112 Countries 50K+ Researchers $5M+ Paid out 110 Employees 85K Submissions 450+ Programs
6. WHY IS THERE AN ISSUE TO ADDRESS? 6 Ballooning attack surface Cybersecurity resource shortage Broken status-quo Active, efficient adversaries Breaking The Vulnerability Cycle
7. BROKEN STATUS QUO 7 $7.8B Estimated Security Assessment Market Size by 2021 Source: http://cybersecurityventures.com/cybersecurity-market-report/
8. BALLOONING ATTACK SURFACE 8 1.1B Websites as of January 2016… ...and the rest. Source: http://www.internetlivestats.com/total-number-of-websites/
9. CYBERSECURITY RESOURCE SHORTAGE 9 209K Unfilled cybersecurity jobs as of 2015 Source: http://peninsulapress.com/2015/03/31/cybersecurity-jobs-growth/
10. ACTIVE AND EFFICIENT ADVERSARIES 10 350% Increase of breaches caused by hacking from 2007 to 2015 Source: http://www.idtheftcenter.org/2016databreaches.html
11. A SIMPLE SOLUTION… 11
12. September 2016
14. WHAT ARE YOU WAITING FOR? 14
15. 15 Only crazy tech companies run bug bounty programs Bug bounties don’t attract talented testers or results They’re too hard to manage and too expensive Running a bounty program is too risky OBJECTIONS If the model makes sense, what is stopping you?
16. IT’S WORTH IT. 16
17. OBJECTION: “ONLY TECH COMPANIES RUN BUG BOUNTY PROGRAMS” 17 30% of all bug bounty programs are run by Traditional organizations.
18. OBJECTION: “THEY DON’T ATTRACT TALENTED TESTERS OR RESULTS” 18 13 HRS In 2016, a critical issue was reported every...
19. OBJECTION: “THEY DON’T ATTRACT TALENTED TESTERS OR RESULTS” 19 KNOWLEDGE SEEKERS HOBBYISTS FULL-TIMERS VIRTUOSOS PROTECTORS
20. 20 “We decided to run a bug bounty program to get access to a wide variety of security testers. Hiring security researchers is very difficult in today’s market...” Jon Green Sr. Director of Security Architecture
21. OBJECTION: “THEY’RE TOO HARD TO MANAGE AND TOO EXPENSIVE” 21 68% Of all bug bounty programs are private, or invite-only.
22. OBJECTION: “THEY’RE TOO HARD TO MANAGE AND TOO EXPENSIVE” (cont.) 22
23. 23 Efficiency and effectiveness of the crowd is really why we bring them on… it’s helped in expanding our team for a fraction of the cost. Now my internal resources are better utilized. David Baker CSO
24. OBJECTION: “RUNNING A BOUNTY PROGRAM IS TOO RISKY” 1/24/17 24 Time Pen Test Pen Test Zone of Vulnerability Blindness Zone of Vulnerability Blindness Code Release Code Release Coverage Automation
25. In reality, public disclosure incidents occur less than .0005% of the time 25
26. HOW TO HAVE A HEALTHY RELATIONSHIP... 1/24/17 26
27. ALIGN EXPECTATIONS 1/24/17 27
28. COMMUNICATE OPENLY 1/24/17 28
29. PAY FAST, PAY WELL 1/24/17 29
30. QUESTIONS? 1/24/17 30
31. 13 HRS In 2016, a critical issue was reported every... 31
32. 32 Time Pen Test Pen Test Zone of Vulnerability Blindness Zone of Vulnerability Blindness Code Release Code Release Coverage Automation BROKEN STATUS QUO (cont.)