5 Tips to Successfully Running a Bug Bounty Program
1 like1,909 views
The document outlines five key tips for running a successful bug bounty program, emphasizing the importance of preparation, aligning expectations, and maintaining communication with researchers. It highlights the need to reward submitters for changes and to respect the researchers' efforts in order to foster a productive relationship. Additionally, the document addresses common concerns and misconceptions about implementing bug bounty programs, providing insights into their effectiveness compared to traditional penetration testing.
5 Tips to Successfully Running a Bug Bounty Program
- 1. ! ! 5 TIPS FOR A SUCCESSFUL BUG BOUNTY The premier platform for crowdsourced cybersecurity. casey@bugcrowd.com jcran@bugcrowd.com
- 2. ! All content (c) Bugcrowd Inc, 2014 - All rights reserved. the problem Without crowdsourcing, security is not a fair fight. HACKED HACKED HACKED HACKED HACKED HACKED
- 3. ! All content (c) Bugcrowd Inc, 2014 - All rights reserved. about your presenters @caseyjohnellis Founder and CEO, Bugcrowd Recovering pentester turned solution architect turned sales guy turned entrepreneur Founder and CEO of Bugcrowd @jcran VP Delivery, Bugcrowd Bugcrowd bounty hunter turned Bugcrowd employee. Former positions with @Rapid7, @Metasploit, @PwnieExpress
- 4. CONFIDENTIAL. DO NOT DISTRIBUTE. All content (c) Bugcrowd Inc, 2014 - All rights reserved. Why aren’t you running one already? “I don’t have resources now, let alone to do this.” Crowdcontrol was built to maximize the efficiency of a bug bounty, and we a triage team of 8 people. “I can’t cap my spend.” Bugcrowd Flex let’s you run a point in time or ongoing bug bounty with a capped cost. “I won’t be able to pause or stop the program if I ever need to.” We can route researcher traffic through the Crowdcontrol Sandbox for total control. “Payments to all those countries would be a nightmare.” It totally is. That’s why we got good at it, so you don’t have to. “I won’t be able to tell whether it’s bounty traffic or an actual attack.” The Crowdcontrol Sandbox gives a single source IP, so you can. “I won’t know who these people are.” Bugcrowd’s Elite tier have proven track record on public bounties, and we vet them into that tier.
- 5. CONFIDENTIAL. DO NOT DISTRIBUTE. All content (c) Bugcrowd Inc, 2014 - All rights reserved. bug bounties are awesome, but hard.
- 6. CONFIDENTIAL. DO NOT DISTRIBUTE. All content (c) Bugcrowd Inc, 2014 - All rights reserved. bugcrowd at Work Crowdsourced security to fit your needs Free Responsible Disclosure Capped cost Ad-hoc or continuous Elite tier researchers Flex Bounty Continuous testing Monthly fee + transaction fee Bug Bounty
- 7. ! All content (c) Bugcrowd Inc, 2014 - All rights reserved. DOES IT WORK? Traditional penetration test Bugcrowd Flex Cost $20,000 $20,000 # of researchers 1 349 Manhours 80 80… in the first 8 elapsed hours Vulnerabilities 5 38 P1 issues 0 7
- 8. CONFIDENTIAL. DO NOT DISTRIBUTE. All content (c) Bugcrowd Inc, 2014 - All rights reserved. the one mistake everyone makes • People assume that 80% of the work will go into dealing with the new vulnerabilities they’ve found out about. • 80% of the work goes into dealing with the people. • If you don’t factor this into your planning, your program will fail.
- 9. CONFIDENTIAL. DO NOT DISTRIBUTE. All content (c) Bugcrowd Inc, 2014 - All rights reserved. 5 Keys to a successful program • Prepare ahead of time • Align expectations • Communicate early and often • If you make a change, reward the submitter • Respect the researcher
- 10. CONFIDENTIAL. DO NOT DISTRIBUTE. All content (c) Bugcrowd Inc, 2014 - All rights reserved. Preparation • A bug bounty will affect your entire organization • Start with low rewards • Accidental bug bounties are the worst • Running out of budget on the program is no fun
- 11. CONFIDENTIAL. DO NOT DISTRIBUTE. All content (c) Bugcrowd Inc, 2014 - All rights reserved. Align expectations • A clear program brief is your first line of communication • Proactively communicate what you’d like to see • When processing submissions, you should be able to point to prior communication when rejecting or rewarding a submission • The only time you’ll have issues is if an expectation goes unmet
- 12. CONFIDENTIAL. DO NOT DISTRIBUTE. All content (c) Bugcrowd Inc, 2014 - All rights reserved.
- 13. CONFIDENTIAL. DO NOT DISTRIBUTE. All content (c) Bugcrowd Inc, 2014 - All rights reserved. Communicate early and often • This is the mistake everyone makes:! • Bug bounties are all about managing the researcher relationship! • Let the researcher know what to expect. Stick to your word • In the absence of communication, suspicion is king • It’s not hard, but requires diligence
- 14. CONFIDENTIAL. DO NOT DISTRIBUTE. All content (c) Bugcrowd Inc, 2014 - All rights reserved. Make a change, reward the submitter • “Touch the code, pay the bug” • This has become a community norm • It’s a binary yes / no • Even if its out of scope
- 15. CONFIDENTIAL. DO NOT DISTRIBUTE. All content (c) Bugcrowd Inc, 2014 - All rights reserved. Respect the researcher • The researcher is taking a significant risk • Many are inexperienced, some are not • Treat everyone the same. Even the researchers that don’t provide valuable submissions • Close the loop on all incoming submissions
- 16. Questions?
- 17. Want a demo? Ping us!!!