From DevSecOops to Security Success: The Bug Bounty Effect at FINN.no

on YouTube ↗37m

" summary

Since 2019 FINN.no runs a private bug bounty that outfinds static and dynamic scanners: CodeQL finds some issues but the bounty yields far more exploitable bugs, first year delivering 24 valid reports for ~$15k and total payouts ≈$200k over five years, median $200–$400, max $6,000. Automated tools (Detectify, dependency checks) flood with false positives; bounties cut average exposure from ~800 days to weeks/months. Concrete wins include a Spring Boot actuator HTTP Trace critical fixed on a Saturday, regex bypasses discovered after report disclosure, and a dependency‑confusion case that prompted an internal mitigation and tooling. Platform musts: SSO, good API, report disclosure.

AI-written summary · about

" chapters (30)

1. 0:00Introduction to the talk and speaker
2. 1:15What is FINN.no and its tech landscape
3. 2:36The DevSecOps challenge and false positives
4. 4:03Vulnerability sources and verified findings
5. 5:06Limitations of traditional pentesting
6. 6:08The vulnerability exposure problem at FINN
7. 7:10What is a bug bounty program and how it works
8. 8:54Bug bounty payouts and business impact
9. 10:19Attracting hackers with a respectful program
10. 11:26Fast response times and hacker motivation
11. 12:52A critical fix on a Saturday night
12. 14:16Bug bounty program results and costs
13. 15:41Report quality and scaling the program
14. 17:06Handling denial of funds attacks and spam
15. 18:49Funny and low-quality bug reports
16. 19:32Impact of bug bounties on vulnerability lifecycle
17. 20:37Focus on fixing your own code over dependencies
18. 21:40Secure defaults and their role in security
19. 22:41Using bug bounty data for training and CTFs
20. 23:44Why combine bug bounties with other tools
21. 24:50Bug bounties vs code scanning comparison
22. 25:55Spicy advice: Launch a private bug bounty program
23. 26:58Security.txt vs bug bounties for Norwegian companies
24. 27:59How to launch a bug bounty program step-by-step
25. 29:25Platform must-haves for bug bounty programs
26. 31:09Report disclosure and its security benefits
27. 32:36Regex bypasses and lessons learned
28. 33:40Dependency confusion attack and mitigation
29. 35:02The importance of tooling and automation
30. 35:45Summary of the bug bounty effect at FINN.no

" related talks

• 40mDon't Let Bug Bounty Kill Your Appsec PostureZohar Shchar · Global AppSec Dublin 2023
• 43mHard Knock Lessons On Bug BountiesJonathan Cran · OWASP AppSec Research (AppSecEU) 2015
• 46mHow to run a successful bug bounty programmeShadab Siddiqui · Rootconf 2019
• 56mRunning a Bug Bounty Program @ SEEKJulian Berton · NDC Sydney 2017
• 45m2014.10.29 - Security@Scale - Katie Moussoris, HackerOneKatie Moussoris · Security @Scale 2014
• 50mTo bounty, or not to bounty? Security@ insights from 500 organizationsAlex Rice · OWASP AppSec California 2016
• 55mYour License for Bug Hunting SeasonCasey Ellis, Jim Denaro · AppSecUSA 2016
• 30mBeyond Quick Cash: Rethinking Bug Bounties for...Farah Hawa, Jayson Grace · BSidesSF 2024