Visit the post for more.
Overview
The article provides a recap of the Security @Scale 2014 conference, highlighting discussions on scalable security solutions from various companies including Facebook, Twitter, and GitHub. It emphasizes the importance of integrating security into engineering practices to protect online services effectively.
What You'll Learn
1
How to develop a bug bounty program based on data-driven models
2
Why scaling security organizations is crucial as companies grow
3
How to implement effective incident response strategies
Key Questions Answered
What are the key lessons from the development of Microsoft's bug bounty program?
Katie Moussouris discussed her experience in creating Microsoft's bug bounty program, highlighting the importance of data analysis and alternative incentive models that do not rely solely on monetary compensation. She emphasized the success of the program, which has paid out $253,000 since June 2013, showcasing how organizations can effectively motivate researchers.
How did Twitter transition from HTTP to HTTPS for its users?
Jim O'Leary explained Twitter's process of switching its entire user base from HTTP to HTTPS, detailing lessons learned since 2011. He highlighted strategies like secure indexing, Strict-Transport-Security, and certificate pinning, which were crucial in ensuring user security during the transition.
What tools did Square develop to manage security at scale?
Diogo Mónica introduced several internal tools Square built to scale its security efforts, including Report Card for project security status, Doorman for centralized 2-Factor SSO, and Sting for alert distribution. These tools help manage risk effectively as the organization grows.
Key Statistics & Figures
Total payout of Microsoft's bug bounty program
$253,000
This amount was paid out since June 2013 as part of the program's success in incentivizing security researchers.
Technologies & Tools
Backend
Haxl
Used for developing a scalable rule engine for spam fighting at Facebook.
Backend
Osquery
An open-source project for host intrusion detection using SQL queries.
Key Actionable Insights
1Implementing a bug bounty program can significantly enhance your organization's security posture.By understanding the motivations of hackers and structuring incentives beyond monetary rewards, organizations can attract valuable security contributions, as demonstrated by Microsoft's program.
2Utilizing ChatOps can streamline incident response processes in geographically distributed teams.GitHub's use of Hubot for incident response illustrates how collaborative tools can facilitate real-time communication and decision-making, making it easier to manage security incidents.
3Developing internal tools tailored to your organization's needs can improve security management.Square's custom-built tools like Report Card and Doorman show how organizations can create solutions that fit their unique security challenges, enhancing overall efficiency.
Common Pitfalls
1
Many organizations fail to prepare adequately for incident response, leading to ineffective handling of breaches.
This often occurs due to a lack of logging and monitoring tools, which are essential for understanding the environment during an incident. Proper preparation can significantly improve response times and effectiveness.