It Takes a Crowd
to Defeat a Crowd
“Cybersecurity isn’t a technology problem — it’s a human one — and to compete against an army of adversaries we need an army of allies.”
CASEY ELLIS, Founder, Bugcrowd
Why Crowdsourced Security?
Crowdsourced Security is a powerful tool – used by leading edge firms such as Google, Apple and Facebook – to decrease risk. However crowdsourced security is not yet well understood across the enterprise security community. This brief will define crowdsourced security and describe why it’s a key element of any viable security architecture.
Partnering with an established crowdsourced security platform largely eliminates overhead and maximizes risk reduction.
Highly vetted, trusted security researchers and private programs diffuse concerns of risk associated with crowdsourced security.
How It Works
Crowdsourced Security: A Human-Based Approach to Risk Reduction
DEFINE
Design Your Program
You define the attack surfaces you need to harden, for example web application front ends or a mobile application.
PUBLISH
Connect to The Crowd
Depending on the type of program, you either publish the program broadly to the researcher community, or engage a more limited set of researchers in a private “invite only” program.
TRIAGE
Find Vulnerabilities
As vulnerabilities are uncovered by the researchers, they are triaged to determine validity and severity.
REWARD
Incentivize Results
You pay a reward (or grant public “kudos”) to the researcher for finding the problem, patch the vulnerability, and verify that the attack vector has been closed.
Why it Works
True Risk Reduction
Rewards are tied to successful outcomes — finding vulnerabilities you need to know about.
Speed
The first hacker to find a vulnerability is rewarded, encouraging hacker to work quickly.
Value
The more critical the vulnerability found, the bigger the reward to the hacker, driving better value.
Seek Protects Its Employment Marketplace
“Being able to use real examples of previous bugs enables developers to look at their attack surface in a different way.”
Pamela O’Shea, Principal Security Consultant, SEEK
READ THE CASE STUDY
Where it Works
Web
Front-End
API
x86 Server
/Cloud
Mobile
IoT
Crowdsourced security supports today’s key attack surfaces, on all key platforms, as well as “the unknown.” As organizations move to cloud architectures and applications, the biggest concerns are web application front ends and APIs, which may be deployed on IoT devices, mobile apps, or on-prem/cloud. All of these can be evaluated for risk by crowdsourced security. Furthermore, a public crowd program can uncover risk in areas unknown to the security organization, such as shadow IT applications or exposed perimeter interfaces.
Using crowdsourced security lowers security costs and operational overhead. There is no agent software on applications or clients, and no software instrumentation to support. There are no network devices or virtual appliances to install and manage. There is also little to no operational waste caused by false positives or low-priority events. As security budgets come under increasing scrutiny, crowdsourcing becomes an obvious choice for simultaneously controlling costs while still aggressively protecting the business.
Explore our Offerings
Vulnerability
Disclosure
Meet compliance and reduce risk with a framework to receive vulnerabilities.
Bug
Bounty
Take a proactive, pay-for-results approach by actively engaging with the Crowd.
Next Gen
Pen Test
Crowdsource human intelligence at scale to discover high-risk vulnerabilities faster.
Attack Surface
Management
Find, prioritize, and manage more of your unknown attack surface.
The Ultimate Guide to Managed Bug Bounty
From Our Blog
Events
In this webinar, you will hear from top security leaders like Eric Johnson, CIO at SurveyMonkey, and Harshil Parikh, Head…
Now in its 23nd year, Black Hat USA is the world's leading information security event, providing attendees with the very…
