Categories
YesWeHack News

YesWeHack is now member of FNTC’s business incubator

YesWeHack is now an official member of FNTC (The Federation of the Digital Trusted Third Parties) ‘s business incubator.

We, YesWeHack, were used to mentioning during our conferences the real need for building trust for our Bug bounty platform namely YesWeHack and this membership is a milestone for our company.

The FNTC Board met in December to validate our application to its business incubator.

Thanks to the FNTC Board for having accepted us in its business incubator.

Categories
Vulnerability Coordination

ZeroDisclo.com : IT Security Researchers finally Protected

In constant contact with its community of security researchers, YesWeHack has noted that it is complex for a security researcher and therefore, for a whistle-blower to report security flaws -in a  coordinated way – to impacted organizations. Especially if those organizations do not have a Bug Bounty program registered on YesWeHack.com!

Vulnerability discoverers often experience difficulties on how to report them to the organizations concerned without disclosing them to a third party and unfortunately direct contact with companies constitutes a legal risk.

A long-time partner of the security research community through its founders, YesWeHack launches ZeroDisclo.com.

This platform provides the technical means and the required environment for all to adopt the coordinated reporting of vulnerabilities commonly known as “Coordinated Vulnerability Disclosure“.

Categories
Customers Stories

Edouard Camoin, CISO of Outscale.com, on the bug bounty switching process from private to public status

Edouard Camoin, CISO of Outscale.

– What’s your role as CISO within Outscale?

First of all, Outscale deals with IaaS : like AWS we provide API and we have Branch offices in France, USA and China. Each Branch office is subject to a specific digital sovereignty.

I’ve been wearing two hats : Guarantor of the internal security and guarantor of the security for the customers.
Globally speaking the human resources are at the core of my job.

– What was the need assessment that led to the opening of a bug bounty program?

Categories
Customers Stories

Xavier Leune, CCM Benchmark Group, on the benefits of bug bounty

Xavier Leune – CCM Benchmarck group –

What is your role in CCM benchmark ?
I am deputy CTO and i’m in charge of technical monitoring with Damien Mangin, CTO of CCM Benchmark Group.

What were the reflexion and the needs assesment that brought about a bug bounty program ?
Like any other actor on the Internet, we are experiencing increasing threats like hacking tries or malware targeting our platforms. As we are the first French leaders media company (according to Comscore), we are particularly exposed to cyber threats. Therefore, we are meant to have a proactive approach in terms of security in order to protect our users’ data.
The bug bounty Program we opened was a very important step complementary of others methods we set up (pentests, trainings). In terms of security by design, this exercise is really useful for our devs because thanks to the bug reporting they can improve the degree of security of their own code.

Categories
Hunters Stories

Portrait of a bug hunter : Ylujion

YesWeHack is glad to introduce you to its best hunters performing on YesWeHack.com

This week, it’s @Ylujion‘s turn, Check his portrait below !

Categories
Events YesWeHack News

YesWeHack winner of the Jury’s Favorite Prize #FIC2017

YesWeHack Team is honored to have received the #FIC2017 Jury’s Favorite Prize

This Jury’s Favorite Prize proves that our products meet the challenges of today: the hiring of talents and the need for agile security. This award will allow us to strengthen our leadership in France and above all to boost us to conquer the Euro zone, that is our priority for 2017 !

Guillaume Vassault-Houlière, Yeswehack CEO

brad_pit

Congratulations to the winners :

  • Prove & Run
  • GateWatcher 

We do thank all members of the Jury

  • François Lavaste, Président CyberSecurity, Airbus Defence and Space
  • Alain Bouillé, RSSI, Caisse des Dépôts et Président du CESIN (Club des experts de la sécurité de l’information et du numérique)
  • Gilles Daguet, General Partner, ACE Management
  • Thierry Delville, Inspecteur général de la Police nationale, Délégation ministérielle aux industries de sécurité
  • Laurent Dumas Crouzillac, Associé, CapHorn Invest
  • Thomas Fillaud, Chef de bureau, Politique industrielle et Assistance (PSS), ANSSI
  • Philippe Gaillard, Associé, CyberD Capital
  • Joseph Graceffa, R&D-SSI, CLUSIR Nord de France
  • Jacques Hébrard, Commandant, Région gendarmerie Hauts de France
  • Geoffroy Hermann, Chef du bureau Réseaux & Sécurité, DGE
  • Jacques-Benoît Le Bris, DSI, Solvay
  • Olivier Ligneul, RSSI, Groupe EDF
  • Thierry Olivier, RSSI, Société Générale
  • Frédéric Valette, Responsable du pôle SSI, Direction générale de l’armement, Ministère de la Défense
  • Yves Veret, Senior Advisor Sécurité Numérique & Technologie de l’information CALAO Finance

***

For those who do not know the FIC aka International Cybersecurity Forum (Hosted in Lille – France)

The International Cybersecurity Forum is a platform aiming at promoting a pan-european vision of cybersecurity as well as to strengthen the fight against cybercrime.

In order to do so, the FIC relies on :

• The trade show, to share knowledge and ideas, recruit new employees and maintain contacts
• The forum, to discuss and debate with experts, to gather ideas and to share professional lessons
• The Observatory, to continue exchanging views and information after the FIC, to explore topics in greater depth and to consolidate our network of experts and like minded throughout the year

***

See you soon #FIC2017 !

 

Categories
Best Practices New Features

YesWeHack : What about the legal features ?

YesWeHack.com – the first European Bug Bounty platform – was launched in early 2016.

Unlike some other platforms, YesWeHack.com presents some specific and legal features that are designed to strengthen its relevance, security and legitimacy.

Above all, Bountyfactory.io focuses on security and legal framework :

Our Servers are based in Europe. Therefore, No data exposure to the US services via FISA, Patriot Act, Freedom Act.

Categories
Best Practices

The Internet of Elevators, of Cars, of Weapons !

lift

Have you ever watched The Lift ? A Dutch horror movie by director Dick Maas about an intelligent ( or smart ?) and murderous elevator starting a killing spree. (Source : wikipedia)

Scary, isn’t it ?

Beyond fiction, the film “The Lift” aimed at questioning technology, systems you can not regain control over.

Nowadays, we are told about the benefits of design thinking, internet of things and their tremendous power in terms of digital and economic development… Oh wait.

Unfortunately, the Internet of Things is driven by marketing ravenous hyenas and very few IoT companies are inspired by – what we could call – the Security Design Thinking.

nebula_of-things

Today, within the Internet of Things, Auto Industry has to struggle to prevent itself from being hacked both by criminals and by their inner blind appetite for market at the expense of their duty in the field of security.

Imagine the antithesis of the legendary film “Rebel without a cause” where the hero no longer rides a car as a symbol of freedom but he’s the prisoner of a runaway wagon.

The revelations concerning the recent fraud on the behalf of  Volkswagen – by the way VW is not an isolated case – highlighted what is at stake in terms of security in the fabulous world of the Internet of Cars.

Before reaching the point of no return, Cars companies and end users should deeply consider the following thoughts :

Categories
Events

YesWeHack Team will attend “les Assises de la sécurité”

From 5 to 8 October 2016, join us for the 16th edition of Les Assises.

“Les Assises de la sécurité” is a key annual event for any professional who is keen on Information Systems Security.

Les Assises will gather more than 2000 people in Monaco to discuss what is at stake in terms of IT security.

YesWeHack Team will be represented by Manuel Dorne aKa Korben & Guillaume VASSAULT-HOULIÈRE aKa Freeman. On October 5 at 5 pm, Guillaume will participate in a round table “Are the search for security breaches and the collaborative economy compatible ?”

YesWeHack Team has a strong experience within Hackers’ communities and the way they deal with legal and accountable disclosure of vulnerabilities.

 

Categories
Hunters Stories

Goals and means of a bug bounty hunter.

These days, Bug bounty Hunters are trending within the IT security ecosystem, but very few articles deal with the DNA of a Bug Bounty Hunter.

At YesWeHack.com, we consider Bug Hunters have to respect and fit legal frameworks and norms.

AS a bug hunter please find below the goals you should be driven by :