Bounties and the SDLC
summary
A case study shows a 30-day IE11 beta bounty that produces 23 submissions 18 bulletin-class 4 sandbox-escapes and leads engineers to change testing and ship earlier fixes, a program that pays a total of about $28,000 with average awards near $1,100. A separate $100,000 mitigation-bypass prize is offered (two $100k checks issued) and an invitation-only model is used to align researchers with the SDL and validate whether the incentives actually move attacker markets.
AI-written summary · about
chapters (22)
- 0:00Intro
- 2:42Katies background
- 7:14Organizational empathy
- 7:45Bug bounties
- 8:38Bounties vs penetration testing
- 10:03Vulnerability response
- 14:56Beautiful
- 16:06Goals
- 18:32Three Bounties
- 19:43Bug Reporting Trends
- 25:16Giant Check
- 26:08Total Price
- 28:03Market Timing
- 36:13Wrap Up
- 38:47Getting Started
- 39:39Application Security Program
- 40:26Initial Spike
- 42:11Trends
- 43:22Goals and Ways
- 45:23Where does vulnerability information feed back
- 45:58CFAA
- 50:31QA
related talks
45m2014.10.29 - Security@Scale - Katie Moussoris, HackerOne
50mTo bounty, or not to bounty? Security@ insights from 500 organizations
20mGetting to $10,000 – the variables at play in determining bounty awards
30mBeyond Quick Cash: Rethinking Bug Bounties for...
45mThe Good, the Bad, and the Bounty: 10 Years of Buying Bugs at Microsoft
43mHard Knock Lessons On Bug Bounties
56mRunning a Bug Bounty Program @ SEEK
07mLessons learned from running big bug bounty programs