Agility is no longer a want but a need, with digitisation driving the need for flexibility. For instance, Tesla is upending more than a century of automotive tradition, Uber is redefining the taxi market, and Airbnb is reinventing how we book vacations. Each one is disrupting the market it operates in – not in decades, but years. For a business to survive, it needs to adapt swiftly to market changes. In the last three years, 81% of organisations have started their agile transformation, while 45% indicate that breaking down silos between business and IT is the main driver for their shift towards agility.
However, the increased role of technology in delivering value also increases security risks. Whether small, isolated events or large-scale attacks, the inevitability of cyberattacks presents a strong business case for investing in effective defence capabilities. Species such as the Bombardier Beetles have adapted to ward off threats in the most challenging environments by spraying boiling toxic liquid. Organisations don’t have to go to these extremes, but they HAVE to detect and swiftly respond to ever-changing threats.
Here’s How CISOs Can Seize the Opportunities in the Age of Continuous Delivery.
Businesses have adopted the agile manifesto due to the inadequacy of conventional “waterfall” delivery methods. Similarly, bug bounty is replacing the conservative approach for managing today’s cyber security risks. It helps organisations evolve into supporting the need for speed while establishing greater transparency and getting a better grip on security costs. Bug bounty busts the myth that organisations should sacrifice security for acceleration and adaptability. It encourages a new way of working that is cross-functional, collaborative, and results-driven.
The entire operating model of bug bounty supports the five tenets of agility – strategy, process, workflows, people, and technology. Bug bounty reduces organisational resistance to change, brings security and delivery teams together, eliminates operational silos and improve transparency while helping develop a security posture at scale. Tune into this blog post to find out how bug bounty programs can meet your organisational agility needs with their flexibility and customisation efforts.
Bug Bounty Benefit: Activate Quickly and Get Fast Results
With cybersecurity being a significant threat, vulnerability tests should be conducted regularly. Pentests are rigid, and they take weeks to schedule, creating significant roadblocks especially given short notice for projects such as extra releases of applications, due diligence on potential acquisitions, and unexpected compliance audits. On the other hand, bug bounty is flexible and can become a key component of your security protocols due to its simple, adaptable implementation. Bug bounty programs orchestrate the proper outcomes to detect vulnerabilities within hours of launching.
“I do believe bug bounty is designed for agility. We can’t be agile when we’re doing pentests. There are just too many projects to follow, and we can’t do one before each roll-out owing to the lack of time, responsiveness, and means. The deadlines are too tight and continually shifting, and the tests must be scheduled several times a year. Bug bounty has ultimately allowed us to launch a real monitoring process for DevSecOps. Moreover, we can provide agile, in-depth security in collaboration with all stakeholders without overly impacting them, with continuous improvement in mind,” highlights an Information Systems Security Expert from a European Financial Institution.
Organisations that identify and remediate issues faster shorten the window of exposure that attackers can exploit, which reduces the number and severity of successful attacks. Quickly detecting security vulnerabilities contributes to faster time-to-market and greater agility for the business as a whole.
Bug Bounty Benefit: Play, Pause or Continue Testing
Agile is not only about speed to deliver, but more importantly, about speed to adapt. To achieve maximum benefits, teams often pause, review, and modify according to the requirements. Bug bounty help organisations create a continuous security environment to improve all aspects of their products, systems and processes with its flexible, iterative model. Organisations can define their metrics, procedures, standards and methods, and make informed decisions to continue the tests or pause them based on the outcome.
When BlaBlaCar implemented bug bounty initially and received their reports, they fine-tuned the bug bounty program, customising the type of vulnerabilities they prioritised and wanted to see reported. “We received ‘real’ and potentially critical vulnerabilities, which convinced us of the relevance of the model and the effectiveness of the platform. After one week, the number of reports decreased, but the ones that came up were even more interesting. This is because the hunters ‘got into’ our product quickly and produced reports that were really specific to our business”, said Alain Tiemblo, Web Security Lead Engineer of BlaBlaCar.
“As we deliver continuously, the ability to extend our program scope in one click, and to detect things quickly on these new scopes also makes us more agile: as soon as an application is updated, we can have it tested, take the results into account, and easily set up a feedback loop,” added Alain Tiemblo.
Depending on the release, tests can be conducted to facilitate organisational pace, be it weekly or monthly. If there are limited or no updates to the application, bug bounty programs can then be paused until the next big release.
Bug Bounty Benefit: Set Rewards on Your Terms
Bug bounty contradicts the traditional time-quality-cost triangle, which believes one cannot be enhanced without compromising the other two. CISOs can mitigate risks by investing time and money in mature testing procedures like bug bounty, which improves quality while saving both time and cost. “A key differentiator is that bug bounty implies an obligation of result – you pay only for what you get – while penetration testing only implies an obligation of means. This also helps us obtain security budgets internally since we only pay people who find exploitable vulnerabilities. This is starkly different from paying auditors to see whether they will find something, without any obligation of results,” remarked Antonin Le Faucheux, CISO, BlaBlaCar.
When it comes to security testing, many organisations lose sight of their objectives. They conduct tests the same way they have always done, resulting in a waste of resources, time, and money. With bug bounty, you can target the testings and vulnerabilities based on your specific requirements. You only pay for results, ensuring that your product is secure, whether you release a significant or minor update. What’s more, bug bounty optimises your security budget so that the savings can be redeployed into other programs that help secure the organisation but are typically sidelined due to a lack of resources.