vulnerability-research
Vulnerability value modifiers
There are a few globally and truly external modifiers to the marketplace-defined value of a vulerability.
vulnerability-disclosure
bugcrowd
My DEF CON/Vegas moves
It has been an amazing week so far, but as we drop from “suite and wingtips” mode to “hoodie and sneakers” mode I’d still love to connect with as many folks as I can… Here are my approximate moves for the rest of the week – If you see me
cybersecurity
7 Years and counting…
In 2012, Bugcrowd set out to create a radical cybersecurity advantage and level the playing field between attackers and defenders. As one of the first steps on that journey, seven years ago today, we launched our first “Proof of Concept” bug bounty, offering up a total reward pool of $500
cybersecurity
My moves during the RSAC/BSides SF circus
Quick post re where I’ll be speaking and attending while the infosec/cyberz are in town for RSA Conference and B-Sides: ps all of the Bugcrowd parties, workshops, and meetups are listed here. If you want to attend Mayhem, make sure you sign up!!! It’s getting to be
bugcrowd
Happy 6th Birthday @bugcrowd
6 years ago today I got off a plane armed with a bunch of notes. I’d spent a week meeting with pen-testing customers in Melbourne, and I’d been talking to them about bug bounty programs. These conversations and a set of ideas I’d been noodling on for
vulnerability-disclosure
Thoughts on the vault7 CIA/Wikileaks disclosures
Wikileaks’ release of thousands of confidential CIA documents today is yet another demonstration of our just how vulnerable the cybersecurity domain is. Unless we do a better job identifying our vulnerabilities, attackers – be they criminals, hacktivists, hobbyist, or nation state agencies – can and will take advantage of them. What’s
vulnerability-disclosure
On the U.S. Government and bug bounties
My favorite thing about going to conferences is establishing the underlying trends behind the questions I’m asked. We’re only half-way through RSAC/BSides week, and already the dominant question is clear: When is the government going to start a bug bounty program? Here’s my answer: The government
cybersecurity
3 years, 20,000 Security Researchers & 200 Clients later...
2012 was the year that almost every industry, banking, education, government, big tech and even security, was hacked. Many, if not all of these companies were doing “all” they could to protect themselves against these hacks, and yet they were still left vulnerable. In direct response to this, 2012 was
vulnerability-disclosure
disclose.io - Driving safety, simplicity, and standardization in vulnerability disclosure.
disclose.io is a collaborative and vendor-agnostic project to standardize best practices around safe harbour for good-faith security research. The project expands on the work done by Bugcrowd and CipherLaw’s Open Source Vulnerability Disclosure Framework, Amit Elazari’s #legalbugbounty, and Dropbox’s call to protect security researchers. Our framework
cybersecurity
Bugcrowd - the Premier Crowdsourced Cybersecurity platform.
Bugcrowd is the premiere crowdsourced security platform. More enterprise organizations trust Bugcrowd’s Crowdcontrol platform to manage their bug bounty, vulnerability disclosure, and next-gen pen test programs. By combining the largest, most experienced triage team with the most trusted hackers around the world, Bugcrowd generates better results, reduces risk, and
vulnerability-research
Why the Smb Is Most at Risk from ms12-010
There’s a lot of hubbub going around about the recent vulnerability from Microsoft. It’s called MS12-020 and it affects the Remote Desktop Protocol (a.k.a. RDP or Terminal Services if you are old school). The hubbub is warranted… Once researchers get code working to exploit this vulnerability
vulnerability-research
Rdpcheck Checks Your Network for the New Rdp Vulnerability
We’ve created a tool at RDPCheck to help you test your exposure to an attack from the outside on Microsoft’s recent MS12-020 Windows Remote Desktop Protocol security flaw.The flaw affects every version of Windows so this DOES apply to you (unless you’re on a Mac…) So