Hi [[ session.user.profile.firstName ]]

Internal Bug Hunts: Squashing Security Bugs on a Budget

Far too often, testing software for security flaws falls into the “nice-to-have” category, taking a backseat to the demands of the marketplace and inflexible feature release schedules. In addition to the expense of hiring an outside security testing team, testing for and fixing obscure security bugs is a brake on an engineer’s ability to put new code in the hands of their customers. Fortunately, there is a workaround to this dilemma that will allow you to promote application security awareness while helping to reduce security bugs in your applications.

An internal bug hunt contest - in which your employees compete for prizes by finding and reporting security bugs - enables you to harness the creativity and problem-solving skills of your workforce while reducing security bugs in your applications. It can also help promote a culture of security awareness - without a large security testing budget.

An internal bug hunt contest can you help you:

• Find and remediate vulnerabilities before external entities can exploit them
• Provide a safe platform for your application owners to test for security bugs
• Promote application security awareness
• Engage employees outside of the central security team who want to explore the security domain

In this webcast, you will learn how an internal bug bounty program can help you find security flaws in your applications before criminals or spies, while improving the security culture at your company.
Recorded Sep 19 2017 47 mins
Your place is confirmed,
we'll send you email reminders
Presented by
Pieter Ockers - Sr Program Manager at Adobe
Presentation preview: Internal Bug Hunts: Squashing Security Bugs on a Budget

Network with like-minded attendees

  • [[ session.user.profile.displayName ]]
    Add a photo
    • [[ session.user.profile.displayName ]]
    • [[ session.user.profile.jobTitle ]]
    • [[ session.user.profile.companyName ]]
    • [[ userProfileTemplateHelper.getLocation(session.user.profile) ]]
  • [[ card.displayName ]]
    • [[ card.displayName ]]
    • [[ card.jobTitle ]]
    • [[ card.companyName ]]
    • [[ userProfileTemplateHelper.getLocation(card) ]]
  • Channel
  • Channel profile
  • Gaining Decrypted Visibility in Public Cloud with Amazon VPC Traffic Mirroring Aug 22 2019 5:00 pm UTC 60 mins
    Steve Perkins, Chief Product Officer & Erik Freeland, Director of Customer Engineering, Nubeva
    Encryption of all traffic in the cloud is a widely adopted best practice. The new TLS 1.3 standard with Elliptic-Curve Diffie Helman (ECDH), perfect forward secrecy and ephemeral keys renders most traditional decryption methods ineffective and out-of-band decryption essentially impossible. Combined with the distributed and elastic nature of cloud computer architectures and the use of third party services, enterprises have been forced to choose between security and visibility or between security and modern architectures.


    Join us for a “How To” webinar covering the newest possibilities for decryption in the public cloud. During the session, Steve Perkins, Chief Product Officer and Erik Freeland, Director of Customer Success at Nubeva, will discuss the complications and opportunities surrounding the new TLS 1.3 protocols. They will walk through how organizations can implement encryption best practices and also gain full decrypted traffic visibility for intrusion detection, threat hunting, incident response and beyond with the newly announced Amazon VPC traffic mirroring and industry-leading open source monitoring tools.
  • Best Practices for Securely Moving Workloads Into the Cloud Aug 8 2019 4:00 pm UTC 60 mins
    Torsten George, Senior Director, Product Marketing, Centrify
    Organizations are increasingly moving their workloads to the cloud to achieve greater agility, flexibility, and cost savings. In fact, spending on cloud infrastructure services will grow from $39.5 billion in 2019 to $63 billion through 2021 [according to Gartner].

    However, when transitioning to the cloud, it’s critical to understand that cloud security is a shared responsibility between the cloud service provider and the customer. The cloud service provider typically secures the core infrastructure and services while securing operating systems, platforms, and data remains the responsibility of the customer.

    As your organization formulates a cloud security strategy, it is important to remember that the #1 cause of today’s breaches is privileged access abuse. And it takes just one single compromised privileged credential to impact millions of data records and result in millions of dollars in fines.

    To limit their exposure to these attacks, organizations need to move to an identity-centric approach based on a Zero Trust model: “never trust, always verify, enforce least privilege”. This concept should be extended to the organization’s workforce, as well as partners, privileged IT admins, and outsourced IT.

    Our webinar, Best Practices for Securely Moving Workloads to the Cloud:
    - Reviews the state of cloud computing;
    - Details the key threats for cloud environments;
    - Identifies 6 best practices for boosting cloud security confidence in a world of Zero Trust;
    - Showcases how to apply these best practices to critical privileged cloud access use cases;
    - Shares a customer success story; and
    - Outlines the benefits of Zero Trust Privilege.
  • 2019 Cloud Security Threat Report: Understand the Latest Cloud Security Trends Jul 25 2019 5:00 pm UTC 60 mins
    Jim Reavis, Co-Founder and CEO, Cloud Security Alliance | Kevin Haley, Director, Security Technology and Response, Symantec
    Is your perception of cloud security matching the reality?

    We surveyed security decision makers worldwide to understand their perceptions of the cloud security landscape and compared this to empirical data sources monitored by Symantec.

    Join Cloud security experts, Jim Reavis, Co-Founder & CEO at Cloud Security Alliance, and Kevin Haley, Director Security Technology and Response at Symantec as they discuss:

    • Key findings from the 2019 Cloud Security Threat Report

    • Real world examples of security threats and whether the perception of cloud security matched up to the evolving cloud threat.

    • Emerging trends in cloud security that can help you respond to the evolving attack surface.

    Register Today
  • IT & OT Security Best Practices-Survey Results of Over 700 Global Practitioners Jul 24 2019 3:00 am UTC 60 mins
    Robert Healey | Senior Director Marketing, Asia Pacific, Tenable
    Security teams are frequently blind to the IT and Operational Technology (OT) assets, internal and external connections, and vulnerabilities on their industrial control system networks. This visibility gap is one of the key challenges highlighted in a new survey report from the Ponemon Institute.

    To learn more about the report and how its findings compare with your organization’s experience, please join Robert Healey, APAC Marketing Director, Tenable, for the webinar: “Cybersecurity in Operational Technology: 7 Insights You Need to Know.”

    All infosec professionals responsible for and interested in effectively securing converged IT/OT environments are encouraged to join this webinar.
  • Hacker-Powered Data: Security Weaknesses and Embracing Risk with HackerOne Jul 23 2019 5:00 pm UTC 60 mins
    Miju Han, Director of Product Management, HackerOne
    Vulnerabilities are a fact of life; risk comes with it. Today, companies, enterprises, & governments are embracing collaboration with hackers to find vulnerabilities before criminals have a chance to exploit them. Using 6 years of data from 1,300+ bug bounty programs & 100,000+ valid vulnerabilities, this talk offers new analysis of the most common vulnerabilities not found on the OWASP top 10.
  • Automating Container Security with AWS and Lacework Jul 18 2019 5:00 pm UTC 60 mins
    Thomas Robinson, Solution Architect, AWS & Dan Hubbard, CEO, Lacework
    Using containers in AWS enables agile orchestration of application capabilities and require less coordination and oversight than on-premises or virtualization infrastructure. While containers allow you to build and release fast, security teams need to assess how they maintain security for these new capabilities.

    In this session, experts from AWS and Lacework will explain how to use Amazon Container Services to easily deliver applications, and how to automate container security so you can enable your DevOps team to build fast while remaining secure.
  • Using User Behavior Analytics to Detect Authentication Anomalies Jul 16 2019 3:00 am UTC 60 mins
    Aron Anderson, Senior Security Engineer & Ashwini Cheerla, Security Engineer at Adobe
    In modern cyber battlefield, we face new threats daily where signatures are not necessarily known. Identifying these anomalies in regular behavior is the core of User Behavior Analysis (UBA). Common UBA applications include detection of malicious insider threats, privilege misuse, and compromised accounts. Analytics tools help make sense of varied information provided by security systems to identify potential risks. At Adobe, we generate vast amounts of security data in form of application, system and other logs. In addition, we have environment context data like employee role details and configuration management database (CMDB) data. This security data is an immense source of security intelligence. If collected diligently, the answers are already present, but the trick is to ask the right questions. This information can be compared against a security standard to find security gaps that need to be remediated, which is reactive security. However, if we use machine learning techniques and other analytics tools to ask the right questions, we can proactively identify anomalous activities.

    All of this is part of our broader strategy around Project ZEN – our zero-trust enterprise network initiative first introduced to the ISACA audience at CSX 2018. This talk will dive into more specifics about how ZEN works – specifically around UBA. We leverage UBA to help meet the most recent NIST guidelines around user passwords and remove the need for password changes at regular intervals. We will provide summit attendees with a blueprint they can use for a significant part of their own zero-trust network efforts. We hope that you can learn best practices from our approach that you can leverage in implementing more effective UBA at your organization.
  • Accelerating Your Journey to Zero Trust Recorded: Jul 11 2019 38 mins
    Christopher Scheels, Director of Product Marketing, Cyxtera
    Zero Trust is trending. Every expo show floor is inundated with this concept that promises to transform of corporate security from a well-known failed perimeter-centric model. In this session, we will discuss what is Zero Trust, why are enterprises adopting it to fix some of security’s biggest challenges and how to get started.
  • Does WebAuthn Signal the End of Passwords for Browsers? Recorded: Jun 27 2019 48 mins
    Pay-al Pan, Senior Solutions Engineer, Okta & James Fang, Director of Product Marketing, Okta
    Passwords have been the de-facto standard for authentication in the last 40 years, but end users hate them. Not to mention they aren't considered safe anymore - 81% of hacking-related account breaches leveraged weak or stolen passwords. While password + 2FA is a recommended approach by NIST, 2FA may still be hackable.

    WebAuthn promises a safer, phishing-resistant protocol and easier authentication standard for web applications. But can it live up to it's hype? Join this session to learn about WebAuthn and understand how you can build strong auth with WebAuthn into your applications.
  • The Nexus of Organized Cyber Crime and Cyber Terrorism Recorded: Jun 26 2019 62 mins
    Dr. Florian Huber, Research Manager at SYNYO & Mag. Bernhard Jäger, Research Manager and Department Lead at SYNYO
    New Services and Tools for Supporting First-line-practitioners and Law Enforcement Agencies.

    In recent years, Europe has been at increased risk of extremist violence and terrorism – from Islamic fundamentalists, far-right fascist hate groups and others, fueled by online radicalization and encrypted communication networks. At the same time, national and international law enforcement agencies are battling growing networks of organized criminals that are increasingly taking their activities online, using the notorious underground ‘dark web’ to commit illegal acts.

    Faced with these threats, the EU-funded TAKEDOWN project (https://www.takedownproject.eu) is developing tools to understand why people turn to terrorism or organized crime, and what can be done to combat the problem. Due to the increasing relevance of the cyber-domain, the project also addressed the issues of (cyber)terrorism and organized (cyber)crime and put a particular focus on the nexus or the hybrids of organized crime and terrorism. 
     
    The webinar, presented by the coordinator of the H2020-project TAKEDOWN, will address…
    - The outcomes of the research conducted in the project. Focusing on the main conclusions related to the nexus and the hybrids.
    - The main practical outcomes of the project the two web platforms, www.firstlinepractitioners.com (for practitioners) and www.fightcrimeterrorism.com (law enforcement agencies and solution providers)
  • 2019 Trends Report: The Zero Trust Journey Recorded: Jun 20 2019 28 mins
    Kelsey Nelson, Product Marketing, Okta
    As your workforce becomes more distributed, security is even more critical. Protecting the network is important but it’s no longer enough to secure applications and data. That’s why adoption of a Zero Trust security framework is on the rise.

    Interested in more data on how your peers are adopting Zero Trust to protect their apps, data and distributed workforce? Join our webinar where we’ll discuss:
    - The full Zero Trust architecture and the steps to get there
    - Where organizations struggle in reaching Zero Trust and how to overcome barriers
    - Your peer’s top priorities for next year
  • 5 Steps to Protecting Your Data in Today's Cloud- and Mobile-First World Recorded: Jun 13 2019 54 mins
    Bob Gilbert, Chief Evangelist and VP Product Marketing, Netskope
    The rapid adoption of cloud and mobile in the enterprise is powering the transformation of legacy IT systems to more modern technology and processes. The business benefits of speed and agility for the enterprise can’t be denied, but the challenge is that security is often not considered a part of this digital transformation. The result is new blind spots are introduced in this cloud- and mobile-first world and legacy security tools are ineffective when it comes to protecting your data.

    In this session, we will discuss the new blind spots that exist in today's cloud- and mobile-first world and 5 steps you can take to help ensure that your data is protected.

    Join this session to learn:

    - About new blind spots that exist in today’s cloud- and mobile-first world
    - Why legacy security tools are ineffective
    - 5 steps to covering these new blind spots
  • Securing Cloud Infrastructure with Cyber Exposure Recorded: Jun 6 2019 61 mins
    Nate Dyer, Product Marketing Director, Tenable
    Cloud is dramatically expanding your attack surface and introducing new visibility challenges into infrastructure security. Without foundational visibility, it’s nearly impossible to execute other cloud security programs supporting compliance, policy enforcement, and vulnerability remediation. Cyber Exposure is a cybersecurity discipline to provide visibility into traditional IT and cloud infrastructure to help you manage and measure cyber risk. Cyber Exposure allows you answer three fundamental questions in your cloud environment:
    - Where are we exposed?
    - What should we focus on first?
    - How are we reducing exposure over time?

    Join us as we demystify Cyber Exposure, show how it can help you secure cloud infrastructure, and provide best practices to help you get started on your Cyber Exposure journey.
  • CSA Study: Cloud Security Complexity Recorded: Jun 4 2019 52 mins
    Yitzy Tannenbaum, Product Marketing Manager at AlgoSec
    Cloud computing provides improved security, agility and flexibility. However, integrating this new service into legacy IT environments comes with great concern.

    The Cloud Security Alliance has recently surveyed over 700 IT and network security professionals from around the globe on security challenges in cloud environments. In this research, security, data loss and compliance were identified as the top 3 concerns when moving to the cloud. In the face of increasingly complex environments, cloud visibility and expertise are essential to ensuring a manageable, secure and fluent transition to a native cloud, hybrid or multi-cloud environment.

    In this webinar Yitzy Tannenbaum, Product Marketing Manager at AlgoSec will review and analyze the findings from the new CSA report “Cloud Security Complexity: Challenges in Managing Security in Native Hybrid and Multi-Cloud Environments”, including:

    • Types of cloud platforms being used by companies
    • Common challenges faced by companies when moving workloads to the cloud
    • The many stakeholder involved in cloud security
    • Methods of managing risk and vulnerabilities in the cloud environment
    • Causes of network or application outages and the amount of time it took to remediate
  • Embracing the Kanyes: Fostering a Security Culture that Accepts Human Error Recorded: May 30 2019 44 mins
    Aaron Zander, Head of IT, HackerOne & Gen Buckley, Senior Analyst, Security, and Compliance, Okta
    It's easy blame employees for poor password and email hygiene, but in reality, human error isn't going to go away. Every organization will always have a "Kanye" with poor operational security and weak passwords. IT and Security teams have to acknowledge the “desire paths” across the security landscape, and ensure that we not only keep up, but facilitate ease of access while maintaining our security perimeter.

    There’s no guarantee on the tech savvy nature or level of care an employee will bring to the table, so we need to move the table closer to them and provide a safe harbor where mistakes are allowed to occur. In this session Aaron Zander, Head of IT for HackerOne, and Gen Buckley, Senior Analyst for Security and Compliance at Okta, will discuss the various ways to enable a security culture without crippling your coworkers.
  • GDPR: Data breach prevention & mitigation - Lessons learned in the past year Recorded: May 28 2019 61 mins
    Istvan Lám, CEO, Tresorit & Daniele Catteddu, CTO, Cloud Security Alliance
    Organizations in and outside the EU had to take significant measures to revisit the way they stored, shared and processed personal data in preparation to the entry into force of the General Data Protection Regulation (GDPR) on 25 May last year. However, compliance with the GDPR is not a tick box activity, it requires continuous evaluation of data flows in and outside the company.

    This webinar brings together Daniele Catteddu, Chief Technology Officer of the Cloud Security Alliance (CSA) and Istvan Lám, CEO of Cloud encryption company, Tresorit to discuss the key learnings since the GDPR entered into force with focus on data breach prevention and mitigation.

    The speakers will reflect, in particular, on the following aspects:
    - Key learnings from data breach notifications & fines imposed so far
    - Best practices for breach detection and reporting
    - Challenges regarding the assessment of the severity of personal data breaches
    - The most common types of data breaches and how to mitigate their impact
    - Assessment of real-case data breaches, determination of what went wrong, and discussion on the implications for compliance with the GDPR going forward
  • Scaling Cloud Forensics & Incident Response with OSQuery Recorded: May 23 2019 50 mins
    Sohini Mukherjee, Security Analyst & Andres Martinson, Sr. Security Engineer, Adobe
    An enterprise has a diverse environment (cloud instances, servers, workstations) in which to try and detect potential security incidents. The ability of an incident response team to work quickly and at necessary scale is imperative when incidents do unfortunately occur. After an initial compromise, attackers often move laterally in an environment, trying to establish a foothold and escalate privileges. While they try to remain stealthy, they almost always leave behind footprints. Detecting and analyzing these footprints quickly and accurately to scope the issue is critical.

    This webcast will explore a scalable approach developed by the Adobe security team that relies on open source tools like OSQuery. The goal was to develop techniques that can be leveraged to more quickly and easily investigate large groups infrastructure components for initial triage, basic forensic analysis, and to also help proactively detect threats. Attendees will learn about the techniques we developed that they can then go apply to their own environments to help with their incident response efforts in the cloud.
  • Eliminate Vulnerability Overload – take Nessus Scan data to the next level Recorded: May 21 2019 60 mins
    Robert Healey | Senior Director Marketing, Asia Pacific
    Nessus has been around for 21 years now and with over 109,000 vulnerabilities in its scan database, is the undisputed global standard tool for Vulnerability Management, that everyone uses, knows and loves. Nessus is a great tool but unfortunately in any medium or large organization, with Nessus alone, you will soon be buried in a mountain of unprioritised vulnerability data. Join this webinar to see how Predictive Prioritization from Tenable combines asset, vulnerability and threat intelligence data to enable you to reduce the number of vulns you need to address by up to 97%, while significantly improving your overall security.
  • The Rise and Fall and Rise of the Edge: Penn State & Duo on the Zero-Trust Strat Recorded: May 9 2019 53 mins
    Steve Manzuik, Director of Security Research at Duo Labs & Keith Brautigam, Director of IAM at Penn State
    In this webinar you will learn:
    - Real examples from Penn State of how network topology has gotten exponentially more complicated
    - Why attackers have shifted from systems-focused to data-focused attacks
    - What the evolution of IoT and BYOD-rich environments means for security teams

    We’ve come a long way from the days of mainframe systems and a security strategy that ended at the edge of your network perimeter. Few security teams are more familiar with this evolution than those working in higher education: between research labs and large student populations bringing in a fresh wave of their own devices every year, you’ve had a front-row seat to this network metamorphosis.

    Penn State's Director of Identity and Access Management, Keith Brautigam, and his team are addressing these new challenges by adopting a zero-trust strategy. Duo is an integral element in that strategy, checking with each new connection whether a user and device should be allowed access. In this session with Steve Manzuik, Duo Lab’s Director of Research, they will explore how the Internet of Things (IoT) is unintentionally driving this perimeter-less movement through devices such as Industrial IoT (aka IIoT), wearables, and a unique new technology that is worth exploring for its wider implications: the hearable.

    Join us for an expert discussion on why the perimeter is going the way of the dinosaur, how smart security teams are adapting, and what is coming next.
  • Extending Zero Trust to the Cloud: Real-World Business Challenges and Benefits Recorded: May 2 2019 61 mins
    John Kindervag from Palo Alto Networks & Rob LaMagna-Reiter from FNTS
    Much has been written and spoken about Zero Trust and the principles of “never trust, always verify” as a means for enterprises to implement effective network segmentation. As the model has been embraced, Zero Trust evolved to become a strategic Cybersecurity initiative that major enterprises align to in order to prevent successful cyberattacks. However, Is it a security buzz word or a real-world effective security strategy?

    Watch as Palo Alto Networks® expert and founder of Zero Trust, John Kindervag discusses the “whys and hows” of extending a Zero Trust architecture to the public and private Cloud and Rob LaMagna-Reiter, FNTS CISO, about their successful Zero Trust cloud operation, the business drivers and strategy, and the technical and cultural challenges and achievements that have quickly delivered the business results and benefits desired.
Educational series on cloud computing, security and privacy.
CSA CloudBytes was launched as a webinar series to help us educate the industry on all matters related to the cloud. Our channel is designed to inform our audience about trending topics, new technologies, and latest research. It also allows audience members the opportunity to earn (ISC)2 CPE Credits.

Learn more at cloudsecurityalliance.org. Join the Cloud Security Alliance on LinkedIn and follow us on twitter: @cloudsa, @CSAResearchGuy

Embed in website or blog

Successfully added emails: 0
Remove all
  • Title: Internal Bug Hunts: Squashing Security Bugs on a Budget
  • Live at: Sep 19 2017 5:00 pm
  • Presented by: Pieter Ockers - Sr Program Manager at Adobe
  • From:
Your email has been sent.
or close