Download to read offline
Uploaded byCasey Ellis
Release The Hounds: Part 2 “11 Years Is A Long Ass Time”
Casey Ellis discusses the evolution of Bugcrowd and the cybersecurity landscape over the past 11 years, emphasizing the importance of adapting to new threat actors and technologies. He advocates for shifting from capability-based to risk-based security values and highlights the need for proactive engagement and a strong vulnerability disclosure framework. The document concludes with a call to action for hackers to leverage their expertise and seize the current opportunities in cybersecurity.
More Related Content
Similar to Release The Hounds: Part 2 “11 Years Is A Long Ass Time”
Release The Hounds: Part 2 “11 Years Is A Long Ass Time”
- 1. https://bugcrowd.com/try-bugcrowd Release The Hounds:Part 2 “11 Years Is A Long Ass Time” Casey Ellis - BSides Knoxville 2023
- 2.
- 3. https://bugcrowd.com/try-bugcrowd change the operating environmentfor hacking in good-faith create a new market by disrupting the economics of defense vs attack encourage the pursuit of potential (time) 2012 2023
- 4. https://bugcrowd.com/try-bugcrowd whoami • Founder/Chairman/CTO ofBugcrowd and Cofounder of The disclose.io Project • Pioneered Crowdsourced Security as-a-Service • 20+ years in infosec… Hacker > Pentest > Solutions/Sales > Entrepreneur • Hacking Policy Council, Election Security Advisory Committee, Cyber Policy Working Group, etc • Aussie, Husband, Dad x 2, Drummer, System Thinker • Lives in San Francisco, California $ sudo hack.sh $ sudo hustle.sh @caseyjohnellis https://cje.io
- 5.
- 6.
- 7.
- 8.
- 9. https://bugcrowd.com/try-bugcrowd 8 December 2012 Theoriginal Bugcrowd “platform”
- 10. https://bugcrowd.com/try-bugcrowd 30 November 2012 The fi rstBugcrowd program
- 11.
- 12.
- 13. https://bugcrowd.com/try-bugcrowd “all security isthe product of something bad happening” …Sudanese Lyft driver in San Francisco
- 14.
- 15.
- 16.
- 17. https://bugcrowd.com/try-bugcrowd 2015 “Hacking happens tome and it hurts”
- 18.
- 19. https://bugcrowd.com/try-bugcrowd 2017 to 2020 “Software is eating theworld and bad guys are eating the software”
- 20. https://bugcrowd.com/try-bugcrowd 2020 “My employee’s 5year old responsible for my corporate attack surface”
- 21. https://bugcrowd.com/try-bugcrowd 2021 “The Internet isbasically a large pile of turtles”
- 22. https://bugcrowd.com/try-bugcrowd 2022 “Everything is basicallya large pile of turtles”
- 23. https://bugcrowd.com/try-bugcrowd 2023 “The machines arecoming for our pile of turtles”
- 24. https://bugcrowd.com/try-bugcrowd if it’s repeatedenough at the dinner table, it ends up in the board room…
- 25.
- 26.
- 27.
- 28.
- 29.
- 30.
- 31. https://bugcrowd.com/try-bugcrowd 300 employees $90M USDraised ~250,000 vulns nuked ~350k hackers signed up 850 customers
- 32.
- 33.
- 34.
- 35.
- 36.
- 37.
- 38. https://bugcrowd.com/try-bugcrowd “do not followthe path set by others, instead make your own path and leave a trail.” Ralph Waldo Emerson
- 39. Broke: “Rub some blockchain/ automation/ML/AIon it and will go away” Woke: Cybersecurity is a people problem, the technology just makes it go faster
- 40. Broke: A more “perfect”security solution is a better security solution Woke: A better security solution makes secure easier, and insecure more obvious
- 41. Broke: VDP as anexternal virtue signal Woke: VDP as a way to teach the business that “to err is human, to learn from error divine”
- 42. Broke: “Bug bounty’s area vulnerability swatting silver-bullet” Woke: “Bug bounty help more organization internalize that the boogeyman is, in fact, a real thing”
- 43. Broke: Bug bounty payoutsas a vanity metric Woke: Required payout as a proxy metric for cost of successful attack
- 44. Broke: “The assurance weget from pentesting is sufficient” Woke: “We need assurance AND impact to understand risk and create builder/ breaker feedback loops”
- 45. Broke: “$NATIONSTATE wouldn’t botherwith my stuff” Woke: “How do I route, detect, contain, and eject a nation-state assuming they are successful”
- 46.
- 47. disclose.io - Fixingthe Internet’s Auto-Immune Problem - Open Source Disclosure Policy Framework - Safe Harbor logo recognition - Public directory of adopters and search tools for hunters - Legal standardization of vulnerability disclosure language - Safe Harbor for good-faith hackers - Rewarding proactive behavior on the company
- 48.
- 49. • Threat actorswill continue to blur together. • Chaotic threat actors will re-emerge and we will be totally unprepared. • Wholesale access to AI/GAI/ML will accelerate the defenders dilemma to the point where we’ll need to reboot our view of “the game”. • The business will force cybersecurity to continue shifting from capability- based value towards risk-based value. • Policy and regulation will play a key role in defining the future operating landscape. • Basic hygiene is still hard - Our primary problem will continue to be reminding people to “wash their hands after they use the restroom”.
- 50. so, how’s thatidea coming along?
- 51. https://bugcrowd.com/try-bugcrowd in summary hackers havea seat at almost any table now good things happen when you step out hackers kick ass at this stuff there’s urgency and a window of opportunity …so hence forth and be rad.
- 52. “a ship in portis safe… …but that’s not what ships are for”
- 53. https://bugcrowd.com/try-bugcrowd Questions? @caseyjohnellis casey@bugcrowd.com https://cje.io Greetz to sawaba,joe, and the bsidesknox crew, codesoda, serge, all the bugcrowders, and all you crazy hackers, hacker listeners, and hacker advocates out there