10 years of Working with the Community
summary
Ten years of corporate response becomes a checklist of concrete changes: a central PSIRT and ASSET move from reactive email fights to HackerOne bounties and hundreds of researcher reports, use of bugcrowd/Signal Sciences experiment to measure live detection, monthly Flash patches and background auto‑updates, and a commitment to push fixes immediately — one recent zero‑day patch hits production in three days. Crowdsource pen tests regularly surface creative, actionable bugs, and teams measure success by reduced response time and higher signal‑to‑noise in reports.
AI-written summary · about
chapters (16)
- 0:00Intro
- 1:06Background
- 2:20Listicle
- 3:27Security Community
- 6:05Security Researchers
- 9:00Vulnerability Report Forms
- 10:18No one is evil
- 12:50Security vendors
- 14:57Crowdsource vs traditional pentest
- 18:10Collaboration
- 20:18Customers
- 22:02Path of Least Resistance
- 31:38Example
- 35:20Metrics
- 37:08Reports
- 38:38Sharing Findings
related talks
45mThe Good, the Bad, and the Bounty: 10 Years of Buying Bugs at Microsoft
56mHow Building a Better Hacker Accidentally Built a Better Defender
53mFive Years of 'Make 0Day Hard'
31mData Driven Bug Bounty
45mRunning an efficient bug bounty program and PSIRT... (Garrett McNamara, Jeff Guerra)
20mCalcifying Crisis Readiness
01mSponsor Interview
51mBigger, Faster and More Secure