Our current approach to security assessment is inherently flawed; automation tools only find what they are programmed to find and penetration testing is extremely limited. Bug bounties build upon and improve upon these existing application security testing tools by harnessing the human creativity of the whitehat researcher community with a pay-for-results rewards model. As a cyber security veteran, Casey will analyze the evolution of the application security industry over the past several years and address why the existing tools and practices are falling short. With data from hundreds of bug bounty programs, he will also show how bug bounties are bridging the gap between companies who need to find security flaws before they’re exploited, and the hackers at the table ready to help. https://2017.conference.auscert.org.au/speaker/casey-ellis/

1. September 2016
AN UNLIKELY ROMANCE
THE CURRENT STATE OF BUG BOUNTIES

2. 1/24/172
FOUNDER & CEO
FORMER PENTESTER
HACKER
DAD
YOUR SPEAKER

3. Financial Services Consumer Tech Retail & Ecommerce Infrastructure Technology
Automotive Security Technology Other
WIDE ADOPTION OF CROWDSOURCED SECURITY

4. WHAT IS A BUG BOUNTY?
4

5. THE HISTORY OF BUG BOUNTIES: 1995 TO PRESENT
5

6. REALLY, IT’S ABOUT PROTECTING THE INTERNET
6
“The Internet was so new
back then… We knew from
day one that the commercial
web was going to need
security”
Jeff Treuhaft, formerly of Netscape,
talking about the first technology bug
bounty program

7. 7
112
Countries
50K+
Researchers
$5M+
Paid out
110
Employees
90K
Submissions
450+
Programs

8. WHY IS THERE AN ISSUE
TO ADDRESS?
8
Ballooning
attack surface
Cybersecurity
resource
shortage
Broken
status-quo
Active, efficient
adversaries
Application Security is Broken

9. BROKEN STATUS QUO
9
$7.8B
Estimated Security Assessment
Market Size by 2021
Source: http://cybersecurityventures.com/cybersecurity-market-report/

10. BALLOONING ATTACK SURFACE
10
20B+
Websites and Internet connected
devices
Sources: http://www.internetlivestats.com/total-number-of-websites/
https://www.statista.com/statistics/471264/iot-number-of-connected-devices-worldwide/

11. CYBERSECURITY RESOURCE SHORTAGE
11
209K
Unfilled cybersecurity jobs as of
2015
Source: http://peninsulapress.com/2015/03/31/cybersecurity-jobs-growth/

12. ACTIVE AND EFFICIENT ADVERSARIES
12
350%
Increase of breaches caused by
hacking from 2007 to 2015
Source: http://www.idtheftcenter.org/2016databreaches.html

13. A SIMPLE SOLUTION…
13

14. September 2016

15. 15

16. 16
Only crazy tech
companies run bug
bounty programs
Bug bounties don’t
attract talented
testers or results
They’re too hard to
manage and too
expensive
Running a bounty
program is too risky
OBJECTIONS
If the model makes sense, what is stopping you?

17. IT’S WORTH IT.
17

18. OBJECTION: “ONLY TECH COMPANIES
RUN BUG BOUNTY PROGRAMS”
18
30%
of all bug bounty
programs are run by
Traditional
organizations.

19. OBJECTION: “THEY DON’T ATTRACT
TALENTED TESTERS OR RESULTS”
19
13 HRS
In 2016, a critical issue was
reported every...

20. OBJECTION: “THEY DON’T ATTRACT
TALENTED TESTERS OR RESULTS”
20
KNOWLEDGE
SEEKERS
HOBBYISTS
FULL-TIMERS
VIRTUOSOS
PROTECTORS

21. 21
“We decided to run a bug
bounty program to get
access to a wide variety of
security testers. Hiring
security researchers is very
difficult in today’s market...”
Jon Green
Sr. Director of Security
Architecture

22. OBJECTION: “THEY’RE TOO HARD TO MANAGE
AND TOO EXPENSIVE”
22
68%
of all bug bounty
programs are private,
invite-only.

23. OBJECTION: “THEY’RE TOO HARD TO MANAGE
AND TOO EXPENSIVE” (cont.)
23

24. 24
Efficiency and effectiveness of
the crowd is really why we
bring them on… it’s helped in
expanding our team for a
fraction of the cost. Now my
internal resources are better
utilized.
David Baker
Former CSO

25. 25
For us, the managed approach
reduced our required time and effort
by at least 80% allowing us to not
only focus on what matters the most,
implementing the remediations but
also freeing up our security team to
focus on other components of our
security program.”
Johnathan Hunt
VP of Information Security

26. OBJECTION: “RUNNING A BOUNTY PROGRAM IS
TOO RISKY”
1/24/1726
Time
Pen Test Pen Test
Zone of
Vulnerability
Blindness
Zone of
Vulnerability
Blindness
Code
Release
Code
Release
Coverage
Automation

27. In reality, public disclosure
incidents occur less than
.0005%
of the time
27

28. HOW TO HAVE A HEALTHY
RELATIONSHIP...
1/24/1728

29. ALIGN EXPECTATIONS
1/24/1729

30. COMMUNICATE OPENLY
1/24/1730

31. PAY FAST, PAY WELL
1/24/1731

32. QUESTIONS?
1/24/1732

33. WHAT ARE YOU WAITING FOR?
33

34. 13 HRS
In 2016, a critical issue was
reported every...
34

35. 35
Time
Pen Test Pen Test
Zone of
Vulnerability
Blindness
Zone of
Vulnerability
Blindness
Code
Release
Code
Release
Coverage
Automation
BROKEN STATUS QUO (cont.)