Return on Investment – ROI. Sales departments have to show it, marketing departments have to show it, and of course, security departments do too. At the end of the day we all need to show where the dollars are going, and security teams have the additional burden of correlating those dollars spent with the elimination of risk – or the perceived elimination of risk.
Posts by Bugcrowd
I have reached the age where friends are getting roles like CISO or Director of Security or Senior Architect. All important titles with crucial tasks ahead of them. Usually when friends take these roles they immediately realize that they have found themselves in unfamiliar waters. The skills that got them to that role are not the skills they need to succeed.
September 2015 Hall of Fame announcement time! Big recognition goes to securityidiots, who topped the September leaderboard with 329 points earned through multiple P1 and P2 submissions.
The only way for a security team to effectively manage risk is vulnerability prioritization and management. There are many different prioritization models used across the industry that are based on vulnerability risk and impact. Without a clear prioritization model, how do you know what to fix first? Highest CVSS Score? FIFO? LIFO? Externally known issues? Whatever your prioritization plan is, it needs to be documented and updated as threats to your business change.
About the Author: Ben Sadeghipour has been participating in bug bounty programs since February of 2014. After his first few bugs, he came to realize that bug bounties are a great way to learn more about web application security as well as make some extra money while going to school – computer science major. Currently Ben is an intern at Bugcrowd and continues to do bug bounty research. You can see more of his work on nahamsec.com.
Like Employee of the Month but better, I’m excited to tell you about the three Crowd members that earned top spots on the April 2015 Hall of Fame. We have a ton of amazing researchers contributing solid bugs every day, but these three ninjas earned the most Kudos points in Bugcrowd bounty programs from April 1 to April 30 2015. To thank them for their hard work, Bugcrowd is pleased to announce they’ll receive performance bonuses.