The ‘first contact’ is the establishment of a conversation between the security researcher having discovered a vulnerability and the manager of the information system affected; it is the nerve centre of efficient coordinated vulnerability disclosure. How do we enable ‘first contact’ then? We have listed the tools that make it possible in a nifty infographic (in English and

Security researchers can make significant contributions to increasing products’ digital security. Yet, ‘first contact’ is hard to establish. More broadly, even when a vulnerability is reported, editors may prefer not to acknowledge it. This silence often drives security researchers to resort to public disclosure as a means of pressuring the publishers to correct the vulnerability.

So, how should one address the discovery and interaction intended to correct a vulnerability when this identification is by an individual outside the organisation? Different means exist to promote 

The ‘first contact’ is the establishment of a conversation between the security researcher having discovered a vulnerability and the manager of the information system affected; it is the nerve centre of a CVD. How do we enable ‘first contact’ then?

An organisation hosts a CERT or uses such a service via a managed services company. It is thus possible to direct all vulnerability disclosure reports to the CERT, which will then ensure coordination of the stakeholders, acting as counsel, intermediary and communicator. Likewise, CERTs are in the best position to preserve necessary pre-disclosure discretion. CERTs ensure there is time to fix. They also monitor the assets in question guaranteeing the vulnerability has not been rediscovered or exploited meanwhile.

It is easy to appreciate the need to inform the essential operators, who would be concerned by a given risk, as well as State services crucial to the Nation’s survival. Hence, the management by a CERT ensures such information reaches the third parties concerned in a privileged and fast manner. The communication circle can evolve before the patch reaches all users, thereby avoiding all malicious use. For example, the CERT-EU facilitates such interactions between the various national CERTs.

Given the difficulty in identifying an entry point allowing for the escalation of vulnerabilities, experts from the cybersecurity community have proposed 

: a file named security.txt, located at a known place in the tree structure of each website. That location needs to remain the same across websites; it is the following: www.mywebsite.tld/.well-known/security.txt.

Various organisations, including BlaBlaCar, Facebook and Google have already adopted this communication channel. For now, security.txt is still a draft standard. Indeed, the project has been submitted to the IETF (Internet Engineering Task Force, an international workgroup that participates in the development of Internet standards) for review and eventual adoption as a standard.

 is a non-partisan non-profit platform which enables vulnerability reporting while maintaining anonymity for the discoverer. Thanks to ZeroDisclo, disclosure can also occur 

 the Tor Browser. Regardless of the web browser the report submitter uses, the report is encrypted with the receiving organisation’s public key, then signed and timestamped by a blockchain. The site sends the report (to a private or national CERT), and the researcher receives a certificate as proof of deposit.

. Indeed, it formalises the report through various criteria enabling the calculation of a CVSS severity score. Even more important, thanks to the report’s encryption, ZeroDisclo acts as a secure ‘transmission belt’. At no time does the platform or the individuals administering it access the details of the vulnerability described.

Thus, coordinated vulnerability disclosure is effortless. Also, ZeroDisclo does not accumulate a dangerous knowledge of the bugs affecting third-party information systems.

Bug Bounty: the comprehensive approach to coordinated vulnerability disclosure

, also known as crowdsourced security, is a collective means of testing the security of a product or service. Each vulnerability receives a reward by the manager of the system concerned according to its severity and thus the risk that its subsequent remediation reduces. In its current version, a Bug Bounty platform brings together international ethical researchers. These platforms enable coordination between an organisation that wants to test the security of its systems and a community of ethical hackers who receive recognition and compensation for their discoveries.

A Bug Bounty program submits a digital service (a website, an API, a mobile application) or a product (a connected car) to ethical hackers for them to examine for potential vulnerabilities. In the case of public Bug Bounty programs, any ethical hacker subscribed to the platform can participate. If the program is private, only a group of preselected hackers takes part.

Bug Bounty is a future standard for cybersecurity in that it materialises collective responsibility for the reduction of digital risk. It embodies the transition (somewhat contrary to popular wisdom) from centralised control of information security towards a ‘decentralised’ approach. The latter is possible through the involvement of a community of ethical hackers. Besides, this securing by the community reduces the number of vulnerabilities likely to be sold to intermediaries with unclear, if not dishonest, motives. Indeed, through Bug Bounty, the researcher who reports a vulnerability receives a financial reward and bolsters their social capital.

Summing up: ways to mobilise collective intelligence

The global and lasting reduction of risk will come from the cooperation of both public and private actors. An international model in this field is essential to avoid all uncoordinated public disclosure. As such, guaranteeing protection for ethical security researchers is paramount. The issue of information sharing is thus crucial, and private actors play an essential role at this stage. Thus, 

the VDPFinder plug-in for Chrome and Firefox

 showcases whether a website one browses has an existing CVD policy. The latter can be an email to a CERT, a security.txt or an ongoing Bug Bounty program.

We have created the infographic below to summarise the implementation approaches for vulnerability disclosure.

 Below, you can download the high-resolution file in English and 

. It is free to use under the terms of the CC-by-NC-SA licence.

 Looking for a handy infographic to help you raise awareness about roles and responsibilities in vulnerability disclosure? 

Mobilising collective intelligence for better security

Since 2015, Firebounty has been helping users discover

disclosure policies (VDPs). For policy discovery on steroids, we have partnered with

, the ‘Internet SIEM’. Read on to find what this boost means for coordinated disclosure.

 exists since 2015 with the primary purpose of allowing security researchers to find disclosure policies of any kind, be it ‘Hall of Fame’ or Bug bounty programs paying rewards. So far, FireBounty harbours thousands of Vulnerability Disclosure Policies (VDPs). Thus, Firebounty is already the world’s most complete VDP directory.

—a one-of-a-kind tool making VDP discovery as effortless as web browsing itself. Thanks to the witty combination of FireBounty’s up-to-date and exhaustive database and VDPFinder’s ease of use, everyone knows in a glimpse how to report a vulnerability and where doing so is rewarded through a Bug Bounty program.

We have been ramping up FireBounty’s capabilities. In our quest to identify and index all VDPs out there, we have been testing a range of solutions. That is how we got to play with ONYPHE. A young, like-minded security-oriented endeavour, ONYPHE goes with the leitmotif ‘Your Internet SIEM’.

Sounds cool, eh? Read on–it gets better.

Security.txt <3 FireBounty: VDPs for anyone to use

, security.txt allows each organisation to create its VDP in a breeze. Doing so happens through a text file located in a defined, well-known path of its website. Imagined by 

, security.txt is becoming a de facto standard, adopted by large corporate websites and personal webpages alike.

Since FireBounty harbours VDPs web over, it is natural to add security.txt to it. Sure thing—but do we need to crawl, like, the 

 web to achieve this? Besides, bot-spidering websites regularly can lead to a variety of misinterpretations and side effects we ought to avoid.

We first tried to discover criteria to guess whether a website is likely to expose security.txt. By using certificate transparency to discover and check websites, we tested different criteria (

 country, certificate authority). But the approach was quick yielding no meaningful correlation with any criterium, and a meagre bunch of security.txt scattered therein.

So there we were, facing the whole internet alone with our powerful yet insufficient crawlers. We logically turned to Shodan, and it worked in a specific manner, providing us with more than 1,500 security.txt. We can do better, however.

ONYPHE is a young French company defining itself as 

. Its active scan of the whole internet—and not only the web–is coupled with other useful sources such as threat list, geolocation data, passive DNS, paste sites and even the darkweb. Thus, ONYPHE collects and indexes a tremendous amount of data.

Naturally, harbouring data is only part of the story. ONYPHE then offers the capacity to easily query these troves of information in a single search form or API. Doing so is how one effortlessly identifies the proverbial needle in the different information categories haystack (

 datascan, synscan, pastries, resolver, ctl, onionscan and many others).

And, last but not least, ONYPHE—just like 

—is founded by security enthusiasts with a deep understanding of the technical challenges practitioners face in their everyday work. Through its innovative approach, it aims to improve tools, so contributing to better cybersecurity for all.

Amongst the cool things Onyphe can do is directing its sensors and tailoring its search to find data, located deep down in a protocol structure—or, like security.txt, in a specific, well-defined path. (Shhhhh, it’s thanks to that feature that 

 actual exposures to the latest top 0-days or internet spread of famous botnets.)

ONYPHE adapted its crawlers to extract security.txt and exposed it 

 its comprehensive API. We now have everything we need to continue identifying security.txt. Since 27 April, a new logo features on many policies listed at FireBounty. Indeed Firebounty daily indexes new security.txt retrieved by ONYPHE. And it now exceeds 3,200 policies ?

We are delighted to see that many VDPs are surfacing. The increasing number of organisations devising a clear path to coordinated vulnerability disclosure indicates that a growing number of people works towards better cybersecurity. Similarly, an ever-growing number of ethical hackers makes use of existing VDPs.

While that effort is commendable, it is vital to remind everyone that a VDP is quite often a passive listening mechanism. FireBounty and VDPFinder aim at showcasing the efforts to quell wild vulnerability disclosure. They are in no way an incentive to aggressively hunt or, worse, ask for a financial reward upfront promising to “disclose if you pay me” where no monetary reward is envisioned. We are 

Let’s keep on making the Internet safer—to infinity and beyond!

Founded in 2013, YesWeHack is the #1 European Bug Bounty & VDP Platform.

YesWeHack offers companies an innovative approach to cybersecurity with Bug Bounty (pay-per-vulnerability discovered), connecting tens of thousands cyber-security experts (ethical hackers) across 120 countries with organisations to secure their exposed scopes and reporting vulnerabilities in their websites, mobile apps, infrastructure and connected devices.

YesWeHack runs private (invitation based only) programs, public programs and vulnerability disclosure policies (VDP) for hundreds of organisations worldwide in compliance with the strictest European regulations.

FireBounty x ONYPHE: Surfacing disclosure policies gets a boost

YESWEHACK PROPHILE ON HISXO

of ours is somewhat special: it tells tales

about the journey from a private bug bounty to a public one.

Olvid, a thriving start-up, made the leap in only four months. Here’s how they did it.

 is an instant messaging (IM) application whose security does not rely on any trusted third party. Unlike other IM applications – such as Signal, WhatsApp, and Telegram which use a central directory to establish secure channels – Olvid does not need a directory. This eliminates:

The risk of a significant hack/leak if an attacker takes control of that directory.

The need for Olvid to collect any personal data, for example, no phone number, name, or email.

Owing to this new security model and the innovative cryptographic protocols implemented, Olvid offers users:

A strong guarantee on the identity of its contacts, without any risk of identity usurpation, fraud, spam, etc.

Total anonymity towards third parties, including our own servers.

At Olvid, we re-implemented everything from scratch. We rely on a minimum of third-party libraries and we have designed the entire application in house.

Having new cryptographic protocols, we needed our implementation to be validated as widely as possible. To achieve that, we worked on three axes:

A ‘theoretical’ ve­­rification of the cryptography, by 

French National Centre for Scientific Research

. This mathematically proves that our protocols delivers the security guarantees that we claim;

 (National Cybersecurity Agency of France requirements);

A bug bounty program mobilising thousands of cybersecurity researchers looking for exploitable vulnerabilities in every corner of our application.

For us, this last verification stage is essential. When you sell a security application, you certainly do not want a hacker to brag about having found a vulnerability in it!

If we want to protect our application from hackers, it must be evaluated by people who use their exact methods and thought process.

We had the opportunity to participate in 

’s Live bug bounty at the International Cybersecurity Forum (FIC). We began our bug bounty experience here being hacked live for two days! We don’t regret it – it was an incredible experience. The event gave us the opportunity to discuss our application with cybersecurity researchers; and it was a very instructive experience, from both technical and business aspects.

You’re now expanding your private program into a public one. What prompted this choice?

, only a few vulnerabilities were reported by the 20 or so participating researchers. None of these were severe.

We deduced from this that our system is robust enough to welcome 

’s entire community. We now want to take advantage of one of bug bounty’s major strengths, crowdsourcing: tens of thousands of researchers bringing different skill sets and methodologies to test the security of our application.

The reason for our move to a public program is simple: we want to offer our users the best possible security guarantee. The more hunters scanning and attacking our app, the better it is for everyone!

Any tip for startups thinking of launching a bug bounty program?

Stop doubting right now! You’ve got to do it! It is indeed a bit scary at first to think that people will actually try to attack your product; but that’s fine, as long as you have the right people doing it.

I guess it’s comfortable to live in denial, thinking that if no-one has succeeded to attack us yet, we’re safe. However, one day, an attack will happen. And the only way to be better prepared for this is to test your application. Penetration testing and certifications are very important as they provide ‘stamps’ that we can show to our clients.

Continuous monitoring by expert hunters validating every new update is critical for every business in today’s world.

Hunters, go ahead. Attack us. We’re waiting! There’s still money to be taken from our wallet 🙂

To learn more about Olvid’s bug bounty program or to start hacking on it, click

Founded in 2015, YesWeHack is the #1 European Bug Bounty & VDP Platform.

Olvid, the ultra-secure messaging app, moves to public bug bounty program

Vulnerability disclosure must be coordinated to be responsible and is an opportunity to empower the various participants. Coordination means that stakeholders understand their roles and responsibilities. Here’s a handy infographic to put confused minds at ease. It is available in English and

The number of connected digital services (Internet, Bluetooth, etc.) grows. And with it, the issue of vulnerability disclosure management is becoming increasingly urgent. Unknown vulnerabilities constitute a risk. System managers, software publishers and their users must be able to identify that risk to fix. Appropriate management and disclosure of all vulnerabilities are essential for reducing digital security risks.

The question of vulnerability disclosure management is gradually becoming more urgent as the number of connected digital services (Internet, Bluetooth, etc.) increases. Yet, this issue is not new: ever since we began creating digital products and services, the subject of vulnerability disclosure has ignited debates within the information security community.

Creating software that meets all security requirements is no small challenge. It is thus crucial to identify and correct vulnerabilities as fast as possible to prevent their mobilisation by malicious individuals. Information systems are better protected when vulnerabilities are discovered and dealt with.

Vulnerability disclosure must be coordinated to be responsible. It is also an opportunity to empower the various stakeholders. All digital service providers, both public and private, are responsible—not only for the development of the best software possible but also for the responsible management of vulnerabilities.

NEW TO COORDINATED VULNERABILITY DISCLOSURE?

WE’VE GOT YOU COVERED: READ OUR WHITE PAPER.

Identifying a bug is within reach of many individuals. There is no need to work inside a company to recognise a malfunction leading to a security risk. Well-intentioned individuals often identify vulnerabilities and then seek to 

Obstacles to coordinated vulnerability disclosure

Besides, it is a far more delicate situation for an individual outside of the organisation to report the vulnerability. It is impossible to address vulnerability disclosure without considering the motivations of the individuals reporting the bugs in an information system. Depending on the answer to this question, legal penalties may apply. Such legal uncertainty is a frequent hurdle to reporting a vulnerability.

Another obstacle to coordinated disclosure is the absence of a clear and secure communication channel enabling the escalation of active vulnerabilities. Indeed, most organisations with an online presence have no means dedicated to receiving reports of information system bugs. This deficiency explains in part why the organisation in question remains silent in response to reports from well-meaning individuals. This silence endangers the users of the vulnerable service.

Last but never the least, disclosure without anticipating the remediation timeline can also lead to negative consequences for the users.

These issues underscore the need for a transparent and smooth decision-making process. It ensures the digital security of individuals as well as public and private stakeholders and protects the rule of law online.

Clear roles and responsibilities are part of the right answer

Hence, the challenge is to get an ethical hacker who had found a vulnerability to report it to a system manager. The latter can then fix it and mitigate the relevant user risks without harming the hacker in the process. It is thus necessary to put in place a vulnerability disclosure system that benefits all stakeholders. You guessed that right: it is coordinated vulnerability disclosure (CVD). The latter is structured cooperation where ethical hackers report vulnerabilities to the manager of the information system in question.

Any company or public organisation can implement CVD and enable a direct report of the vulnerability to the most relevant entity. It can also involve an intermediary. In both cases, the approach is a coordinated vulnerability disclosure. That process allows an organisation to remedy the loophole before any detailed information concerning it goes public, with all of the negative implications that this can cause.

We have created the infographic below to better grasp the roles and responsibilities of the various participants to a CVD.

 Indeed, knowing who does what to reduce digital risk must not be a modern 

. Below, you can download the high-resolution file in English and 

Roles and responsibilities for efficient vulnerability disclosure

ZeroDisclo.com is a non-partisan non-profit platform. It enables vulnerability reporting while maintaining anonymity for the discoverer. It’s got a spring refresh to make it even easier to do vulnerability disclosure right.

 enables vulnerability reporting while maintaining anonymity for the discoverer. Thus, ZeroDisclo channels an insightful disclosure process all by protecting the vulnerability reporter and providing timely and detailed information to the receiving 

ZeroDisclo builds the bridge between an ethical hacker and a CERT. The platform formalises the report through various criteria enabling the calculation of a CVSS severity score. Even more important, thanks to the report’s encryption with the keys of the person submitting the report and of the receiving organisation, ZeroDisclo serves as a ‘transmission belt’. At no time does the platform or the individuals administering it access the details of the vulnerability described.

ZeroDisclo is also available as a .onion instance, enabling coordinated vulnerability disclosure 

. Regardless of the web browser the submitter uses, the report is encrypted with the receiving organisation’s public key, then signed and timestamped by a blockchain. The site sends the report to a CERT; the vulnerability discoverer receives a certificate as proof of deposit. Coordinated vulnerability disclosure is thus possible without ZeroDisclo having to accumulate a dangerous knowledge of the bugs affecting third-party information systems.

Enabling coordinated vulnerability disclosure is essential. ZeroDisclo is a uniquely positioned tool that does just that. The technology behind it does disclosure well.

That is why we deem it necessary also to give the website a spring refresh. The redesigned-from-head-to-toe website aims at seamless navigation—vulnerability disclosure is also done right when it is done through an unambiguous interface. Among other things, the submission form now indicates what parts of the vulnerability report are encrypted. Furthermore, the FAQ provides answers to many questions we have received since the platform’s inception in late 2016.

Indicate which report details are concealed

We heavily insist on the importance of bringing sensitive information to the right people without exposing the discoverer to unnecessary legal danger in the process. Alongside, we need not receive a copy of those details: our work aims to contribute to reducing vulnerabilities, not to stockpile them.

The vulnerability submission form is a central tool on ZeroDisclo. As it enables the discoverer to reach out to the receiving CERT, we have paid particular attention to make it as unambiguous as possible. Hence the little icon that indicates which parts we have access to—and which we do not.

A FAQ to better know what you can(not) do with ZeroDisclo

You have questions; we get that. And get these, too ? Hence a FAQ to reflect the various questions we have received in the past nearly-four years. The page is accessible through the top navigation menu. The questions are under broader 

, clarifying aspects for the different roles that partake in the vulnerability disclosure process.

CERT onboarding and further awareness raising

On the other side of ZeroDisclo’s ‘transmission belt’ is a CERT.

A short yet unambiguous Disclosure Policy

The CERT needs time to investigate. Reproducing the vulnerability may take time; cascading details to all concerned parties and organising fixes is also time-consuming. That is the reason we have outlined a concise yet straightforward Disclosure Policy. Acknowledging it is the final and mandatory step before submitting the vulnerability report.

An infographic to grasp ZeroDisclo in the blink of an eye

We aim for ZeroDisclo to be effortless to use. Yet, there will always be newcomers, both in the hacker community and within CERTs. Hence a dedicated ‘How it works’ page—and infographic has the spotlight therein. We have given it 

 approach, adding a more detailed step-by-step explanation at the bottom of the page.

In the coming 48 hours, we will provide a full infographic to the CERTs listed on ZeroDisclo. We aim it as a handy tool they can use internally to raise awareness about vulnerability disclosure done right. Until then, make the Internet safer—use ZeroDisclo.com!

ZeroDisclo.com: Vulnerability disclosure done right

, we sat down with the Information System Security Expert of a major European financial institution. Read on to learn how a heavily regulated industry implemented Bug Bounty.

Why did you decide to launch a Bug Bounty program?

To be honest, I wasn’t convinced at first. I imagined it was a ‘patchwork’ of various missions being carried out by their pentesters and not an established, focused activity.

 team who pre­sented different advantages that met my security expectations. Following this, we launched an initial 

 campaign on a site we knew well and which we had already tested multiple times before. Choosing a mature scope enabled me to control the potential program costs.

I wasn’t expecting to get any feedback as we were already on our eighth penetration test on the site since I’d been on the job. And the last test had been conducted just the week before. 

But the results proved us wrong: we received multiple vulnerability reports, including one that was critical, just an hour after launching the program

. We now know this vulnerability had existed for 18 months. In other words, 

two pentests had taken place without it being noticed. So, Bug Bounty instantly appealed to us! (Laughs)

What value does Bug Bounty offer compared with traditional cybersecurity solutions, such as penetration testing?

First, you’re getting something close to the real thing. By that I mean we’re not trying to get a comprehensive view of the vulnerabilities. We’re trying to hit right where it hurts immediately. That’s very close to what a real attack would do.

Second, Bug Bounty gives us continuity – vital given the current agility trend. We continually update our internet applications (at least once a month); so, it becomes complicated and costly to pentest each deployment. Bug Bounty enables us to monitor continuously.

Third, the efficiency and quality of the work done by the hunters is exceptional. On sites that we’d tested multiple times, we systematically found vulnerabilities, some of which were critical. The hunters are paid based on results, so their goal is to find something concrete for us – and that’s my goal, too. One of the problems with pentesting is that the results rely entirely on the pentester.

With Bug Bounty, we work with specialists. The hunters won’t necessarily look for every type of vulnerability that may exist on a web application. Instead, they go where they perform the best – and where they can be swift and effective. That’s what we’re looking for, too.

Since we launched our Bug Bounty program, we’ve upped our security game: we found new vulnerabilities. We were able to fix them, and the security of these applications is now a cut above. Ultimately, that’s what a CISO should be aiming for: not just compliance, but enhanced security.

The final very important advantage is the return on investment (ROI). Between the reward budget and the cost of the platform – and given the results – over the year, it’s very profitable. I have twice as many vulnerabilities reported via my Bug Bounty program than I did with pentesting, and it costs me about 50% less.

I’ve been pentesting critical sites for years and getting empty or nearly empty reports in return. We were paying because it was our policy, and we needed to meet our compliance requirements; but it brought us nothing, or almost nothing more, in terms of security.

Does Bug Bounty mean the end of penetration testing, or are the two complementary?

They’re still complimentary, but it will reduce the perimeter seriously. We will aim to maintain the same number of pentests, but focus them on less critical areas.

I’m now wondering if it makes any sense to do annual pentests on applications managed in agile mode. And for all the critical web-based applications, we’re moving towards full Bug Bounty.

How does Bug Bounty work in your company? Have you observed any changes in your teams since you began Bug Bounty?

We’re in a ‘managed’ program, meaning we don’t do the vulnerability triage ourselves. But, internally, I’m in charge of overseeing the Bug Bounty program. It’s a little time-consuming at first; you need the discipline to avoid looking at every vulnerability, one by one, as soon as you get them. Once you es­tablish your rhythm (for me, that’s once a week), it’s advantageous. Speaking of time, it’s close to that of managing a classic pentest. On the other hand, it’s a lot simpler to launch and monitor than a pentest.

We gave the Operational Security team direct ac­cess to our program. This way, our colleagues can see the vulnerabilities as soon as they’re validated. Also, our developers can interact directly with the hunters. We’ve involved them right from the launch of the project, so, they didn’t take it as a ‘punishment’, but rather like a game of offence/defence. That’s exactly how I wanted it to work; it was like: ‘Oh, they’re good, how do they do that?’. (Laughs)

Engaging with the developers has made us a lot more effective. It helps them improve and, in general, helps us make progress in terms of security.

We were aware that we needed to change. However, we couldn’t address the need for checking production applications by performing pentests (monthly roll-outs). In essence, we were in the process of deploying without really respecting our security policy because we could only audit them over time. Therefore, we needed to find another solution, and that solution was Bug Bounty.

I do believe Bug Bounty is designed for agility.

We can’t be agile when we’re doing pentests. There are just too many projects to follow, and we can’t do one before each roll-out owing to the lack of time, responsiveness, and means. The deadlines are too tight, continually shifting, and the tests have to be scheduled several times a year.

Bug Bounty has ultimately allowed us to launch a real monitoring process for DevSecOps. Moreover, we can provide agile, in-depth security in collaboration with all stakehol­ders without overly impacting them, with continuous improvement in mind.

For example, when a vulnerability is reported, validated, and sent for processing, we’re told internally that the application firewall has been updated as a result. Then, we ask the hunters to check—and they always manage to exploit the vulnerability by going around the web application firewall (WAF) another way. This interplay is continuous improvement in action and reveals that the code must be fixed. If necessary, we can put the hunters and developers in contact, to further discuss the vulnerability and its fix.

Everyone is empowered, equipped, and a lot more responsive – that’s the beauty of DevSecOps.

If you want more informations about Bug Bounty & YesWeHack, 

How a heavily regulated financial institution implemented Bug Bounty

YesWeHackEDU, a fully-fledged educational platform, mobilises real-world hacking techniques for training purposes. YesWeHackEDU provides a reliable approach for reporting vulnerabilities and is a tangible evaluation tool. The platform offers free subscriptions for two months starting from 1 April to help universities during the COVID19 outbreak.

Through getting together ethical hackers (‘bug hunters’), and organisations committed to improving their cybersecurity, bug bounty platforms play an essential role in implementing coordinated vulnerability disclosure and surfacing bugs to reduce cyber risk.

Cybersecurity is both an economic and societal issue. Yet, this sector suffers from an imbalance between the state of the threat and the market’s defence capabilities. Thus, the capacity of public and private actors to detect and correct shortcomings professionally and ethically must be rapidly strengthened. To remedy that imbalance, we need comprehensive training and better information sharing.

 in November 2019, a unique and fully-fledged educational platform aimed at students and teaching crew alike. Due to the current 

, we have decided to provide basic two-month free licences to learners and instructors, enabling skill-building to continue despite the pandemic.

 self-education: complementary yet insufficient

Although more and more universities and training initiatives sprawl, they are unlikely to mitigate the growing skills shortage. Formal cybersecurity education is unable to replenish the talent pool at a pace that follows the increasing complexity of cybersecurity challenges. In contrast, an overwhelming majority of ethical hackers operating today are self-taught. Self-education is possible thanks to abundant online resources and expanding events which increasingly feature a Capture-the-Flag (CTF) type of activities.

Both formal education and self-training have shortcomings. University curricula remain too theoretical, students setting foot in real-world operations solely during their internship. The latter often happens at the Bachelor or Master’s level. Pluridisciplinarity is still challenging to achieve, a hurdle especially damaging to cybersecurity and computer science curricula.

Self-education, on the other side, relies on the individual’s commitment and ability to identify security-focused courses available and select the ones most relevant to the issue at hand. Even with a performant self-directed learning resource set at hand, 

 in online education, albeit their role becomes one of a learning catalyst and knowledge navigator.

The broader connected society understands the challenge. The outcome is new education tools for security, aiming to solve the cybersecurity skills gap through an approach outside the classroom. Both free and paid-for coursework designed by ethical hackers features amongst those tools, all encouraging and relying on collaboration into the cybersecurity community.

The bug bounty platforms all have a dedicated “Resources” page. A closer examination of these pages, however, concludes to a high uniformity of available content.

YesWeHackEDU builds bridges between universities and communities

Bug bounty programs include concrete incentive structures and processes designed to encourage individuals with a range of experience and talent to identify and report potential security vulnerabilities. Embracing this idea requires a real sense of agency on the individuals. Yet, relying on the person alone is short-sighted at best. Collaboration through practical situation awareness thus leverages an innovative way for formal education to keep up with the rapidly evolving talent need landscape.

 is a unique and fully-fledged educational platform in both its approach and outreach. It mobilises real-world data in a structured way. Alongside diverse training environments matching different student levels, YesWeHackEDU provides a reliable methodological approach to vulnerability report composition and constitutes a tangible evaluation tool.

Academia needs to capitalise on the available online tools for teaching and welcome innovative approaches to training. YesWeHackEDU is one such progressive development. Three main educational scenarios made possible by YesWeHackEDU: as part of a cybersecurity curriculum; as a module for Computer Science curricula more broadly (e.g. software development, data science); as part of life-long learning programs.

YesWeHackEDU as part of a formal cybersecurity curriculum

Crowdsourced security invests organisations with the skills, experience and nonstop coverage of creative and experienced security researchers. These hunters work to identify vulnerabilities before criminals exploit them. Such a proven model for crowdsourcing the right expertise, applying it when and where need be, and rewarding for results is what YesWeHackEDU enables in the classroom.

Through engaging students and the teaching crew with the training environment, YesWeHackEDU offers a blended learning approach for cybersecurity curricula. The educational set-up streamlines learning effectiveness in building upon students’ pre-existing technical knowledge and fostering their proactivity, autonomy and rigour. Since YesWeHackEDU reliably tracks contributions, teachers can follow progress and grade based on a formal and harmonious delivery process.

The ongoing COVID19 outbreak has drawn learners and teachers away from the classroom. Still, cybercriminals are riding the pandemic wave, often adding a cyber crisis to the health crisis. 

’s mission to build bridges between ethical hackers and organisations, we have decided to provide free licences to any university, starting 1 April. Those licences span two months.

They will enable teachers and students alike to benefit from top-notch pedagogical resources during the COVID19 pandemic.

YesWeHackEDU: Addressing talent shortage through Bug Bounty

Why did you implement a bug bounty program?

We’ve been ISO 27001 certified since 2014 and are mandated to use penetration testing to seek out vulnerabilities. At first, the penetration testing proved useful. Over time however, they produced fewer exciting outcomes. We quickly realised that owing to the limited duration of an audit (2-3 weeks), the penetration tester didn’t have the time to identify more severe vulnerabilities. At best, he or she had hunches, but then we needed to work on them.

 had been working well in the U.S. Household name brands were using the approach.

We explored red team and bug bounty, with researchers coming from diverse backgrounds to test our scopes and discover new vulnerabilities.

If we’d gone with red team, we’d have encountered the same problem we had with the classic penetration testing I mentioned before. So, we chose to launch a bug bounty in the belief that, although the penetration testers were no longer finding anything, that didn’t mean there weren’t other problems.

We started with a private program collaborating with approximately 15 hunters because we weren’t ‘sure’ about our applications. The hunters identified some significant vulnerabilities. We gradually invited more hunters before finally going public with two scopes: our infrastructure service and our customer portal.

Can you describe the evolution and development of your program?

It was reasonably quick – one year – to implement the program. When we went public, we didn’t experience a sharp spike in vulnerabilities: we started with a grid of very reasonable bonuses, which we gradually increased to reactivate hunter activity on our program to reach our current ‘cruising speed’.

Did sovereignty influence your decision to work with YesWeHack?

Yes, definitely. When we considered bug bounty, we were aiming for both the 

 certification. It therefore seemed more opportune for us to work with a French partner, giving us solid guarantees on how our data is managed.

Is working with a sovereign platform an asset for you in the way you approach your market?

The YesWeHack Blog

Mobilising collective intelligence for better security

FireBounty x ONYPHE: Surfacing disclosure policies gets a boost

YESWEHACK PROPHILE ON HISXO

Mobilising collective intelligence for better security

Olvid, the ultra-secure messaging app, moves to public bug bounty program

Roles and responsibilities for efficient vulnerability disclosure

ZeroDisclo.com: Vulnerability disclosure done right

Olvid, the ultra-secure messaging app, moves to public bug bounty program

How a heavily regulated financial institution implemented Bug Bounty

YesWeHackEDU: Addressing talent shortage through Bug Bounty

How Outscale secures its sovereign cloud with YesWeHack

How a heavily regulated financial institution implemented Bug Bounty

Don't wait for threats to strike

Produits

Chercheurs

Ressources

A propos

Suivez-nous