August 2018
Intermediate to advanced
45 pages
1h 2m
English
Content preview from Building a Modern Security Program
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Chapter 4. Building a New Feedback Loop by Starting a Bug-Bounty Program
Bug-bounty and responsible-disclosure programs are incredibly useful.
Note
Bounties and responsible-disclosure programs can be completely separate activities. I’m using them interchangeably in this chapter simply for brevity, but I highly encourage anyone looking further into launching one to specifically understand the difference and choose whatever is the right starting point for your organization.1
If you’re not working toward launching one at some point, I strongly suggest considering it. Often, security or technology leaders are worried about either about having the funds to support bug bounties or about inviting attacks on the organization. However, my experience is that these two concerns are much smaller issues than you would expect in practice.
Many organizations have embraced bug-bounty and responsible-disclosure programs in the past few years for two key reasons:
Bug bounties give you a real-time and ongoing feedback loop that highlights where your security program is succeeding and where it is failing.
Bug bounties provide an avenue and incentive for researchers to report serious vulnerabilities they previously might not have shared (or simply sent directly to the press or security mailing lists).
Because both of these reasons offer major advantages to organizations with a program in place, it’s no wonder bug-bounty programs have seen such a high rate of adoption.
In this chapter, I share experiences ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.