Node Summit 2016 Presentation by Casey Ellis: Welcome to the blue team...

Welcome to the blue team…  
(How building a better hacker accidentally
built a better defender)
Casey Ellis - NodeSummit 2016
Casey Ellis - CEO
Bugcrowd Inc
W
e’re
hiring!
jobs@
bugcrowd.com

@CASEYJOHNELLISBUGCROWD.COM NODE SUMMIT 2016 - CASEY ELLIS
About me
@caseyjohnellis
JABAH (Just Another Blonde Aussie Hacker)
Recovering pentester turned solution architect turned sales guy turned
entrepreneur
Wife and two kids now living in San Francisco
Founder and CEO of Bugcrowd
2

• I want to change the way you might already think
about connecting companies to researchers.
• Let’s be real.
• I’m not a developer. I’m a 100% breaker/ﬁxer.
Before we begin…
3

#buildabetterhacker
4

• Who here builds for a living?
• Who here breaks/ﬁxes for a living?
• Who does both?
Who’s who
5

We’re different…
6
Builders Breakers
…and that’s good.

Say what?
We do completely opposite
things.
7

#bettersecurityfeedback
8

@CASEYJOHNELLISBUGCROWD.COM NODE SUMMIT 2016 - CASEY ELLIS 9

Developer incentive
Push this feature by this deadline because $REASON.

Security incentive
Make sure dev doesn’t do anything that lets the bad guys in.

• Those who think like bad guys *greatly*
overestimate the ability for everyone else to think
like a bad guy.
• This makes them useful and valuable (but doesn’t
make them “better” or “worse)
• Tip: The next time you feel like calling a developer
“dumb”, build and launch a product ﬁrst.
Side note:
12

The developer problem
All this security stuff is slowing us down

The security problem
Why won’t they take me seriously?

• Development contributes to products which make
money.
• Security minimizes risk of loss. No security = More
risk… but *maybe* nothing will happen.
• No dev = no product = no money = no job = no
beuno… So the feature wins.
Side note:
15

The real developer
problem
I don’t believe in the boogeyman

The real security problem
I don’t have the time/energy/people skills/resources
to convince you that the boogeyman is real.

• Thanks to every security vendor ever for making this
even harder.
• FUD works as a awareness tool, but FUD fatigue is
very, very real.
Side note:
18

#wereinthistogether
19

• Developer checklists
• Check-in testing/CI tests
• Security awareness training
• Pentesting/VA/SCA
• Outsourced things
Status quo
20
BLOCKERS

So we do this…
(and let’s be honest, we quite enjoy it too…)

It doesn’t work over the
long term.
22

The question:
How do we get the
business to believe in the
boogeyman?
23

A better question:
How do we create
better security feedback
for the business?
24

Picard Management Tip
25
The most efficient way to get something the attention it deserves is to set it on fire.
*not a Pickard quote, but it totally should be.

The McAfee Version
26
The most security aware an organization will ever be is straight after a breach.
*not a John McAfee quote, but he’s burning benjamin’s in this pic because it’s true.

• Heartland, the leaders in end to end encryption!!!
• Target, with their shiny new CISO!!!
• JP Morgan Chase, with their massive new security
budget!!!
• Etc, etc, et al, QED
Examples?
27

That’s nice, but
how do I avoid
the whole
“getting pwned”
bit?
28

Bug bounty!!!
29

FOREVER!!!
30
Pics by @alliebrosh
http://hyperboleandahalf.blogspot.com/2010/06/this-is-why-ill-never-be-adult.html

What’s a bug bounty
program?
31

It’s not just about being
cheap, or loud…
33

…it’s about introducing you
to this guy.
34
Egor Homakov (@homakov)
aka “that guy who totally owned
Github that time”
Good guy who thinks like a bad guy
“I wonder what his next-door
neighbor can do?”

#bettersecurityfeedback
35

Bug bounties create
controlled incidents…
36

… like having your code pwned
by an 18yo kid.
37

#storytime
38

Eg 1: Mozilla
39
Thanks to @mwcoates
http://www.slideshare.net/michael_coates/bug-bounty-programs-for-the-web
Clearing their
assurance debt
Boogeyman
belief

Great success!
40

We see this pattern every.
single. time.
41

• Extortion attempt from Eastern Europe
• Resolved by creating a “one man bug bounty” (we
didn’t tell him he was the only one though…)
• Bug received in 15 mins
• #welcometotheblueteam
Eg 2: Western Union
42

• Infosec team having a *very* hard time getting buy-
in from management and engineering
• Invoke Picard Management Mode
• Received budget for another 3 team members
Eg 3: [REDACTED] social
media
43

• Long time customer of [EXPENSIVE WEB APP
SCANNER] getting “clean results”
• Admin of admin’s through a chained attack within 24
hours of launch
• They thought they were doing a great job at writing
secure code…
Eg 4: [REDACTED]
eCommerce provider
44

• Loss prevention company, works with BIG NAME
retailers
• Success of software dependent on not being
hacked - they said it couldn’t be
• Took less than 48 hours
Eg 5: Digital Safety (DISA)
45

Great success!
46

1. Create a pot that beneﬁts your engineering team
(team drinks, party, event, whatever)
2. Bug bounties paid from it.
3. What ever the hackers don’t get, you keep for your
party.
Idea:
Gamiﬁed SDLC
47

Ready to start?
48

Bug bounties are
awesome…
49

…but hard.
50

Plan ahead
51

The Golden Rule:
Touch the code
==
Pay the bug
52

The mistake *everyone* makes:
Vulnerability data
People
53

Understand the risk.
54

Align expectations before
you engage.
55

So, do you think the
boogeyman is real?
Let Egor prove it to you.
56

• Bug bounties are cost effective, and highly
marketable, but that’s not the full story…
• …they create controlled incidents that powerfully
impact the security awareness of your builders.
• Go start one.
• More tips and tricks at https://blog.bugcrowd.com
Conclusion
57

#questions
58

@caseyjohnellis
https://bugcrowd.com
casey@bugcrowd.com
Greets to the Bugcrowd, the #scotcherati, @alliebrosh, @rallyvc,
@nodesummit, and the herd.
W
e’re
hiring!
jobs@
bugcrowd.com

Node Summit 2016 Presentation by Casey Ellis: Welcome to the blue team...

Recommended

Recommended

More Related Content

More from bugcrowd

More from bugcrowd (14)

Recently uploaded

Recently uploaded (20)

Node Summit 2016 Presentation by Casey Ellis: Welcome to the blue team...