Category: crowdsecurity

Yes We Hack and its Partners, or how to get the best out of Bug Bounty ?

What does a YesWehack partner do ?

Every organization is concerned by cybersecurity and most of them can see that traditional solutions (penetration testing & scanners) are not sufficient anymore. As a result, whatever the size or industry, they are increasingly numerous to opt for Bug Bounty.

By 2022, crowdsourced security testing platform products and services will be employed by over 50% of enterprises, up from less than 5% in 2018.

Gartner 2018 Market Guide on Crowdtesting

Indeed, Bug Bounty is the only solution that can pretend to exhaustiveness, responsiveness and continuity in the tests. More importantly, Bug Bounty meets organizations growing need for agility > https://www.yeswehack.com

For all that, any organization that wishes to set up/implement Bug Bounty programs is not ready to manage by itself yet; indeed the Bug Bounty process involves:
• The program‘s creation : determination of the scope, rules, researchers’ reward grid, etc.
• The program’s day-to-day management and interaction with the researchers
• Vulnerabilities and researchers’ test reports validation and management

Lacking time, resources, skills and process, some organizations can be intimidated by the implementation of a Bug Bounty Program in spite of unrivaled benefits they could get out of it.

This is where our partners step in.

Why Becoming of YesWeHack Partner?

Read More

New Gartner report references YesWeHack ‘s Bug Bounty platform.

YesWeHack is delighted to be included in the 2018 Gartner Market Guide for Application Crowdtesting Services.

For the first time, Gartner references a European Bug Bounty platform. It is a landmark for us as we are the leading European platform, not only in terms of quantity of hunters, but also in terms of active public programs.

Guillaume Vassault-Houlière, YesWeHack CEO

According to Gartner: “By 2022, crowdsourced security testing platform products and services will be employed by over 50% of enterprises, up from less than 5% in 2018.” Based on that assumption, YesWeHack is the right company at the right place: the crowdsecurity market window is wide open and very promising indeed.

Once again, YesWeHack strengthens its growth and asserts its genuine European belonging by complying with European legal framework.

Bug Bounty by YesWeHack

YesWeHack is the first European Bug Bounty platform, it provides a community of 7000+ cybersecurity researchers to organizations seeking to improve their global security.

A Bug Bounty program maximizes your return on investment by rewarding researchers on results only. It is an ideal complement to traditional IT security audits, which are, by nature, limited in time and without guarantees or performance requirements.

Read More

Bug Bounty: Take the leap – [ITW] Alain Tiemblo @BlaBlaCar

Alain Tiemblo – BlaBlaCar Web Security Lead Engineer

Since September 2017, BlaBlaCar has been managing with a select number of security experts a private Bug Bounty program to enhance the operational security of its platform.

Previously accessible only by invitation via YesWeHack.com, YesWeHack’s bug bounty platform, this program has enabled BlaBlaCar to remain proactive on the cyber security of its services.

Thursday April 19, BlaBlaCar’s program is public

What is your role at BlaBlaCar?

I am a backend developer profile, today overseeing application security. When I joined BlaBlaCar, I was in charge of the platform’s performance and security. In mid-2015 and early 2016, our operational security needed to level up significantly, especially following our major fund-raising campaigns, which put BlaBlaCar under the light and pressure. So at that period of time, i took the lead of a small team to mitigate these attacks, and audit/consolidate the platform.

What is your approach to security, including coordinated vulnerability disclosure?

We have kept application security in-house for a long time. Previously, we used classical audits conducted by various companies, by several basic pentest applications, by using static analysis tools, etc. I think it helped to rough out a lot of little things that would have been detected by bug hunters.

In addition, we received a few troll messages on Twitter reporting vulnerabilities without notice and without any details… We also have some emails via customer support about potential security holes, but nothing was disclosed by these contacts, they first wanted to be paid and this, without proof of the existence of a security flaw, so it was impossible for us to enter the game.

Read More

Bug Bounty : Franchir le pas – ITW d’Alain Tiemblo @ BlaBlaCar

Alain Tiemblo - Bug Bounty - Vulnerability Coordination

Depuis septembre 2017, BlaBlaCar propose à un nombre d’experts en sécurité triés sur le volet, un
programme de Bug Bounty privé afin de renforcer la sécurité opérationnelle de sa plateforme. Accessible
jusqu’alors uniquement sur invitation via YesWeHack.com, la plateforme de bug bounty de YesWeHack, ce programme a permis à BlaBlaCar de rester proactif sur la cybersécurité de ses services.

Entretien avec Alain Tiemblo Web Security Lead Engineer – @BlaBlaCar – manager du programme de Bug Bounty.

Jeudi 19 avril le programme de BlaBlaCar est public

Quel est votre rôle au sein de BlaBlaCar ?

Je suis un profil développeur backend, aujourd’hui chapeautant la sécurité applicative. Lorsque je suis arrivé à BlaBlaCar, je m’occupais de la performance et la sécurité de la plateforme. Mi 2015 début 2016, nos besoins en sécurité opérationnelle ont augmenté de manière significative notamment à la suite de nos grosses levées de fonds qui ont suscité quelques convoitises. J’ai alors pris le lead d’une petite équipe afin de mitiger ces attaques, et auditer / consolider la plateforme.

Quelle est votre démarche en termes de sécurité et notamment de divulgation coordonnée de vulnérabilités?

Nous avons pendant longtemps gardé la sécurité applicative en interne. Auparavant, nous faisions appel à des audits classiques menés par diverses entreprises, par plusieurs applications de pentest, en utilisant des outils d’analyses statiques, etc. Je pense que ça a permis de dégrossir beaucoup de petites choses qui auraient été détectées par des chasseurs de failles.

Par ailleurs, on a reçu quelques messages de trolls sur Twitter signalant des failles sans préavis et sans aucun détails…

Read More

Page 2 of 2

Powered by WordPress & Theme by Anders Norén