Category: Feature

Edouard Camoin, CISO of Outscale.com, on the bug bounty switching process from private to public status

https://twitter.com/skelkey

Edouard Camoin, CISO of Outscale.

– What’s your role as CISO within Outscale?

First of all, Outscale deals with IaaS : like AWS we provide API and we have Branch offices in France, USA and China. Each Branch office is subject to a specific digital sovereignty.

I’ve been wearing two hats : Guarantor of the internal security and guarantor of the security for the customers.
Globally speaking the human resources are at the core of my job.

– What was the need assessment that led to the opening of a bug bounty program?

We provide cloud computing services with certification 27001.

Regularly, we order pentesting sessions led by IT security companies. The results are pretty good but that did not satisfy us enough and we wanted to go deeper to better secure our products.

We made up our mind to expanse our culture in terms of security. Clearly, bug bounty is another approach because the payment is bound to the result, only the result counts, and bug bounty is not limited in time.

– Why did you opt for BountyFactory and more precisely, what criteria convinced you compared to other US and European platforms?

We needed a platform based in France and so in Europe strictly because it was a strong demand on the behalf of our management because we are very sharp on the sovereignty of the data.

So de facto, the US platforms have been disqualified.

BountyFactory offers much better responsiveness with the integration of features within the platform and the process of creating the program is clear. We were seduced and convinced by the high quality of the responsiveness and relevance of the YesWeHack team.

– Did you ask for assistance in setting up your program?

BountyFactory provides a real and efficient support and follow-up.

As a matter of fact, we managed to publish our program in just a single day!

I was sent an example of a program and in no time I was able to finalize, define our scope properly. Last step was the adjusting of the overall amount for the rewards.

– For the private step how many hunters did you select?

From the hall of fame, I just selected the hunters that I knew of reputation (5 or 8) and completed with some of the yeswehack private team.

– During the private program what did you notice in terms of reporting of vulnerabilities?

Indeed, we had two private programs.
One focused on our IaaS and Api and the other one focused on our web application .

As for our Web interface : we’ve got 10 reported bugs in one month, and 5 were validated. Only 3 of them were critical.
Concerning our API : nothing critical so far .

– Have you enjoyed the quality of communication between you and the hunters via the Bountyfactory platform? What improvement would you need?

The ticketing system via email is ok beyond that, we often discuss with hunters via twitter and more generally via the famous IRC so it would be a good idea to have a secure and built-in Instant messaging feature.
The hunters are very correct, they ask before attacking. The level of discussion and consultation is really good, prevention upstream before testing the perimeter because the platform was in production. They are careful and responsible, they want to have the customer’s approval before trying various methods.

– Why did you decide to go public?

First beginning by a Private program was highly needed for we had no experience in managing a bug bounty program.
The private step has a clear advantage : a private bug bounty is like a pentest without time limit.
Going Public will allow us to test in real conditions our IaaS + Api.
This first pass throughout the private mode is important to lucidly approach the switching from private to public status.
Now we are glad to announce : Everyone can play !

The real attacker does not care about standards so only Bug Bounty can simulate this brutal truth !

– In short, are you satisfied with your choice?

Bug Bounty is really appreciated in communities, we wanted to set an example, in our humble opinion, the pentesting will have to question itself. The Hunter is involved in bug bounty to find. Unfortunately, no normative aspects (PASSI) look at the benefits and we can confirm that the real attacker does not care about standards so only bug bounty can simulate this brutal truth !
With our customers, we will promote this exercise widely via twitter, and moreover our security approach via bug bounty will be explained to our partners and customers in the forthcoming appointments.

***

The Hunt is ON !

Outscale Bug Bounty Program

***

Xavier Leune, CCM Benchmark Group, on the benefits of bug bounty

Xavier Leune - CCM Benchmarck group -

Xavier Leune – CCM Benchmarck group –

What is your role in CCM benchmark ?
I am deputy CTO and i’m in charge of technical monitoring with Damien Mangin, CTO of CCM Benchmark Group.

What were the reflexion and the needs assesment that brought about a bug bounty program ?
Like any other actor on the Internet, we are experiencing increasing threats like hacking tries or malware targeting our platforms. As we are the first French leaders media company (according to Comscore), we are particularly exposed to cyber threats. Therefore, we are meant to have a proactive approach in terms of security in order to protect our users’ data.
The bug bounty Program we opened was a very important step complementary of others methods we set up (pentests, trainings). In terms of security by design, this exercise is really useful for our devs because thanks to the bug reporting they can improve the degree of security of their own code.

Why did you guys choose Bounty Factory : What made the difference compared to other bug bounty platforms ?
We paid attention to several criteria provided by Bountyfactory.io. First advantage was the fact that it is based in France and it strongly facilitated the set up because we had a good feeling throughout the discussion with YesWehack teams. They did prove their capacity in mobilizing some high-level hunters for a program such as ours. Eventually, The European approach and the way the rewards are run were both arguments that can assure us to fight against the financing of terrorism.

Did you ask for an help for setting up of your program (in terms of scope, timing, invitations) ?
Since the launching of our bug bounty program on the 28th of September, we’ve been helped by Bounty Factory dedicated Team from the very beginning and on the regular basis. We did profit from their experiences in order to better write up our program and better define our scope so that hunter were precisely informed of our expectations. Moreover, we have been accompanied to define our rewarding policy to treat properly the feedback given by hunters who are spending long time for securing our platforms.
Last but not least, we benefited from Bounty Factory dedicated team in order to select and send invitations to high-ranked hunters.

How many hunters did you invite for the private step ?
For the private step we have invited the whole YesWehack private team made of 10 people.

During the private time, what did you notice out in terms of reported vulnerabilities ?
Obviously at the very beginning of the program simple and common vulnerabilities were reported, especially XSS vulnerabilities. As time went by, more sophisticated vulnerabilities appeared , we were really surprised by some findings. We have felt a very good implication on the behalf of each hunter who was driven by their appetite for being the first reporting a critical vulnerability.
The features : 58 reported bugs, 34 were subject to corrective measures. Others were mainly duplicates 18 out of 24.
The number of critical vulnerabilities were up to 5.
The best reward  for one and only bug was up to 1000 €.

Did you appreciate the level of communication between you and the hunters ?
The level of communication with the hunters was really appreciated by our team. At times, we experienced some difficulties concerning some vulnerabilities in reproducing them or understanding the prejudice they implied. So the hunters were really good at answering our questions and at double-checking the patches we delivered.

Why did you choose to go public ?
To us, going public is a natural evolution of our bug bounty program. We wanted to be able to understand correctly the art of running a bug bounty through Bountyfactory.io especially by dealing with a restricted number of reported bugs in a first movement and along with hunters whom we wanted to communicate with. Now, we are far more confident in terms of procedures and in terms of patching policy, so it makes sense going public and being exposed to a max of skills to keep on securing our platform .

In terms of profits, can you say that beyond the financial aspect there are issues of communication and reputation ? How would CCM deal with these aspects ?
It is important for us to show a proactive approach on such crucial issues. However, it is not planned at the moment to promote the opening of our bounty bug program towards our audience. Above all, we decided to go public for ourselves and our visitors.

***

So, Hunters 

Hack and take the cash

via BountyFactory

***

Bountyfactory.io : What about the legal features ?

Load European Cybersecurity

Bountyfactory.io – the first European Bug Bounty platform – was launched in early 2016.

Unlike some other platforms, Bountyfactory.io presents some specific and legal features that are designed to strengthen its relevance, security and legitimacy.

Above all, Bountyfactory.io focuses on security and legal framework :

Our Servers are based in Europe. Therefore, No data exposure to the US services via FISA, Patriot Act, Freedom Act.

  • BountyFactory uses OVH dedicated cloud that is subject to Service Organization Controls namely SOC 1 type II (SSAE 16 et ISAE 3402) & SOC 2 type II
  • Our infrastructure is ISO 27001 certified
  • Each vulnerability, each report, each comment is encrypted before being stored in our database and only identified actors are access granted.
  • In terms of financial transactions : BountyFactory complies with the following norm > The Payment Card Industry Data Security Standard (PCI DSS)
  • In terms of Privacy, BountyFactory is subject to EU Data Protection Reform (January 2012) While the Regulation will enter into force on 24 May 2016, it shall apply from 25 May 2018. The Directive enters into force on 5 May 2016 and EU Member States have to transpose it into their national law by 6 May 2018.
  • Our payment system, MangoPay, is tightly compliant to EU legal framework in terms of anti Money laundering and anti financing terrorism

mangopay_european_legal_framework

***

Beyond that essential standards, let’s go deeper into BountyFactory.io in order to discover some useful and relevant features :

As a customer – once logged in as Admin-manager – you will be able to digitally sign the General Terms & Conditions of Use thanks to YouSign Company based in France and subject to both French and European Law.

The GTU signing process

Send Bug Bounty Confirmation Code

Validation of the signing Process

signing process

Still as a customer, you are free to Credit and Refund your account any time you need.

Bug Bounty Credit and Refund

By default, your bug bounty program will be private so you can select the hunters (max 50 people) you want to invite.

For instance, you can choose BountyFactory core Team made of 10 people.

Yes We Hack Bug Bounty Private Team

And let the game begin !

The chosen hunters will start searching for vulnerabilities within the scope you defined with BountyFactory Manager.

Bug Bounty Program Management is a differentiating criterion and this feature will be the topic of the a forthcoming and dedicated post.

In order to win efficiency and time : only confirmed true vulnerabilities are taken into account.

Therefore, you will see the amount of bugs found in your dashboard . Each Bug is categorized according to OWASP criteria.

The screenshot below shows more details about the gamification feature focusing on the quality of reports submitted by Bug Bounty Hunters.

The admin-manager is able to rate and allocate one or several points to a well written report on one vulnerability .

Validation of the Vulnerability Report

Over Communicate

Comments are very useful to discuss some details with the researcher and it strengthens significantly the level of communication between the requester and the hunters.

Comments of the Vulnerability Report

One important step is the following : The way you will be able to reward a good hunter.

Thanks to MangoPay technology and security, one hunter can be paid by credit card or through your wallet. MangoPay is a service provided by the French Bank > Crédit Mutuel Arkéa

Rewarding Bug Bounty Hunter

The Dashboard gives you an overview of bug types and statuses

Dashboard

types_of_bug_bounty

As a Game Master : manage your Budget, your Timing, your Hunters

For instance, the screenshot shows you can keep an eye on your budget by checking statistics of the ongoing bug hunting (average and max rewards out of your total budget)

budget_average_reward_bug_bounty

Any time, you can choose to switch from a private program to a public program.

Switching from Private to Public Status

This step is specifically critical so BountyFactory Manager will be notified.

In order to avoid failure, YesWeHack Program manager will double check with the requester if it is a legitimate move.

To sum up, BountyFactory.io provides original features that will help customers managing their Bug Bounty Programs with all the specs, layers of security and trustworthy norms.

rihannaRegister and open your own bug bounty program !

***

/!\ Keep in mind /!\

We Have More Features to Show You

We will keep You posted folks !


Read More > Our FAQ

YES WE HACK © 2017 | Our Job Board | Our Bounty Factory | Events | Press