The first security technology bug bounty predated the Internet by over one hundred years: Alfred C Hobbs breaking an unbreakable lock at the Great Exhibition of 1851 for the princely sum of 200 Guineas. With the acceleration of technology adoption, unintended consequences, our adversaries, and the need to quickly understand how "unhackable" things really are, it's safe to say that things have escalated since then. In 2021, there as many who benefit from engaging the good-faith hacker community as there are folks who find themselves lost in a mish-mash of term confusion, unclear expectations, and general reservations - in spite of the increasingly obvious truth that "it takes an army of allies to overcome an army of adversaries". This breakout is for both. Casey John Ellis, the Founder, Chairman, and CTO of Bugcrowd, pioneer of the crowdsourced security as-a-service category, and co-founder of The Disclose.io Project will unpack the "family tree" of vulnerability disclosure, bug bounty, and crowdsourced security testing, frame up how we got here, and facilitate a discussion from the group about where it all goes next.

1. The Crowdsourced Security Platform

2. https://bugcrowd.com/try-bugcrowd
Bug bounty or beg bounty?
Casey Ellis - Blackhat EU CISO Summit
November 2021

3. https://bugcrowd.com/try-bugcrowd
whoami
$ sudo hack.sh $ sudo hustle.sh
@caseyjohnellis
casey.ellis@bugcrowd.com
+1.415.530.1129
https://cje.io
Hacker > Pentester > Solutions guy > Serial entrepreneur
Founder/Chairman/CTO of Bugcrowd and
Co-founder of The disclose.io Project
Pioneered Crowdsourced Security as-a-Service
20 years in Infosec
Proud Australian, husband, and father of two
Lives between Sydney, Australia and San Francisco, USA

4. https://bugcrowd.com/try-bugcrowd
agenda
How did we get here?
Tips for unsolicited contact
Broke vs Woke
Discussion

5. https://bugcrowd.com/try-bugcrowd
whois bugcrowd.com

6. https://bugcrowd.com/try-bugcrowd
How did we get here?

7. https://bugcrowd.com/try-bugcrowd

8. https://bugcrowd.com/try-bugcrowd
“Diversity is a critical yet often overlooked
factor in security and controls strategies.
Moving to a paid bounty gives us the ability
to attract a wider pool of ethically-trained
security researchers from across the
globe.”
Nick McKenzie, Bugcrowd CI&SO
Formerly NAB, Standard Chartered Bank, J.P. Morgan and UBS

9. No proactive program
Vulnerability
disclosure program
Bug bounty program
If vulnerability discovery
was lightning…

10. https://bugcrowd.com/try-bugcrowd
Vulnerability disclosure programs
Bug bounty programs
“Bug bounty platforms”
Crowdsourced security
Outsourced pentesting
Multi-player pentesting
“Bug bounty platforms”
Multi-sourced security
Open to the public Invitation-only

11. https://bugcrowd.com/try-bugcrowd
Broke vs Woke

12. https://bugcrowd.com/try-bugcrowd
• Do set clear expectations on what happens next and try to meet
them (Golden rule: Maintain expectations)
• Don’t entertain payment if payment isn’t proactively o
ff
ered
• Assume good-faith at the outset - Di
ff
erent languages, cultures,
and countries communicate di
ff
erently by default, and the initial
experience can be unsettling
• Do consider starting a VDP, at minimum, to align expectations and
get information to the right place
• Do reach out to experts like Bugcrowd or the NCSC to help you
through the process

13. https://bugcrowd.com/try-bugcrowd
Broke vs Woke

14. https://bugcrowd.com/try-bugcrowd
Broke:
“Rub some blockchain/
automation/ML on it and it’ll go
away”
Woke:
“Cybersecurity is a people
problem, the technology just
makes it go faster.”

15. https://bugcrowd.com/try-bugcrowd
Broke:
Vulnerability Disclosure Programs
(VDP) as a marketing stunt
Woke:
VDP as a leading indicator of
security maturity, through the
acceptance of potential failure

16. https://bugcrowd.com/try-bugcrowd
Broke:
Bug bounty as a silver-bullet
Woke:
Bug bounty as a way for the
business to internalize that the
boogeyman is real

17. https://bugcrowd.com/try-bugcrowd
Broke:
Total payouts as a vanity metric
Woke:
Required payout as a business metric for
cost of attack

18. https://bugcrowd.com/try-bugcrowd
Broke:
Pentest as an assurance-only model
Woke:
Assurance + impact to create
builder/breaker feedback loops

19. https://bugcrowd.com/try-bugcrowd
Broke:
security@domain.com > /dev/null
Woke:
disclose.io

20. https://bugcrowd.com/try-bugcrowd
Discussion time

21. https://bugcrowd.com/try-bugcrowd
@caseyjohnellis
casey.ellis@bugcrowd.com
+1.415.530.1129
https://cje.io
Thank you!
Questions?