staging-devopsy.kinsta.cloud

Tag: Bugcrowd

  • Bugcrowd Disrupts the Multi-Billion Dollar Pen Test Market With Its Next Gen Pen Test Solution

    Bugcrowd’s global Crowd of experienced pen testers and whitehat hackers help customers find 7x more critical vulnerabilities than traditional pen tests

    SAN FRANCISCO – November 14, 2018 – Bugcrowd, the #1 crowdsourced security platform, today announced Bugcrowd Next Gen Pen Test, a new product with unique platform capabilities to meet organizations’ evolving security needs as attack surfaces grow at an accelerated pace. Bugcrowd helps  organizations around the world level the cybersecurity playing field by cost effectively harnessing the creativity of a global Crowd of trusted pen testers and whitehat hackers to identify vulnerabilities before adversaries – something you can’t get through traditional security testing alone.

    Organizations spend  millions of dollars  a year today on compulsory  pen tests with minimal results and ROI. The  traditional pen test model incentivizes pen test providers to apply limited resources resources,  with limited depth of skills, on a limited schedule. According to a recent survey, nearly 60% of security leaders are highly dissatisfied with current penetration test efforts, with more than 70% reporting they do not believe their current penetration testing methodology uncovers high priority security vulnerabilities. In fact, according to Gartner’s June 2018 Emerging Technology Analysis: Bug Bounties and Crowdsourced Security Testing, pen testing “adds limited value in improving application security, and is out of step with DevSecOps-based approaches that rapidly iterate on applications.”

    Bugcrowd Next Gen Pen Test is the only scalable model for sidestepping the operational handcuffs of traditional testing approaches. By leveraging a global Crowd of thousands of uniquely skilled and trusted pen testers, companies are able to rapidly build and incentivize the perfect team for every engagement – providing continuous testing, with less overhead, in less time, and with more predictable results. Bugcrowd Next Gen Pen Test goes a step above traditional pen testing to provide coverage assurance, comprehensive methodology and reporting, and deep integration into the software development lifecycle. Bugcrowd customers find more critical vulnerabilities with Next Gen Pen Test than traditional pen tests, dramatically improving their security posture.

    “Planning a traditional penetration test is a painful process. There are a lot of hoops to jump through, not to mention, scoping is difficult and the methodology is strict,” said Richard Rushing, CISO, Motorola Mobility. “Bugcrowd Next Gen Pen Test leverages the crowdsourced security model to bring me 10x the security coverage needed for today’s application and the cost savings. You can’t beat it.”

    “As I speak to CSOs around the world, they’re looking for better ways to protect their organizations than the traditional pen testing approaches that have not changed in more than 20 years – and have in fact failed to reduce overall security risk,” said Ashish Gupta, CEO, Bugcrowd. “The solution can only be addressed by a radical shift in pen test design, which lends itself exceptionally well to the crowdsourced security model. Bugcrowd Next Gen Pen Test brings together the needed variety of experience and technical specialization on an ongoing basis to handle the complexity of constantly changing attack surfaces companies will face in the coming years.”

    Bugcrowd Next Gen Pen Test combines the continuity of 24/7/365 testing and the methodology and reporting needed to meet compliance and audit requirements. Included in Bugcrowd Next Gen Pen Test are unique platform capabilities, including:

    • CrowdMatch™: Unparalleled knowledge of the behaviors, performance, and skills of a crowd of thousands of uniquely skilled pen testers to rapidly and dynamically build the perfect team for every engagement.
    • BugHunter Methodology™: Proven approach to pen testing that brings together leading industry testing standards, such as OWASP Top 10, PCI, NIST, and others, with incremental tests from a hacker mindset to drive risk reduction and compliance.
    • ResearcherDirect™: Direct researcher engagement and oversight to foster relationships and knowledge through a secure portal not available via traditional pen testing.
    • Vulnerability Rating Taxonomy (VRT): A community-driven, open source guide provides quick ID of high priority vulnerabilities, reducing overhead.

    To learn more about Bugcrowd Next Gen Pen Test, tune in to the upcoming webinar on Thursday, November 15, 2019 featuring Bugcrowd CSO, David Baker, and Vice President of Researcher Growth, Jason Haddix.

    About Bugcrowd

    Bugcrowd is the #1 crowdsourced security platform. More enterprise organizations trust Bugcrowd to manage their bug bounty, vulnerability disclosure, and next gen pen test programs. By combining the largest, most experienced triage team with the most trusted whitehat hackers around the world, Bugcrowd generates better results, reduces risk through remediation advice, and empowers organizations to release secure products to market faster — with no hidden fees. Based in San Francisco, Bugcrowd is backed by Blackbird Ventures, Costanoa Ventures, Industry Ventures, Paladin Capital Group, Rally Ventures, Salesforce Ventures and Triangle Peak Partners. Bugcrowd. Outhack Them AllTM. Learn more at www.bugcrowd.com.

     

     

  • The DevOps Force Multiplier: Competitive Advantage + Security

    The DevOps Force Multiplier: Competitive Advantage + Security

    Several years ago, DevOps started hitting the eyes of enterprise business leaders when news outlets such as The Wall Street Journal and Forbes began reporting that the IT culture and methodology was helping adopters to gain a competitive advantage. Since then, we’ve seen story after story about how DevOps-focused employees are becoming the driving force behind the software and applications the world relies on for everything from mobile banking transactions to ride-hailing to gaming. Even the Pokemon company can’t get enough DevOps engineers.

    It looks as if DevOps soon may be recognized as more than just a force for fast and agile software development and deployment. Evidence is emerging that it also may be having a positive impact on security.

    Security Researcher Sees Trend

    Screen Shot 2016-07-21 at 9.03.00 AM
    Bugcrowd Security Researcher OJ Reeves

    Bugcrowd Researcher OJ Reeves sees his fair share of weak security. As a full-time white-hat penetration tester and researcher running attack simulations for enterprises that want to improve their defenses, he’s seen everything from unpatched vulnerabilities in software to the perilous journeys overshared credentials take as they’re passed between multiple administrators across various communications channels.

    Recently, Reeves noticed that in our facepalm-ridden world of security blunders, organizations with a DevOps focus seem to have better security.

    “DevOps is young and still being defined differently across organizations,” said Reeves. “I have noticed recently that when I engage with businesses that employ DevOps-focused people, a security mindset often accompanies.”

    The reasons behind why DevOps is assisting with creating more secure environments are wide and varied, Reeves cited several.

    DevOps Checks Boxes — All of Them

    “Check box security” can be a bit of a dirty-word term when it comes to protecting systems and data, as it frequently refers to compliance—something many cybersecurity and risk professionals consider to be the bare minimum when it comes to protecting data and systems. At the intersection of DevOps and security, it actually can mean something very different, Reeves said.

    “Organizations that actually have DevOps people in place tend to do a better job checking all boxes and making sure security is in place,” he said. “When you have a DevOps person who is doing the job properly, they (organizations) have a much better chance of defending themselves.”

    DevOps Makes Fewer Mistakes

    One company Reeves attacked had developers, operations and infrastructure employees in place but no DevOps-focused team members. He noticed right away that there was no clear definition of who was responsible for security or who was in charge of protecting application life cycles.

    “There were credentials everywhere—all spread out and all mismanaged in different ways,” he noted. “You don’t want anyone with malicious intent, who can compromise a developer’s’ desktop, to get access to credentials.”

    When running simulations for organizations with DevOps employees in place, he’s observed that those kinds of mistakes happen less frequently.

    “More often than not I’ve found that the credential management process is much better when DevOps people were present. When there is a person in charge, who is also conscious of how others are using credentials, a credential security champion tends to emerge,” he said.

    DevOps Communicates

    Reeves, like many other practitioners I’ve spoken with, emphasized that communication between IT members is critical to effective defense. That’s something he said DevOps-focused organizations seem to be especially good at doing.

    When privy to conversations taking place between developer, security and DevOps employees, Reeves has noticed that everyone involved is interested in improving processes all around—processes which include security.

    “Direct human interaction that takes place between those who are responsible for defense tends to result in improved security,” he added. “Just the fact that awareness for these [security] issues is being raised and discussions are taking place is having a positive impact.”

    Reeves indicated the discussions taking place within DevOps environments he’s observed are focused on the right things.

    “These human-to-human interactions make things more secure and they pay attention to organizational security, where we should be having our discussions,” he noted. “Let’s not talk about the latest AV (anti-virus), etc.; security is an organizational process and problem. The best security in the world doesn’t matter if employees in the organization aren’t aware of what’s taking place.”

    DevOps: Harder to Crack

    At the end of the day, companies such as Bugcrowd and pen testers such as Reeves are paid to find exploitable gaps in systems so they can be closed before the nefarious can take advantage of them. While DevOps isn’t typically thought of as a security enabler, organizations that don’t have dedicated DevOps employees may want to consider Reeves’ parting words: “When organizations I am researching have a DevOps focus, it is generally more difficult for me to compromise them.”