How Building a Better Hacker Accidentally Built a Better Defender
Talkat AppSec California 2015 · on Wednesday, 2015-01-28· at 14:00· Annenberg Community Beach House: Track 3, 415 Pacific Coast Hwy·
summary
Claims that a crowdsourced program turns offensive skill into defensive improvement get tested with numbers and stories: a Bugcrowd platform with 145,000 researchers produces an early spike in findings then a long tail as engineers fix root causes, a private bounty neutralizes an extortion attempt, an admin chain exploit surfaces on day one, and vendor comparisons show 3–5× more vulnerabilities per dollar versus traditional testing, so the built system demonstrably reduces repeat issues.
AI-written summary · about
chapters (12)
- 0:00Introduction and context
- 2:22The builder-breaker tension
- 5:31Bridging the gap with security
- 10:01Limitations of traditional tools
- 12:46Driving security awareness
- 15:48The role of bug bounties
- 19:17Psychology of external testing
- 22:45Real-world success stories
- 26:05Unconventional applications
- 31:13Strategic program implementation
- 33:29Best practices for success
- 38:42Q&A and concluding remarks
related talks
12mAre Users Able to Take Control of Their Data?
24mHacking The 0day Market
30mHackers Going to Hack
20mHow to Use Your Vulnerabilities to Train Your Developers on Security
16mThe hacker army protecting your data
12mConfessions of a reformed pentester
22mEngineering under the watchful eyes of hackers
30mDoes Public Disclosure of Vulnerabilities Affect Hacker Participation in Bug Bounty Programs?