By Bugcrowd Jun 7, 2017Centrify’s Bug Bounty Program with Bugcrowd It’s an exciting time to be in information security. Black hats are attacking more web sites, constructing more 0-day threats and phishing more credentials and payment data. The proliferation of smart IoT devices and new technologies create opportunities for malicious activities. Nation State actors and the vulnerabilities they exploit are gaining visibility. Read More
By Bugcrowd Apr 26, 2017[Guest Blog] Calling All Bug Hunters: Sophos Teams Up with Bugcrowd This post originally appeared on the Sophos Blog here.Adversarial relationships between vendors and security researchers used to be common. Researchers would report a bug and the vendor – not all but certainly more than a few – would drag its feet in patching the problem. Then, the researcher would make the findings public and the vendor would criticize them for releasing information attackers could exploit. Read More
By Bugcrowd Mar 16, 2017[Guest Blog] Bugcrowd’s Buggy Awards: Fitbit Takes Two! Appeared originally on the Fitbit Engineering Blog Read More
By Bugcrowd Nov 17, 2016Guest Blog: Barracuda Bug Bounty Program Shifts to the Cloud Posted originally on November 14 by Dave Farrow, Senior Director, Information Security at Barracuda Networks. Read More
By Bugcrowd Aug 30, 2016OSS Security Maturity: Time to Put On Your Big Boy Pants! Earlier today we joined Jake Kouns, CISO of Risk Based Security, and Christine Gadsby, Director of Product Security at BlackBerry for a guest webcast. They gave their Black Hat 2016 talk ‘OSS Security Maturity: Time to Put on Your Big Boy Pants’ which analyzes the real risks of using OSS and the best way to manage its use within your organization.This post is a high-level review of that presentation–you can watch the recording here and download their slides here. Read More
By Bugcrowd Apr 27, 2016[Guest Blog] Skyscanner’s Adventures in Bug Bounties Posted originally on April 27, 2016 by Stuart Hirst on Skyskanner’s Code Voyager BlogSkyscanner has a culture of innovation and continuous improvement. For our IT security function, the ‘Security Squad’, it is no different. External security testing had previously taken the form of standard penetration testing, which brought considerable value and helped improve security posture. However, our Squad wanted to look at new ways of testing the products that we help secure on a daily basis. In early 2015, we began to investigate the possibility of a crowd-sourced testing mechanism. Read More
By Bugcrowd Apr 22, 2016Bug Bounties and NGWAF: 1+1=3 Return on Investment – ROI. Sales departments have to show it, marketing departments have to show it, and of course, security departments do too. At the end of the day we all need to show where the dollars are going, and security teams have the additional burden of correlating those dollars spent with the elimination of risk – or the perceived elimination of risk. Read More
By Bugcrowd Mar 24, 2016[Guest Blog] InfoSec’s New Mandate: Silo Smashing and Feedback Loop Amplification The original post by James Wickett appeared originally on Signal Sciences Lab on 03/24/16. I have reached the age where friends are getting roles like CISO or Director of Security or Senior Architect. All important titles with crucial tasks ahead of them. Usually when friends take these roles they immediately realize that they have found themselves in unfamiliar waters. The skills that got them to that role are not the skills they need to succeed. Read More
By Bugcrowd Mar 18, 2016Guest Blog: Indeed’s Bug Bounty Goals, Learnings and Successes This post is an exerpt from “A Bounty of Security,” originally posted on March 17, 2016 by Gregory Caswell on the Indeed Engineering Blog. Read More
By Bugcrowd Researcher Success Jul 14, 2015Advice From A Researcher: How To Approach A Target Editor’s Note: Today I’d like to introduce you to Bugcrowd member Anshuman Bhartiya (anshuman_bh). As an information security professional as well as bug bounty researcher, Anshuman has helped improve the security of many organizations. He has submitted several P1 & P2 bugs leading to his high standing within the programs he is involved in. As an active member on our Bugcrowd forum he also contributes to the bug bounty researcher community. This blog is from one of his responses on the forum that he has allowed us to post here. We are thrilled to share his thoughts and experience on how to successfully approach a target. Thanks! Read More
