NodeSummit 2016 - WELCOME TO THE BLUE TEAM! CREATING “OH SHIT” MOMENTS FOR FUN AND PROFIT.

Welcome to the blue team…  
(How building a better hacker accidentally
built a better defender)
Casey Ellis - NodeSummit 2016
Casey Ellis - CEO
Bugcrowd Inc
W
e’re
hiring!
jobs@
bugcrowd.com

@CASEYJOHNELLISBUGCROWD.COM NODE SUMMIT 2016 - CASEY ELLIS
About me
@caseyjohnellis
JABAH (Just Another Blonde Aussie Hacker)
Recovering pentester turned solution architect turned sales guy turned
entrepreneur
Wife and two kids now living in San Francisco
Founder and CEO of Bugcrowd
2

• I want to change the way you might already think
about connecting companies to researchers.
• Let’s be real.
• I’m not a developer. I’m a 100% breaker/ﬁxer.
Before we begin…
3

#buildabetterhacker
4

• Who here builds for a living?
• Who here breaks/ﬁxes for a living?
• Who does both?
Who’s who
5

We’re different…
6
Builders Breakers
…and that’s good.

Say what?
We do completely opposite
things.
7

#bettersecurityfeedback
8

@CASEYJOHNELLISBUGCROWD.COM NODE SUMMIT 2016 - CASEY ELLIS 9

Developer incentive
Push this feature by this deadline because $REASON.

Security incentive
Make sure dev doesn’t do anything that lets the bad guys in.

• Those who think like bad guys *greatly*
overestimate the ability for everyone else to think
like a bad guy.
• This makes them useful and valuable (but doesn’t
make them “better” or “worse)
• Tip: The next time you feel like calling a developer
“dumb”, build and launch a product ﬁrst.
Side note:
12

The Developer Problem
All this security stuff is slowing us down

The Security Problem
Why won’t they take me seriously?

• Development contributes to products which make
money.
• Security minimizes risk of loss. No security = More
risk… but *maybe* nothing will happen.
• No dev = no product = no money = no job = no
beuno… So the feature wins.
Side note:
15

The real developer
problem
I don’t believe in the boogeyman

The real security problem
I don’t have the time/energy/people skills/resources
to convince you that the boogeyman is real.

• Thanks to every security vendor ever for making this
even harder.
• FUD works as a awareness tool, but FUD fatigue is
very, very real.
Side note:
18

#wereinthistogether
19

• Developer checklists
• Check-in testing/CI tests
• Security awareness training
• Pentesting/VA/SCA
• Outsourced things
Status quo
20
BLOCKERS

So we do this…
(and let’s be honest, we quite enjoy it too…)

It doesn’t work over the
long term.
22

The question:
How do we get the
business to believe in the
boogeyman?
23

A better question:
How do we create
better security feedback
for the business?
24

Picard Management Tip
25
The most efﬁcient way to get something the attention it deserves is to set it on ﬁre.
*not a Pickard quote, but it totally should be.

The McAfee Version
26
The most security aware an organization will ever be is straight after a breach.
*not a John McAfee quote, but he’s burning benjamin’s in this pic because it’s true.

• Heartland, the leaders in end to end encryption!!!
• Target, with their shiny new CISO!!!
• JP Morgan Chase, with their massive new security
budget!!!
• Etc, etc, et al, QED
Examples?
27

That’s nice, but
how do I avoid
the whole
“getting pwned”
bit?
28

Bug bounty!!!
29

FOREVER!!!
30
Pics by @alliebrosh
http://hyperboleandahalf.blogspot.com/2010/06/this-is-why-ill-never-be-adult.html

What’s a bug bounty
program?
31

It’s not just about being
cheap, or loud…
34

It’s about leveling the
playing ﬁeld…
35

…and about introducing
your devs to this guy.
36
Egor Homakov (@homakov)
aka “that guy who totally owned
Github that time”
Good guy who thinks like a bad guy
“I wonder what his next-door
neighbor can do?”

Better security feedback.
37

Bug bounties create
controlled incidents…
38

… like having your code pwned
by an 18yo kid.
39

#storytime
40

Eg 1: Mozilla
41
Thanks to @mwcoates
http://www.slideshare.net/michael_coates/bug-bounty-programs-for-the-web
Clearing their
assurance debt
Boogeyman
belief

Great success!
42

We see this pattern every.
single. time.
43

• Extortion attempt from Eastern Europe
• Resolved by creating a “one man bug bounty” (we
didn’t tell him he was the only one though…)
• Bug received in 15 mins
• #welcometotheblueteam
Eg 2: Western Union
44

Great success!
45

• Infosec team having a *very* hard time getting buy-
in from management and engineering
• Invoke Picard Management Mode
• Received budget for another 3 team members
Eg 3: [REDACTED] social
media
46

Great success!
47

• Long time customer of [EXPENSIVE WEB APP
SCANNER] getting “clean results”
• Admin of admin’s through a chained attack within 24
hours of launch
• They thought they were doing a great job at writing
secure code…
Eg 4: [REDACTED]
eCommerce provider
48

Great success!
49

• Loss prevention company, works with BIG NAME
retailers
• Success of software dependent on not being
hacked - they said it couldn’t be
• Took less than 48 hours
Eg 5: Digital Safety (DISA)
50

Great success!
51

1. Create a pot that beneﬁts your engineering team
(team drinks, party, event, whatever)
2. Bug bounties paid from it.
3. What ever the hackers don’t get, the devs keep.
(Level up: Pilot it with internal teams. You can do this
with the Bugcrowd platform.)
Idea:
Gamiﬁed SDLC
52

Ready to start?
53

Bug bounties are
awesome…
54

…but hard.
55

Plan ahead
56

The Golden Rule:
Touch the code
==
Pay the bug
57

The mistake *everyone* makes:
VULNERABILITY DATA
PEOPLE
58

Risk
59

Align expectations before
you engage
60

So, do you think the
boogeyman is real?
Let Egor prove it to you.
61

• Bug bounties are cost effective, and highly
marketable, but that’s not the full story…
• …they create controlled incidents that powerfully
impact the security awareness of your builders.
• Go start one.
• More tips and tricks at https://blog.bugcrowd.com
Conclusion
62

#questions
63

@caseyjohnellis
https://bugcrowd.com
casey@bugcrowd.com
Greets to the crowd, #scotcherati, builditsecure.ly, Rapid7,
iamthecavalry.com, @treyford, @alliebrosh, @_mwcoates, @homakov,
@codesoda, @jcran and the @bugcrowd team.
W
e’re
hiring!
jobs@
bugcrowd.com

NodeSummit 2016 - WELCOME TO THE BLUE TEAM! CREATING “OH SHIT” MOMENTS FOR FUN AND PROFIT.

Recommandé

Recommandé

Contenu connexe

Similaire à NodeSummit 2016 - WELCOME TO THE BLUE TEAM! CREATING “OH SHIT” MOMENTS FOR FUN AND PROFIT.

Similaire à NodeSummit 2016 - WELCOME TO THE BLUE TEAM! CREATING “OH SHIT” MOMENTS FOR FUN AND PROFIT. (20)

Plus de Casey Ellis

Plus de Casey Ellis (20)

Dernier

Dernier (20)

NodeSummit 2016 - WELCOME TO THE BLUE TEAM! CREATING “OH SHIT” MOMENTS FOR FUN AND PROFIT.