duncan-godfrey

Duncan is a security, engineering, and business leader. His background is in security engineering and, in particular, cloud security.

Sr. Director of Security and Compliance

Duncan Godfrey

A global community of ethical hackers brings new perspectives to the hunt for vulnerabilities

Of all the tools available to stock your app security arsenal with, we have to say — bug bounties might just be the hammer you’re looking for.

Modern application assembly bears only a passing resemblance to the historical development methodologies it inherited its DNA from, often leading to a sort of complacency when it comes to securing the dev cycle. If you determine that it is indeed time to scale your security to keep pace with your developers, consider what we at Auth0 did, we set up a bug bounty program and are already reaping the benefits.

Application development environments today more closely resemble an actual assembly line, with developers picking and choosing where to insert a pre-existing extension or module and where to build from scratch. It’s a lot like a build-your-own-bowl lunch place, where you make it your own by mixing the existing bases with just the right tasty sauce combo. Combine the conveyor belt model with a dispersed workforce of developers who may be sitting on opposite sides of a continent from one another, and you get a new and unprecedented workplace paradigm that puts collaboration front and center. 

Bugcrowd is working at the forefront of this new remote paradigm, blending that collaborative spirit with a crowdsourcing model to bring a diversity of perspectives to the hunt for exploits and vulnerabilities. 

## What Is a Bug Bounty and Who Is Bugcrowd?

TLDR &mdash; A bug bounty is when a company or app developer rewards ethical hackers for finding and safely reporting vulnerabilities in their code. And, [Bugcrowd](http://www.bugcrowd.com) is a company who provides this service through a crowdsourced security platform.

A few brief words about a word &mdash; “hacker.” If your only exposure to this word is based on media reports about data breaches, you probably have a negative image of who “hackers” are. In the world of bug bounties and app security, the word has multiple connotations. A hacker can be either good or bad. An ethical cybersecurity researcher, or an unethical bad actor. The researchers used by Bugcrowd are ethical hackers, meaning they’re using their security knowledge, deep curiosity, and coding skills to help companies like Auth0 secure their digital assets.

OK, back to our story.

A bug bounty program can be implemented by any company with a software product. Whether it faces the public or not, anything written with code and connected to a network can be broken into. Offering a bounty for ethical hackers/researchers to find and document these exploits is the best way to stop bad actors from finding and, well, exploiting them later.

That’s a bug bounty in a proverbial nutshell; now on to Bugcrowd. Their unique model combines traditional pentesting with a cutting-edge crowdsourced bug bounty program to quickly and effectively locate vulnerabilities in their client’s code. The crowdsourcing aspect is used to connect their client companies with carefully curated and vetted cybersecurity researchers from around the world who are ready to bring their individual perspectives to the project of zapping bugs.

Luke Stephens, Manager of Training and Quality Assurance for Bugcrowd, puts it like this, “Bug bounty programs aren’t just about accessing talent; they’re about understanding what your security posture looks like; when a motivated adversary shows up.” By bringing ethical hackers with a variety of backgrounds and a mixed set of skills together with a singular goal, finding the backdoors attackers use to wreak havoc, Bugcrowd sets the security bar that much higher by finding the exploits before the bad guys have a chance to.

## What Role Can Bug Bounties Play in Modern App Assembly?

As mentioned above, [the state of modern app assembly](https://auth0.com/resources/whitepapers/state-app-assembly-2020) is a far cry from the early days of software development. Rather than a piece of software being written and tested by a team of in-house developers from start to finish, today’s apps are an amalgamation of custom code integrated with pre-existing modules written by third-party providers. It’s like the way your burrito-sauce-mixed-with-sriracha creation brings out the tanginess in the adobo pork in that lunch bowl last week.

This model speeds up your development time, makes it very easy to iterate, and leads to a more familiar user experience; however, it also opens up a whole new world of security concerns. It increases the complexity of your attack surface, which now includes a constellation of third-party code and services. 

Consider an app that uses an IAM solution from one provider, residing on a PaaS (platform-as-a-service) from another, with a payment system from a third. This all sits behind a custom UI written in-house. That’s four discrete code sets, multiple programming languages, and untold possibilities for vulnerabilities to slip between the code cracks. Remember the heartburn that bowl gave you last week? Yeah, that.

A bug bounty program brings together researchers from around the world, each with their own unique background and particular expertise, and turns them loose on that amalgam. Your developers know their code, but how well do they know the code used in all those modules? The range of perspectives and specializations brought by a team of crowdsourced bug bounty hunters is unparalleled and means you stand a much stronger chance of vulnerabilities and potential exploits being found before an attacker can get at them. 

All of that said, bug bounties are not a one-and-done solution to all of your testing needs. A program like that offered by Bugcrowd forms one prong of a defensive, in-depth approach to app security. Traditional third-party pentesting still holds a place in the pantheon of security measures, and a solid IAM solution can still find its place alongside bug bounties in a mature security program.

> “Strong internal security practices and compliance need to be accompanied by active, continuous, incentivized security testing, and bug bounty programs are an effective and scalable way to achieve this.”
_-Luke Stephens, Manager of Training and Quality Assurance, Bugcrowd_

## The Business Impact Of a Bug Bounty Program

ROI is king when it comes to business decisions, right? What if you could make one change to your dev ecosystem that could potentially raise ROI by 4x? Well, that’s precisely what our experience has been. Dollar-for-dollar, we see in the range of 3-4x the vulnerabilities with this program than we have in the past. More bugs are found in less time and for less money. With the global average cost of a data breach in 2019 sitting at over [$3.8 million USD](https://www.ibm.com/security/data-breach) &mdash; we think our bug bounty program is a sound investment.

Beyond the purely financial aspect, there’s a team cohesion and training aspect to setting up a bug bounty program that can’t be overlooked. People trust people, so having a living, breathing researcher document a vulnerability has a much stronger impact on the development team than an automated scan or test sequence does. And that’s how you build better security awareness into your next iteration or new product. To go back to Luke at Bugcrowd:

> “Bug bounty programs provide a scalable way to not only identify risk to help the security team but to help impart security awareness to builders within our organization.”
_-Luke Stephens, Manager of Training and Quality Assurance, Bugcrowd_

## Lessons Learned From Our Ongoing Partnership With Bugcrowd

In our time working with Bugcrowd and their researchers, we’ve learned some valuable lessons around app security and the value of discovery. We’ve drilled down and come up with our top two most impactful lessons to share with you:

1. **First and foremost, the bugs identified by Bugcrowd have been far more complex and deeply buried than anything we’ve found in the previous testing**. This dovetails with the quote earlier about bug bounty programs finding 3-4x more vulnerabilities per dollar spent. 

2. **Be ready. You should expect to see a significant increase in the number of vulnerabilities discovered compared to before the program**. That means you need to be sure your security team is ready to triage and mitigate those vulnerabilities, so you ensure they’re dealt with before a malicious actor.

Both of these lessons are reciprocal. We’ve learned a lot about our product, and by having the resources to address issues quickly, we’ve shown the Bugcrowd researchers that we’re responsive and how highly we value the work they do. 

Auth0 Senior Manager of Product Security, Marcin Hoppe, sums it up succinctly:

> “We don’t control what types of vulnerabilities bug hunters are looking for, and they might be looking for things we have not included or prioritized in our own security testing efforts. This gives us a chance of getting reports of vulnerabilities we might have otherwise missed.”

## What Does The Future Hold For Bug Bounty Programs?

Though relatively new to the security scene, official bug bounty programs are seeing a high adoption rate across industries. That’s right; bug bounties aren’t just for the tech sector. According to a [report from Bugcrowd](https://www.bugcrowd.com/resources/reports/priority-one-report/) themselves, 2019 saw an increase of 29% in the number of bug bounty programs launched, along with a 50% increase in public programs. Leading the way were the financial (71%) and retail (50%) sectors, with healthcare (41%) coming in third.

With programs like Bugcrowd showing the way to proactively seek out, document, and mitigate potential vulnerabilities **before** they cost the company millions of dollars — that trajectory shows no signs of slowing down. By answering the formerly unanswerable question, “what is a vulnerability worth?” bug bounty programs are providing a new peace of mind for today’s app devs.

## Auth0 and Bugcrowd: A Security Partnership That Works

Here at Auth0, security is what we do. By partnering with Bugcrowd, we found added peace of mind, further tightened our security perimeter, and have sped up the resolution process when a vulnerability is discovered.

<include src="asides/AboutAuth0" />

Bugcrowd’s Bug Bounty Program: Crowdsource Your App Security

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Private program reinforces company’s strong security ethos

**BELLEVUE, Wash., Oct. 1, 2019** -- [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced the launch of a private bug bounty program to further reinforce its emphasis on security and ensure that its customers are protected from any vulnerabilities.

The private bug bounty is a specialized program that will allow Auth0's security team to partner with selected researchers to source potential vulnerability discoveries in exchange for monetary rewards. The bug bounty will be run on [Bugcrowd](https://www.bugcrowd.com/) and will expand the company's current [Responsible Disclosure Program](https://auth0.com/responsible-disclosure-policy/), which is already in place.

"We take the privacy and protection of our customers' data very seriously and are dedicated to investing the time and resources into ensuring we adhere to the highest standards," said Joan Pepin, CISO and VP of Operations at Auth0. "Our security program is maturing rapidly, and the launch of this bug bounty program reinforces our dedication to our customers and the highest level of security we offer them."

Bugcrowd will select and invite security researchers registered on its platform based on skills and experience. Each report verified by Bugcrowd's Application Security Engineer team will be then sent to the Auth0 Product Security team to assess the severity of the finding, assign the researcher a monetary reward, move the issue to its internal vulnerability database, and work with relevant Product and Engineering teams towards remediation.

"Bugcrowd deploys a global Crowd of diverse, creative, and highly-skilled security researchers to identify and solve security challenges," said Ashish Gupta, CEO at Bugcrowd. "The result is our ability to provide highly specialized security expertise to the high caliber of companies we work with. We are really excited to be supporting the launch of Auth0's Bug Bounty Program and serve as an extension of its security team."

The program is launching with approximately 25 global researchers who have been identified and invited by Bugcrowd, and will increase in number later this year.

Auth0 is a trusted security partner to its customers and has achieved certification for many important compliance regulations, including HIPAA, SOC 2 Type II, ISO 27001, ISO27018, and more. Please visit [Auth0 Security](https://auth0.com/security/) for more information.

<include src="asides/AboutAuth0" />

### Media Contacts

Jeana Tahnk 
Corporate Communications 
Auth0 
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Meghan Gardner 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

"bugcrowd"