PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How the Risk-Averse DoD Learned to Stop Worrying and Love the Hackers

hackerone.com | vulnerability | #bug-bounty | #vdp | #roi | #dod | #security-conference | #hacker-powered-security
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A Security@ 2019 panel traces how the US DoD embraced hackers: its VDP and bounties surfaced 11,000+ valid vulnerabilities, saved taxpayers $64 million in three years and returned roughly 800% ROI.
Published
Collected

Related coverage

vulnerability · hackerone.com
Why Every Federal Agency Needs a VDP
A CISA draft directive requires all US federal civilian agencies to publish a vulnerability disclosure policy, following the DoD VDP model that surfaced 12,000+ vulnerabilities in three years.
incident · hackerone.com
How Hackers—the Best Kept Secret in Cybersecurity—Can Help Your Organization Protect its Assets and Improve Security
Recap of HackerOne's fifth Security@ conference, where CEO Marten Mickos cast ethical hackers as cybersecurity's best-kept secret against supply chain attacks, ransomware, and misconfigurations.
blog · hackerone.com
Security@ Fireside Chat: Insights from Phil Venables of Goldman Sachs
Former Goldman Sachs CISO Phil Venables shares lessons from 25 years in banking security: build security into the SDLC instead of leaving it to specialists, and give hackers a clear reporting channel.
blog · hackerone.com
Security@ 2018: Oath, DoD Highlight Value in Bringing Bug Bounties to Life
At Security@ 2018, Oath CISO Chris Nims, DDS's Reina Staley, and hacker Frans Rosén discussed how in-person events strengthen bug bounty programs; Oath alone paid $2M in bounties over six months.
blog · yeswehack.com
‘No cheaper way of getting security testing’: financial services Bug Bounty success story
Finance-sector case study: Bug Bounty proved ~90% cheaper than pentesting, complements internal testing on internet-facing assets, and began with a VDP after two good-faith bug reports.
vulnerability · hackerone.com
How Federal Agencies Use Vulnerability Disclosure Policies to Level Up Security
Vulnerability disclosure policies are becoming a requirement for federal agencies. The article recaps HackerOne's government work since Hack the Pentagon and five components of an effective VDP.
Back