SecurityBrief Asia - Technology news for CISOs & cybersecurity decision-makers

Bugcrowd partners with Least Authority for security boost

The latest look inside the minds of professional hackers using the Bugcrowd platform reveals that AI is increasingly becoming a tool, target and threat.

New Cybersecurity Warning As 1,000 Elite Hackers Embrace AI

In addition to Google's new bug bounty program, announcements this week around generative AI also include an upcoming Biden administration executive order, as well as studies by OpenAI and the United Nations.

Google launches AI bug bounty program as organizations plan to study risks

Kantata has announced that Concurrency, Inc., a Wisconsin-based IT consulting firm, a ServiceNow partner and a Microsoft-based systems integration partner, is successfully using its... Outreach has announced the appointment of Abhijit Mitra as its new ...

Dave Gerry, CEO of Bugcrowd

Bugcrowd has reported significant customer growth in the last year. The company has seen growing demand for its crowdsourced cybersecurity platform. It

Bugcrowd experiences continual customer growth

At Dreamforce, Enterprise Times sat down with Andres Restrepo of Klient to talk about the PSA company and Dreamforce. We met at the Canada Lodge, a hotel that had been taken over by Canadian organisations within the Salesforce ecosystem. Restrepo only ...

A conversation with Klient

Company helping to protect data and environments of top brands including Rapyd, ExpressVPN and T-Mobile SAN FRANCISCO, Oct. 10, 2023 /PRNewswire/ -- Bugcrowd, the only multi-solution crowdsourced ...

Bugcrowd Announces Rapid Growth of Customer Base Year Over Year

SAN FRANCISCO, Oct. 10, 2023 /PRNewswire/ -- Bugcrowd, the only multi-solution crowdsourced cybersecurity platform, today announced significant global customer momentum, highlighting the market ...

Bugcrowd

bugcrowd

Today, announced a $6M Series A financing, led by Costanoa Venture Capital, with participation from existing investor Rally Ventures. As part of our investment, I have also joined Bugcrowd’s board of directors. Bugcrowd . In the short time since then, a number of large-scale breaches have occurred, including and . The problem continues to get worse, and companies are scrambling to protect themselves with the latest and greatest technologies. This problem has produced several notable startup successes including Palo Alto Networks, Splunk, and FireEye. However, despite their increased vigilance and spending on , there is one problem that chief information security officers (CISOs) can’t buy their way out of: talent. There are more than . I wrote about our interest in security in October the famous ‘Sony Hack’ a massive online bank robbery security technology 200,000 unfilled cybersecurity jobs and open job postings have increased by 74% over the past five years Pioneered by Netscape, and refined by large web companies like Google and Facebook, bug bounty programs have emerged as a way for security teams to leverage talent outside of their companies, and continue to gain mainstream adoption. By offering financial rewards to security researchers who discover vulnerabilities in their systems, organizations are able to harness the power of crowdsourcing to have more security experts, working on their behalf, exactly when they’re needed. While these programs have been in existence amongst large web companies for some time, running such a program has been very difficult for “the other 99%” of companies until very recently. Bug bounty programs not only require a unique software platform, but also the resources and expertise to review and process the high volume of submissions that a well-run program will generate. This is why Costanoa is absolutely thrilled to be partnering with Casey, Chris, and the rest of Bugcrowd team. Already counting Pinterest, Blackphone, Western Union and Aruba Networks among its customers, Bugcrowd gives companies of any size the ability to run bug bounty programs, and access to their globally distributed team of 15,000+ researchers. They have built a unique, end-to-end platform offering a turnkey solution for running and managing bug bounty programs, while also curating a diverse community of security researchers that are intelligently matched with companies based on their specific expertise. We are very excited about the profound impact that Bugcrowd is having on the security industry, and look forward to building a great company together. If your company is interested in getting started with a bug bounty program, learn more and get started . here For more information, read the press release . here By: Neill Occhiogrosso and Bucky Moore

Our Investment in Bugcrowd

Hey there 👋 In your journey as a developer, the common way to make money is by . securing a full-time job However, you may not be in a position yet to secure a job ( ), or you began working, but you are looking at ways to make some extra cash. aka you are still studying Now, you can try to make a side income in many ways. Some are more realistic than others. In this article, we will learn about the . side-income gigs that you can get started with today achievable Take a deep breath, and let us wash our souls with this new knowledge. 🧎 I did not try every option in the list. If you think something should be added to the list or you want to share a personal experience, please comment below (I'd love to hear from you!). 🙇‍♂️ Disclaimer: ⚔️ Creator Quests Creator Quests is a way for developers to monetize their skills. are open-source challenges happening every two weeks. Creator Quests and for playing around with the developer tools of the future. 🚀 It is like a 24/7 Hackathon that rewards developers for building cool apps The community decides the winner by giving kudos to projects they love. The projects with the most kudos will earn the most. 🤑 💃 MaaS - Me as a Service Freelancing is hard to start with. However, it is very much to everyone. achievable and accessible I had some experience in freelancing with data analytics. If I had to redo it again, here is how I would approach it: Understand the differences between , , and . Pick a platform you prefer and focus on that. I found to be an interesting platform, but if you think you are very good, you can always look into . 1️⃣ Pick a platform: Fiverr Upwork Freelancer Malt TopTal Build a profile around a very specific service, e.g., I specialize in coding Python scrapers and building a database using MongoDB, which ultimately displays dashboards through Plotly (not exactly that, but you get the idea 🙃). 2️⃣ Don't be Mr/Mrs know-it-all: Getting your first clients is extremely hard, so contact job postings and explain that you are happy to do it If they are happy with the job, ask them to provide a good rating. 3️⃣ Charge NOTHING for your first Client: for free. Start charging for your work - still at a lower rate - and build your reputation. 4️⃣ Get your First Pay: Once you have a stronger position on the platform, you can decide to up your pricing. 5️⃣ Increase your pricing: My final comment is that although I believe everyone can start making money by freelancing, There are many drawbacks that could not fit with how you like to work (difficult clients, deadlines, platform dependency, etc). I don't think everyone should be doing it. In London, I found a little trick to get some clients. You can approach some relevant consulting/recruiting agencies, and they can help you find clients for you. Look into agencies like this if you are struggling to get started. 💁 Special Tip: 🧪 Test it. Get Paid for it. As a developer, you understand the technicalities behind a webpage or an app. This means you have the skills to perform great QA. Depending on the platforms you focus on, you can spend between 10-60+ minutes trying out an app or a website. There are various platforms out there, but the three known websites for you to check out are: Trymata UserTesting UserLytics PS: There is also the option for complete surveys which, in my opinion, pay very little. If you are still curious about it, you can check or . Wynter SwagBucks 🐛 Bug Hunter You can monetize this skill if you have a great eye for detail and enjoy web security. You can make money there if you are curious and have good programming skills. 🥂 You will likely get paid $20 at the start, but the rewards can increase to astronomical amounts like £100k+. I would stress that this is not how you become a millionaire. There is some decent competition, and you likely won't earn very high figures. You should still try it and see if it works for you. The most known platforms for this are: HackerOne BugCrowd If you somehow become good at this, you can look into big companies, as this tends to be where the big bucks are. You can find the vulnerability programs here from , , and . Microsoft Apple Google If you find vulnerabilities in a website you enjoy using, there is no harm in asking them for compensation. 🙃 Last tip: 🧑‍🏫 You learned something? Teach it back Tutoring is my personal favourite "side hustle.” It may seem "meh" for some, but it is very much achievable, and it . strengthens your knowledge around a specific topic while making good money Also, you don't necessarily need to be an expert. That's right! As long as you are more knowledgeable in a specificic domain, you can charge a service for teaching that knowledge. There are three ways you can approach this: 📜 Old School Way 1️⃣ : Post physical ads around schools/colleges with your offering and contact details. Identify the right schools 2️⃣ Find and get involved in relevant Discord, Facebook, and Linkedin groups. Make the community in question aware of your services in a respectful way. Identify Communities: 3️⃣ Start your first sessions with a lower pricing to get the ball rolling. After some experience, consider raising your prices. Don't be too greedy: 👶 New School Way Look into the platforms below: Codementor Superprof Tutor Register as a tutor and start below market rate to get your first students. 📦 Digital Content You can look into building some video courses. My personal favorite is a new tool called . Stan Store This is the all-in toolkit for digital creators, and there is much more than just building video content. I personally made a couple hundred dollars using this platform. Alternatively, you can look into more conventional platforms like or . SkillShare Udemy Slightly less achievable paths (but worth a mention) 👇 : Some hackathons provide good cash prizes. The downside is that there is usually a decent amount of competition. To scout for the right hackathons, the best website by far is . 🚧 Hackathons DevPost You can build a boiler template based on your knowledge. What is "slightly less" achievable in this case is how much money you can make (at least initially). This is because it requires a big following (or significant marketing). If you want to give it a shot, you can check out and . 🏷️ Selling Boiler Template: Gum Road AppSumo I hope you enjoyed this article and that it helped you understand how to leverage your dev skills for a side hustle. The above gigs are not trying to paint a picture that you will be wealthy overnight. However, they are side hustles with a high chance of getting paid. With some consistency, you can expect to earn much more over time. 🚀 This post was inspired by a great piece written by . @lissy93 If you are interested in learning about alternative ways to monetize your dev skills (especially if you are more experienced), please check their and give it some love. article See you next week, Your Hackernoon buddy 💚 Bap Also published . here

Developer Side-Hustles: 5 Practical Ways to Monetize Your Coding Skills

Joining the cybersecurity field as an outsider without a technical background was a transformative journey for me. What immediately captivated me about the industry was its relentless pace and the exhilarating challenge it constantly presented. Interacting with professionals in the field, I was heartened by their overwhelming support for newcomers who genuinely exhibited the will to learn. However, I quickly found a prevailing sentiment: there's a general expectation for newcomers to be independent self-learners. This could be a daunting expectation, especially considering that many potential beginners in aren't inherently self-learners. While innate curiosity is undoubtedly a valuable trait, it's essential to recognize that many individuals, even those with immense potential, need a structured framework to move their initial steps into this vast domain. cybersecurity In the last few years, significant progress has been made in filling the talent gap in the industry. However, as of 2023, according to the , there were 440,000 new jobs created in cybersecurity globally (an 8.7% increase year over year), but a staggering 4 million positions remained unfilled (a 12.6% increase year over year). This enormous gap results from the disconnect between employers' needs for experienced professionals and the real-world shortage of such expertise ISC2 Cybersecurity Workforce Study The solution to this talent crunch lies in focusing on the early stages of potential cybersecurity professionals' careers, particularly young students. As a community, it's imperative that we equip the youth with the tools they need to explore cybersecurity as a viable career option. The key is to offer structured, practical, and accessible learning paths. Below are some steps and examples of how to do so. Study Frameworks Like NIST-NICE The NIST-NICE framework categorizes cybersecurity work into seven high-level categories: Analyze, Collect and Operate, Investigate, Operate and Maintain, Oversee and Govern, Protect and Defend, and Securely Provision. Each category is further divided into specialty areas and work roles, providing a comprehensive roadmap for career progression. Table 1: NICE Framework Work Role Categories Category Description Number of Work Roles Securely Provision (SP) Conceptualizes, designs, procures, and/or builds secure IT systems. Responsible for aspects of system and/or network development. 11 Operate and Maintain (OM) Provides the support, administration, and maintenance necessary to ensure effective and efficient IT system performance and security. 7 Oversee and Govern (OV) Provides leadership, management, direction, or development and advocacy so the organization may effectively conduct cybersecurity work. 14 Protect and Defend (PR) Identifies, analyzes, and mitigates threats to internal IT systems and/or networks. 4 Investigate (IN) Investigates cybersecurity events or crimes related to IT systems, networks, and digital evidence. 3 Analyze (AN) Performs highly-specialized review and evaluation of incoming cybersecurity information to determine its usefulness for intelligence. 7 Collect and Operate (CO) Provides specialized denial and deception operations and collection of cybersecurity information that may be used to develop intelligence. 6 This table showcases the broad spectrum of roles within the cybersecurity landscape. By understanding these categories, beginners can better position themselves for a more tailored and informed career trajectory. For a comprehensive understanding of the NIST-NICE framework and to access a myriad of resources tailored for beginners, one can visit the . NICE's Getting Started Resource Center The goal is to explore various facets of cybersecurity and determine where passion intersects with proficiency. Since cybersecurity is a dynamic field, there's always room for an individual to pivot, learn, and evolve. Become Friends with Real Hackers The cybersecurity community is exceptionally supportive of newcomers. Even seasoned professionals are often open to sharing tips and advice and are incredibly accessible to beginners. The secret to meeting these people is to attend live events. Real-time interactions at in-person events offer spontaneous questions, discussions, and the possibility for deeper understanding. It’s not just about soaking in knowledge; it's also about networking. These venues are prime opportunities for establishing meaningful connections, potentially leading to mentorships, job placements, or even collaborative projects. Furthermore, many such gatherings have live challenges or hands-on workshops where attendees can put theory into practice, often under the guidance of an expert. Here's why attending in-person events can be so beneficial for a cybersecurity enthusiast: Directly engage in challenges or workshops, honing skills in real time. Skill Demonstrations: Cybersecurity is ever-evolving. Engage in fresh, cutting-edge discussions that might not have reached the wider online community yet. Staying Updated: Share experiences and challenges with peers. It's comforting and motivating to know others face similar challenges. Moral Support: When it comes to venues, some platforms and organizations stand out: (Open Web Application Security Project): Renowned for its insights into web vulnerabilities, its global chapters regularly hold meetings and workshops. OWASP : These community-driven events offer a cozier, more intimate setting for discussions and learning. BSides : One of the hacker conventions, it is an excellent place for someone keen on diving deep into hacking and cybersecurity. DEF CON When planning to attend, here are a few tips: Don't just be a passive participant. Engage, ask, discuss! Engage Actively: Go through the event's schedule, note down sessions of interest, and research the speakers. Prepare: Did you connect with someone interesting? Drop them a thank-you note or a simple message post-event. It could be the start of a valuable relationship. Follow-up: So, if you're aiming to deepen your cybersecurity knowledge and network, attending such events could be the stepping stones to your next big opportunity. Participate in CTF Challenges and Hackathons Capture The Flag (CTF) challenges are competitions where participants solve cybersecurity puzzles ranging from cryptography to web application vulnerabilities. These challenges offer beginners a practical, hands-on experience in solving . For example, the DEF CON CTF event annually attracts a global audience and has puzzles suitable for all skill levels. real-world cybersecurity problems Engaging in CTF challenges directly correlates with several areas outlined in the NIST-NICE framework: Analyze (AN): Deciphering cryptographic puzzles in CTFs sharpens skills pertinent to the Analyze category, where one evaluates incoming cybersecurity information. Protect and Defend (PR): Addressing vulnerabilities during a CTF strengthens a participant's capabilities in identifying, analyzing, and mitigating threats to IT systems, aligning closely with the Protect and Defend category. Investigate (IN): Some CTFs involve forensic challenges, aligning with the Investigate category, where one examines cybersecurity events or crimes related to IT systems. Securely Provision (SP): Tackling challenges where participants must secure or harden systems mirrors the Securely Provision category, emphasizing the design and creation of secure IT systems. By immersing oneself in CTFs, beginners not only gain valuable hands-on experience but also better understand the different roles and areas they might be interested in as per the NICE framework. It provides a tangible, engaging way to explore and deepen specific cybersecurity competencies. Join Bug Bounty Campaigns In a bug bounty campaign, companies incentivize ethical hackers to find and report vulnerabilities in their systems. This practice is becoming increasingly prevalent among leading technology companies, realizing the value of the global pool of independent security researchers. For instance, tech giants like Google, Facebook, Apple, Microsoft, and Twitter have all rolled out their own bug bounty programs, encouraging ethical hackers to identify and responsibly disclose potential security flaws in their platforms. By offering these campaigns, these organizations not only enhance the security of their systems but also foster a symbiotic relationship with the cybersecurity community. For example: Google's Vulnerability Reward Program (VRP) rewards researchers who uncover security vulnerabilities in Google's products and services. Their reward amounts can range from $100 to over $30,000, depending on the severity of the flaw and the product affected. In some exceptional cases, even higher rewards have been granted. Google's VRP has been instrumental in ensuring the security of products such as Google Chrome, Android, and Google Cloud Platform. Apple's Security Bounty Program invites security researchers to find vulnerabilities across iOS, macOS, and other Apple software. The payouts can be quite substantial, with rewards for the most critical issues reaching up to $1 million. This reflects Apple's commitment to user privacy and security. Platforms like Bugcrowd, Hackerone, and Intigrity have also streamlined the process, acting as intermediaries connecting ethical hackers with organizations, including those that might not have independent programs like Google or Apple. Once a vulnerability is identified and reported through these platforms or directly to the companies with established programs, it undergoes a verification process. If validated, the researcher could receive a financial reward, recognition, or both. Focus on Practical-led Training For beginners, there are web browser-based labs. These labs allow users to practice in a controlled environment directly within their browsers. While convenient and easy to access, these platforms might not fully replicate the complexities and intricacies of real-world systems. They are good introductory tools, but as users progress in their cybersecurity journey, they might find them less challenging. On the other hand, there are virtualized environments that require VPN access. These platforms offer environments that are almost identical to actual company infrastructures. The virtualized scenarios are meticulously crafted to emulate real-world networks, servers, and workstations. As users connect via VPN, they feel as if they are truly inside an operational network, providing a level of authenticity that web browser-based labs might lack. This type of environment allows for a deeper exploration of tools, tactics, and procedures, effectively training the participant to tackle genuine cybersecurity threats. The rigorous training in these environments ensures that participants are job-ready and fully prepared to address the multifaceted challenges they might face in their cybersecurity careers. By experiencing both types of training, candidates can appreciate the gradient of complexity in cybersecurity challenges and better hone their skills to be effective professionals. Here is a list of free or affordable practical cybersecurity training resources for beginners: : Provides a series of war games designed to teach the principles of security from the basics to advanced concepts. It's a great starting point for beginners wanting to learn Linux commands and simple penetration testing techniques. OverTheWire : This platform offers more than 300 challenges across different domains to help users improve their hacking skills. It provides a hands-on approach to learning about network security, web application security, and more. Root Me : Developed by the creators of the Burp Suite, this academy offers free hands-on web security training. It covers a wide array of topics from basic to advanced web vulnerabilities. PortSwigger Academy : Provides a beginners-friendly courses paired with VPN-based real-world training experience, emulating genuine cybersecurity scenarios. PWNX.io : A platform designed primarily for students to learn about cybersecurity. It offers educational modules tailored to different skill levels. PWN.college : An online platform that aids learning in cybersecurity through hands-on virtual labs. Its gamified challenges range from the very basics to more advanced, catering to users of all skill levels. TryHackMe A platform that provides various cybersecurity labs and challenges. While it does cater to users of all skill levels, some of the challenges can be very advanced, making it ideal for those looking to progress beyond the basics. Hack The Box: TCM Security offers self-paced cybersecurity courses that cover topics such as penetration testing, security training, and compliance. Additionally, they provide certifications that are increasingly gaining reputation in the industry. TCM Security: The resources mentioned above represent just a snapshot of the many tools and platforms that have gained attention and appreciation within the cybersecurity community. The realm of cybersecurity training is vast, and the list of valuable resources extends far beyond what's provided here. Additionally, there are numerous open-source projects and other content available online that can be instrumental in enhancing one's learning journey. Specialized forums and websites, which I will detail in the next paragraph, can be invaluable in discovering reviews or feedback from other community members. This feedback provides insights into the quality of new resources that are constantly being released. Leverage Social Media and Forums to Find a Mentor In the vast realm of cybersecurity, guidance from someone experienced can make all the difference. Platforms like LinkedIn can be particularly beneficial, not just for networking, but also for identifying potential mentors. By carefully reviewing profiles, joining relevant groups, and actively participating in discussions, you can showcase your eagerness and catch the attention of experienced professionals willing to guide newcomers. Discord, a platform initially created for gamers, has burgeoned into a hub for various professional communities. Specialized forums and websites further amplify the opportunity: Reddit’s Cybersecurity Communities: Platforms like and subreddits are teeming with professionals and enthusiasts discussing the latest in security trends, challenges, and solutions. The subreddit is particularly designed for students and beginners, fostering a nurturing space for queries and guidance. Reddit's Cybersecurity Netsec Netsecstudents Wilders Security Forums: Dive deep into discussions about online privacy, security, and data protection on . The vast range of threads and posts signifies a dedicated community, making it an invaluable resource for all cybersecurity-related topics. Wilders Security Forums MalwareTips and Antionline Forums: Websites like and are vibrant communities where one can engage in in-depth discussions on various facets of security, from malware threats to network safety. MalwareTips Antionline Bleeping Computer and Spiceworks Community: Forums such as and the are dedicated to comprehensive security-related discussions, from firewalls and VPNs to password managers and malware attacks. Bleeping Computer Spiceworks Security Forum Hacklido: A unique platform, is where the brightest hackers come together to share knowledge, experiences, and guidance. It's a rich source of practical insights and real-world examples. Hacklido By actively engaging in these forums and communities, not only can one expand their knowledge but also build meaningful connections. As you participate and contribute, the chances of meeting potential mentors who recognize your passion and dedication increase significantly. Remember, mentorship in cybersecurity is not just about learning the ropes; it's about guidance, feedback, and understanding the nuances of the rapidly evolving world of digital protection. Make Use of Free Tools As you embark on your cybersecurity journey, it's essential to familiarize yourself with the plethora of free tools available. These tools, widely recognized and utilized by professionals in the field, can significantly augment your learning experience: Wireshark: An open-source packet analyzer, Wireshark allows users to see what's happening on their network at a microscopic level. It's widely used for network troubleshooting, analysis, software, and communications protocol development, and education. Description: The tool comes with a range of to help newcomers grasp its functionalities. Resource: official documentation and guides OWASP ZAP (Zed Attack Proxy): Developed by OWASP (Open Web Application Security Project), ZAP is a free, open-source web application security scanner. It helps find security vulnerabilities in web applications while you are developing and testing them. Description: New users can benefit from the tool's and various community-contributed guides. Resource: official documentation Metasploit Community Edition: Part of the Metasploit Project, this edition is a free-of-charge penetration testing tool that helps verify vulnerabilities and manage security assessments. It aids in the discovery, analysis, and exploitation of vulnerabilities. Description: Metasploit provides a plethora of for various functionalities. Resource: tutorials and user guides Snort: As an open-source network intrusion prevention system (NIPS) and intrusion detection system (IDS), Snort is adept at performing real-time traffic analysis and packet logging. Description: Beginners can find extensive documentation and a community of users on the . Resource: Snort official website OpenVAS (Open Vulnerability Assessment System): OpenVAS is a full-featured vulnerability scanner that comes with numerous tests and offers updates for the latest vulnerabilities. It assists in identifying issues in systems and applications. Description: The OpenVAS community provides a to support new users in understanding and maximizing the tool's capabilities. Resource: comprehensive set of documentation Kali Linux: Kali Linux is a Debian-based Linux distribution that's geared towards advanced penetration testing and security auditing. It comes pre-installed with hundreds of integrated security tools, making it a staple in the cybersecurity community. Description: For those new to Kali, the offers comprehensive guidance, ranging from installation to utilizing its vast array of tools. Resource: official documentation Harnessing the capabilities of these tools not only gives beginners a practical understanding of various cybersecurity domains but also provides a hands-on approach to combating potential threats. Remember to explore the associated documentation and tutorials for each tool, as they often hold a wealth of knowledge and best practices. Untapped Potential and the Need for Guidance While there are self-learners who manage to connect the dots on their own, a vast number of budding talents are not yet part of the , mainly because they lack initial guidance. By providing targeted and practical guidance, we can help pave the way for a new generation of cybersecurity professionals ready to take on the challenges and opportunities that this rapidly evolving field has to offer. cybersecurity ecosystem Structured learning can be achieved in various ways, and this guide aims to offer an alternative perspective, coming from a non-traditional cybersecurity professional who had the unique opportunity to learn from genuine hackers.

You are Not Learning Alone: a Structured Guide for Cybersecurity Beginners

আপনি একা শিখছেন না: সাইবার সিকিউরিটি নতুনদের জন্য একটি স্ট্রাকচার্ড গাইড

Sie lernen nicht alleine: ein strukturierter Leitfaden für Einsteiger in die Cybersicherheit

No está aprendiendo solo: una guía estructurada para principiantes en ciberseguridad

Vous n'apprenez pas seul : un guide structuré pour les débutants en cybersécurité

आप अकेले नहीं सीख रहे हैं: साइबर सुरक्षा के शुरुआती लोगों के लिए एक संरचित मार्गदर्शिका

あなたは一人で学んでいるわけではありません: サイバーセキュリティ初心者のための構造化ガイド

혼자 배우는 것이 아닙니다: 사이버 보안 초보자를 위한 체계적인 가이드

Você não está aprendendo sozinho: um guia estruturado para iniciantes em segurança cibernética

Вы не учитесь в одиночку: структурированное руководство для новичков в области кибербезопасности

Yalnız Öğrenmiyorsunuz: Siber Güvenliğe Yeni Başlayanlar İçin Yapılandırılmış Kılavuz

Bạn không học một mình: Hướng dẫn có cấu trúc dành cho người mới bắt đầu về an ninh mạng

你不是一个人学习：网络安全初学者的结构化指南

248 Stories To Learn About Cyber Threats

Let's learn about via these 58 free stories. They are ordered by most time reading created on HackerNoon. Visit the to find the most read stories about any technology. Vulnerabilities /Learn Repo 1. CVE-2022-42856: Adjoining Splittail Vulnerability Report A look at CVE-2022-42856, reported by Apple as a vulnerability under active exploitation. 2. What is Broken Access Control and Why Should You Care? With broken access control being one of the most prevalent weaknesses for web applications, it’s important to not only understand it, but to prevent it also. 3. Command and Control Frameworks in a Nutshell A glimpse over Command and Control attacks and frameworks, how they happen, and how they can affect our daily lives. 4. How to Exploit Prototype Pollution? Prototype Pollution is a JavaScript related vulnerability. This article explains how it works and how to exploit it bypassing security checks of the app. 5. CVE-2022-31705: Bridged Creek Vulnerability Report Information on the CVE-2022-31705 critical sandbox escape vulnerability announced by VMWare. 6. Check Point Security Breach: A Leading Cybersecurity Company Has Been Breached Check Point, which bills itself as the leader in cybersecurity solutions, has been breached. Data records of over 5k ZoneAlarm forum users have been hacked. 7. Building a Web Vulnerability Scanner In May this year I was part of a team that launched SecAlerts, a free security product that sends subscribers a customised weekly report of vulnerabilities and security news relevant to their software stack. The service was deliberately made a low-barrier of entry way to keep users informed and, as it nears 1,000 subscribers, the decision to 'keep it simple' appears to have merit. 8. Key Questions to Ask your DevOps Teams About Containers and Kubernetes DevOps teams are responsible for balancing two important forces
in their organizations’ software development efforts: shorter delivery cycle
times for applications that continue to increase in size and diversity. 9. API Architecture: Components and Best Practices While API Architecture and API Design are different, when it comes to securing them, both need to be kept in focus. 10. Common Web Security Vulnerabilities In the movies, hacking is like fast keyboard typing and hitting the Enter but in the real world, hackers find and exploit vulnerabilities to hack websites. 11. There Are More Risks Associated With SaaS Data Security Than Potential GDPR Fines The growing reliance on SaaS business calls for an improvement in security. On occasions, data security can be of existential importance to organizations. 12. Crypto Wallets Exposed "Mnemonic Phrase Vulnerabilities" (4 Already Fixed) MetaMask and Phantom said today that they had patched a security flaw that could, in some cases, allow attackers to obtain mnemonic phrases. 13. Safe Storage: Hacks vs. Vulnerabilities Vulnerabilities found in hardware wallets is to be expected. All systems are hackable. The safest place for your coins is still your private keys. 14. Military Grade Encryption Won’t Save You, or Your Business With two recent vulnerabilities making headlines this month, notably CVE-2019-14899, impacting VPNs running on Linux distros and Atlassian’s zero-day flaw reported by SwiftOnSecurity concerning leak of private keys, it should be no surprise anymore as to why encryption merely breeds a feeling of security rather than guaranteeing it. 15. How to fix Security Vulnerabilities in NPM Dependencies in 3 Minutes Hola people!!! 🥑 16. Common Vulnerabilities and Exposures - Top Offenders in 2019 In 2018, the #1 spot on the "Top 10 Software with the Most CVEs" list went to Debian Linux, with 1197. 17. 5 CSRF Vulnerabilities Known For Highest Bounty Rewards If you don’t know, a bug bounty program is a modern strategy to encourage the public to find and report bugs or vulnerabilities in software — especially the security bugs that may be misused by cybercriminals. Most of the big technology companies like Facebook, Google, and Microsoft employ bug bounties. 18. Improving Open-source Software Security for Java Developers How can security be stepped up for the open-source Java ecosystem?
Enforcing automated scans before components are published is one of the ways. 19. Newest Malware from China “I think malware is a significant threat because the mitigation, like antivirus software, hasn’t evolved to a point to mitigate the risk to a reasonable degree.” Kevin Mitnick 20. 3 Types of Security Policies You Can Use with Your Kubernetes Pods On August 20, 2020, a provider of access management tools released an advisory detailing several misconfiguration issues that affected the kubelet. This feature of Kubernetes functions as the primary “node agent” running on each node. In order to support this functionality, the kubelet maintains full control over a pod running in a node. 21. Securing your NodeJs Express Application — Part 1 Review common mistakes and vulnerabilities in JavaScript like command injection and see how to secure NodeJs and express using npm packages like hpp and helmet 22. How to Keep OpenSSL Updated in an Enterprise Environment Outdated systems can leave us vulnerable to bad actors. Zero-day exploits are common with just about every system that exists. If we do not upgrade regularly, we leave ourselves at the mercy of black-hat hackers who regularly take advantage of any out-of-date application they can find. This is equally true with OpenSSL as with anything else. 23. Breaking Down 3 API Security Breaches The following three API security breaches provide helpful lessons for improving security today. 24. How to Protect Your Kindle From Hackers On August 6, 2021, findings of a security flaw in Amazon’s Kindle e-reader were disclosed by Slava Makkaeveev, a researcher from Check Point. You can patch it. 25. How to Optimize Your Web Server for Better Website Performance In this digital world, the success of your website lies in its first impression and user experience. A website that takes a loading time more than a blink of an eye makes them so frustrated and abandoned the website. It can create an adverse impact on search engine ranking and business of that website. 26. Spotlight on the Server-Side: A Guide to SSRF Vulnerabilities Server-side request forgery (SSRF) vulnerabilities can lead to total system compromise. Discover where they’re common, examples, and prevention tips. 27. How Does the Adversarial Cycle Apply to Coding and Security? Even if the code is perfect, an attacker can exploit it. 28. Common Vulnerabilities and Exposures: A Poem There's still some cases of malware
always-alarmed-and-on, always
large-in-scale in sight and run via
spray pray on-site. 29. Top 9 Security Practices at Kubernetes in 2020 In January 2019, Kubernetes, the world's most popular container orchestration system, discovered the first major security vulnerability that hit the project’s ecosystem. Vulnerability CVE-2018-1002105 allows attackers to compromise clusters via the Kubernetes API server, which allows malicious code to be executed to install malware, etc. 30. BREAKING New Threat Analysis: Killnet Hack-for-Hire Group New threat analysis detailing research performed by Quadrant Security on the Killnet hack-for-hire group. 31. Stack Overflow Vulnerability Stack overflow is a type of buffer overflow vulnerability. When we  pour water in a glass more than its capacity the water spills or  overflow, similarly when we enter data in a buffer more than its  capacity the data overflows to adjacent memory location causing program to crash. This is know as buffer overflow. 32. Handling Vulnerabilities Due to De-serialization in Java Applications When it comes to vulnerabilities, it's crucial to understand how Java objects are stored and accessed. 33. How We Could Have Listened to Anyone’s Call Recordings How PingSafe managed to find and report a vulnerability in an automatic all recorder that would have allowed us to listen to anyone's call recordings 34. Roadmap and Resources to Become an Ethical Hacker How to become an ethical hacker 35. How to Fix Your Broken Vulnerability Management CVSS scores are broken measures of vulnerability criticality.  SSVC is a viable solution to the problems created by CVSS scoring when used in isolation. 36. Crack Open the IoT Vulnerabilities of Realtek Taiwanese chip designer Realtek has warned of four recent vulnerabilities in three SDKs in its WiFi modules. 37. AU Government Fails Cybersecurity Targets as PM Warns of Cyber Threat On June 19 this year Australian Prime Minister, Scott Morrison, alerted the nation to the fact they were undergoing cyber attack. 38. Planning Cyber Security Budget Thoroughly: 2021 Edition Budgeting for cybersecurity is a challenging process. Here are some tips, how you can plan your cyber security budget effectively. 39. 10 Common Java Vulnerabilities Every Security Engineer Should Know This article covers the most common security vulnerabilities for Java programming 40. Your Top 5 Software Composition Analysis Questions Answered With the fast growth of the usage of open source in all industries, the need to track its components becomes dire as ever. Software Composition Analysis (SCA) is an open source component management solution for providing and automating visibility into the open source in your software. 41. How The Rise of Vulnerabilities Has Shaped Modern Patch Management Practices Vulnerabilities can seriously damage company’s operations and reputation, but you can protect it by automating live patching of infrastructures with KernelCare. 42. How To Deal With Common Open Source Vulnerabilities Most successfully IT Companies like Google, Microsoft including small Saas organizations relies on open-source software to power their software and applications architecture, deployments and so on. It really helps speed up the rate at which developers work on a project and also gives developers access to a myriad of top-notch projects. 43. 4 Common Web App Vulnerabilities and How to Combat Them Expert's advice on how to protect a web application against malicious attacks, accidental damage, and commonly known vulnerabilities in 2021. 44. The Best Practices for Web3 Security Risk Mitigation This article highlights the risks and vulnerabilities within the Web3 ecosystem and the best practices for Web3 security risk mitigation. Read on. 45. How To Fix The Most Common Linux Kernel Vulnerabilities The Linux kernel is widely considered the pillar of some of the most popular projects among the open-source community. As the central module of the O.S, the system’s stability, performance, and security rely heavily on the kernel. 46. What Is the Vulnerability Rating Taxonomy (VRT)? Developed and open-sourced by Bugcrowd, it’s a system designed to address the inherent shortcomings of CVSS ratings when viewed in isolation. 47. How To Block Security Vulnerabilities from Penetrating Your Code As continuous software deployments grow and become the accepted standard, security measures gain even more importance. From development and all the way through to production, security requirements should be adopted by all teams in an organization. 48. How a Supply-Chain Breach Put at Risk Atlassian Accounts On November 16, 2020 Check Point Research (CPR) uncovered chained vulnerabilities that together can be used to take over an account and control Atlassian apps. 49. The Powerdir  MacOS Bug Could Allow Attackers to Snoop On You The vulnerability allows malicious apps to bypass privacy preferences. Precisely, it could allow an attacker to bypass the operating system's Transparency, Cons 50. The Rise and Fall of APTR1 Exploit Jian Cyber weapons are digital and volatile by nature. Stealing them and transferring from one continent to another, can be as simple as sending an email. 51. How Should Companies Build a Robust Cybersecurity Culture? In the modern age of information and technology, there’s not a single individual or organization that would object to the tightening of cybersecurity within an enterprise. 52. Viewing K8S Cluster Security from the Perspective of Attackers (Part 2) This article will continue to introduce attack points on K8S Cluster security. 53. CVEs: How Keeping a Catalogue of Common Vulnerabilities and Exposures Helps Your Company CVE combines a dictionary and a catalog containing names for vulnerabilities and other information security vulnerabilities. 54. PCI DSS – Compliance Requirements and How to Meet Them Is your business involved in any type of payment card processing? Then you need to be aware of the PCI DSS requirements. In this article, we take a closer look at some of the requirements defined by PCI DSS and show how they can be met. 55. Over 35 Tech Companies Compromised in Novel Software Supply Chain Attack Security researcher Alex Birsan breached systems of over 35 tech companies in what has been described as a novel software supply chain attack. 56. Time Bombs Inside Software: 0-Day Log4Shell is Just the Tip of The Iceberg CVE 2021–45046, says the fix to address CVE-2021–44228 in Apache Log4j 2.15.0 was "incomplete in certain non-default configurations." 57. Top 10 C++ Open Source Project Bugs Found in 2019 Another year is drawing to an end, and it's a perfect time to make yourself a cup of coffee and reread the reviews of bugs collected across open-source projects over this year. This would take quite a while, of course, so we prepared this article to make it easier for you. Today we'll be recalling the most interesting dark spots that we came across in open-source C/C++ projects in 2019. 58. What Vulnerabilities FreakOut Takes Advantage of for Creating a Botnet Check Point Research encountered several attacks that exploited multiple vulnerabilities, including some that were only recently published, to inject OS command Thank you for checking out the 58 most read stories about Vulnerabilities on HackerNoon. to find the most read stories about any technology. Visit the /Learn Repo

58 Stories To Learn About Vulnerabilities

Working in cybersecurity can be a very fulfilling career, but most jobs require some amount of experience or formal training. While there are many great courses and certifications for learning pen-testing out there, it might be the case that they are simply above your budget. But that is totally fine. I think it is still possible to get job-ready knowledge about and pen-testing from free resources. cybersecurity A little warning: While I feel like it is possible to spend no money on your way to the first pen-testing job, it is the case that some paid resources provide knowledge in a condensed and easy-to-digest form. Having access to those resources might accelerate your learning journey. So I will provide some recommendations on which of them are worth it and which are not. I also created a GitHub repo with free cybersecurity resources. Check it out, and feel free to add some: https://github.com/her0marodeur/awesome-free-cybersecurity A few words about my own career I got really lucky in terms of getting a job. My first contact with cybersecurity was back in my teenage years when I Googled “ .” That was back when there were no such resources as HackTheBox and TryHackme. So, a lot of the learning was more theoretical and, in general, kinda slow. How to become a hacker After I finished school, it was time to look for a job. I started out with a student job for a big software company. There, I had the opportunity to work with different security teams. During this time, I did my eJPT certification and got in contact with the internal pen-testing team. They provided me with the opportunity to do an internship and paid for my OSCP. After I finished my Bachelor’s degree, I got offered a full-time job as a pentester. As I mentioned, I got lucky, but I think there are a couple of takeaways from my own story: The demand for pen-testers is currently very high, so many companies are willing to train existing employees. So if you are already working for a company, see if they have an internal pen-testing or security team. The most important characteristics of a pentester (hacker) are willingness to learn and curiosity. Getting them does not cost a penny. One of the mistakes I made was focusing too much on the theory and not getting enough hands-on experience. This is really important, and you should try to get as much practice as possible. The role of certifications and degrees I know you probably want to get into learning right away, but I think we should have a brief discussion about this topic. There is a decade-long ongoing discussion about the difference between and which is better and a lot more. I don’t want to dive into all that stuff. certifications and degrees Generally speaking, a degree or a certification is a verifiable and easy way for employers to assess the skills of an applicant. The OSCP or a computer science degree does show that the candidate has skills and knowledge in a certain area. If you have to filter through hundreds of applications, they give a good orientation. But there are two big things to take into consideration: There are other ways of getting experience and knowledge. I have friends who have maintained Minecraft servers since they were twelve years old, and they have extremely good programming skills, even without having a degree. And their salaries are comparable to some seniors in the industry. Even tho there has been a huge interest in pen-testing in the last couple of years, the demand has skyrocketed as well. That means employers are not getting hundreds of applications. Many times, it is actually the case that pen-testers are getting many job offers just because they have a LinkedIn profile. Paid Certifications to avoid: For some reason, this is still seen as a good certification, but from everything I have heard, they provide a really dry course, and the exam requires you to memorize a lot of stuff. So you can save your money. Certified Ethical Hacker (C|EH): I did this one myself, and it was fun; the exam was really hands-on and enjoyable. The reason I don’t recommend it is that I don’t think it is really beneficial in terms of getting a job because I don’t feel like employers are valuing it. eLearning Security Junior Penetration Tester (eJPT): Paid Certifications you can do (if you have the money): I don’t hold this certification myself, but I did Heath Adams courses back in the day. The content is just great and really well explained. It covers a lot of topics. The exam is more relaxed than the OSCP, and it has industry recognition at the lowest price. Practical Network Penetration Tester (PNPT): The OSCP has its pros and cons, and I wouldn’t recommend that you take a loan to do it or bust your bank account. But in a situation where you can really afford to do it (considering money AND time), I have to admit it has a great course, and it is basically a job guarantee. If you want to learn more about it, check out my blog here: Offensive Security Certified Professional (OSCP): https://infosecwriteups.com/methodology-and-mindset-for-passing-the-oscp-d609592a7dcb Getting the knowledge To know where you should start, you have to know where you stand. It is a big difference if you already have fundamental IT knowledge or if you are coming from a different profession because it is absolutely necessary to understand basic computer science concepts like networking and how programs, web pages, and computers are built and running. Since I suspect that many readers of this article will have this knowledge, I will not talk too much about learning all that stuff. has some really cool courses to learn the basics, and I think installing your own web server and learning the basics of Python really helps a lot. There are also basic computer science courses on sites like . TryHackMe Coursera TryHackMe and HackTheBox As well as for basic knowledge, I think you should really start with for learning the basics of pen-testing; they have some really good paths for this. Sadly, some of them might be only accessible via a paid membership. I think the paid membership is really one of the best investments you can make because it is quite cheap and provides access to a lot of knowledge. TryHackMe If you are thinking about what kind of pen-testing (mobile, web, network, Red Teaming, etc…) to learn first, I suggest you go with web pen-testing because there are many resources about it, and when we talk about Bug Bounty later, most of the targets are available in this area. But if you feel like doing something else, do it; all of this is just my opinion. Additionally, to do the learning path, you should also do some of their boxes that don’t give you any hints about how to solve them. Also, check out for this; they also have some great boxes, but beware of their rating system. I recommend you really start with easy boxes. HackTheBox When solving boxes, I recommend you give yourself a time limit. I recommend something like this: If you don’t have the initial foothold after 30 minutes, you should check a writeup. Afterward, you try 30 mins for privilege escalation, and if you don’t get it, check the writeup again. It might be true that there is no writeup in a real pentest, but doing boxes is about getting as much knowledge as possible. Also, start pushing yourself as soon as possible and increase the difficulty. It may mean that you might need a write-up for almost every step, but it also means you learn something new with every box. Free certifications: This one is a must-have. It is just the right mix between great course content and realistic and challenging exercises. APISec University: This one is not really about pen-testing but covers a lot of the basics of cybersecurity. But these topics are important for pen-testers as well because they always have to see the bigger picture of cybersecurity. The course and exam are free, but it requires an annual maintenance fee. ISC2 Certified in Cybersecurity (CC): : Another one that is not directly about pen-testing. It explains one of the essential policies of cybersecurity, and employers would like knowledge about this one. Skillfront ISO/IEC 27001 Information Security Associate™ If you love certifications as I do and want some more for free, please check out my GitHub Repo over here: https://github.com/her0marodeur/awesome-free-cybersecurity Getting the experience By now, you already hacked some machines and websites, but all of them were in a simulated environment and left vulnerable by design. While this provides valuable experience and gives you the ability to learn how to exploit vulnerabilities, it is not necessarily the experience employers are looking for. Therefore, I recommend you try your skills against some real-world targets (in a legal way). Luckily, Bug Bounty platforms allow you to do this and maybe earn some money. Bug Bounty Platforms You can check out the following platforms: https://www.bugcrowd.com/ https://www.hackerone.com/ https://www.intigriti.com/ https://yeswehack.com/ Look at their programs and get familiar with the general topic of Bug Bounty (try to avoid the Twitter and Medium hustler bubble; there is some really bad stuff out there). I suggest you start by looking at Katie Paxton-Fear’s stuff ( ). She has some great videos that are really for beginners. But don’t stress too much about all of it; sign up for a platform, pick a program, and hunt. This is what life as a pentester is going to be like. Also, be careful and don’t bother too much about all of the tools, oneliners, and scanners. Learn about the recon fundamentals ( ) and start hunting. https://insiderphd.dev/ https://www.youtube.com/watch?v=krCsMZfbuB4 If you get one or the other bug, it is great for your CV because it shows you know how to apply your pen-testing knowledge to real-world targets. Synack Red Team https://www.synack.com/red-team/ This one really depends on how much time you want to spend before getting a job as a pentester. I am not part of it, but I heard really good stuff about it. It basically is a closed Bug Bounty platform, but they additionally offer some fixed pay jobs like checking default credentials or OWASP Top 10. However, you have to apply to them, and this process can take a while. But it gives you the chance to have some experience with a real-world job application. It offers great hands-on experience and looks good on your CV. So check it out and see if it is for you. Getting the job If you are following this blog (btw. please read more resources than just this one; there is a lot of great career advice out there), I hope you don’t think of it as something that has to be done in chronological order. You can skip things and do them in parallel, or however it feels right for you. Writing a CV Before you go out and look for a job, you should write a CV. This really should focus on showcasing skills that you can apply to your pen-testing job. So if you have worked in another job, think about how you can translate the skills you gained to pen-testing. If you are a programmer, tell them you have a deep understanding of technology and for sure you had to implement security measures in your code, and probably you know how developers think and fail. If you have worked as an executive assistant, you have probably done a lot of writing and have clear communication skills, which is also really beneficial for pen-testing. By now, you have done at least some certifications and courses, but be careful what you include in your CV. I think, if you have done the three free certs I mentioned, you should include all of them, as they really showcase skills and knowledge needed for your job. But you want to be careful not to include every little thing. Rather than including the certificate of completion for every TryHackMe track you did, you should just include your TryHackMe profile. And for bug bounty profiles, you only want to mention the sites where you have at least one accepted submission. If you put too much basic stuff in there, it probably seems desperate. For writing the actual CV, you should not get too creative. It is best to either download a Word template and fill it in with your experience and skills or use one of the online generators (consider privacy implications). Be aware that your CV is often times read by machines, so make it “machine-readable.” Getting yourself out there Being visible can be really helpful if you want to get a job. I think having a is crucial. So create one, put a nice photo and some experience on it, and maybe include “aspiring pentester” in your bio to make yourself visible when recruiters search for possible candidates in this area. well-maintained LinkedIn profile You can also do a little bit more to increase visibility. A nice thing to do is to start a blog. Like this one, you are just reading. Even tho you might not have a lot of expert knowledge; you can talk about your journey and experiences or write a tutorial for a tool or a writeup for a box you did. But please don’t go down 1337 Hacker Road. I don’t think that blogs like “Hack a webcam with only three steps,” “Hacking Instagram password,” and other clickbait help find employment. Other things you can do are contribute to GitHub projects (for example, Nuclei and Spiderfoot allow you to contribute new rules and templates), create your own tools, or speak at a conference. All of these things will increase your network and look great on a CV. Applying for jobs Go for quality over quantity. The job has to be a match for you as much as you have to be a match for the job. So, really try to find jobs that match your expectations. While I say that, it is also true that it is probably easier to pivot from one pen-testing job to another than getting into the industry, but I feel bad advising anyone to take a job they don’t enjoy. I highly recommend you reach out to recruiters/headhunters. You can easily find them on LinkedIn, add them to your network, and ask if they have a role that fits your profile. It will not cost you a penny because the employers are paying them. They will also be a big help with streamlining a lot of the process. They know their clients and where you have a good chance of getting hired and, most of the time, allow you to skip steps like writing a cover letter. Even if they are not able to offer you something right away, they will add you to their contact list and reach out in the future. Interviews There are just better resources than I am, so I will link to them: The Cyber Mentor- Mock Job Interview: https://www.youtube.com/watch?v=IDpjaS6OYPU The Cyber Mentor — What to Expect in an Ethical Hacking Job Interview: https://www.youtube.com/watch?v=nrewE1mLlaU Security Interview Questions: https://github.com/justinltodd/security-interview-questions Conclusion While it should be entirely possible to get a pen-testing job without spending a dollar, it will still require a lot of work. Spending at least some money can make the process if you spend it right. I also have to mention that all of this is just my personal experience and perspective. Your mileage may vary. If you liked this blog post, you can follow me on Twitter @Secbyaccident or read my other stuff over at . https://security-by-accident.com/ And if you have read this far, I want to offer you a little Thank You. My DMs on Twitter are open, and you can reach out to me if you want me to review your CV, help you with some studying, or set you up with some recruiters. I will do all of this for free, but expect a little delay in response time. Also published here.

Cybersecurity Job Hunting, Pen-Testing Study Plans, and Certifications on a Budget

In the world of engineering, there are many different ways to rate the severity of a vulnerability. The most common way is to use the Common Vulnerability Scoring System (CVSS). However, there is also a newer system called the Vulnerability Rating Taxonomy (VRT). Developed and by , it’s a system designed to address the inherent shortcomings of CVSS ratings when viewed in isolation. open-sourced Bugcrowd The result is a method in which vulnerabilities are prioritized, simplifying most of the vulnerability management process. Here's a look at how these two systems compare. What Is a “Vulnerability Rating Taxonomy”? The term "vulnerability rating taxonomy" is one that has been batted around for quite some time. In theory, it's a great way of encapsulating something very complex - categorizing vulnerabilities according to severity and threat level. But in practice, understanding what the taxonomy covers can be an adventure akin to Herculean labor! Ultimately, it gets down to a classification system that puts vulnerabilities into descriptors based on the extent of their danger. Think of it like sorting apples from oranges; shorthand descriptions to help differentiate between them. Once understood, the taxonomy provides an invaluable tool for prioritizing security patches and deploying resources efficiently. So, do yourself (and your IT team) a favor and take the time to familiarize yourself with such vocabulary, so you can control the chaos! How Is the Vulnerability Rating Taxonomy Is Used? The vulnerability rating taxonomy is an important tool for security professionals. It's the go-to source to identify and evaluate a system's weaknesses, as well as strategize mitigation options. This comprehensive rating system is designed to not just rank, but also categorize common vulnerabilities found in systems. Essentially, it brings order to chaos and gives security staff the much-needed insight into potential security issues so they can develop an effective risk management plan. To top it off, this system can be gradually adapted to account for new threats or advances in technology. In other words, the vulnerability rating taxonomy allows us to stay one step ahead of the bad guys - not a bad way to stay safe should we say! What Are the Benefits of Using a Vulnerability Rating Taxonomy? Using a vulnerability rating taxonomy can feel daunting at first, but it's worth the effort. While there's a lot to learn if you don't have experience with this type of system, its advantages greatly outweigh any initial hangups. Once you are familiar with the organization and language of a vulnerability rating taxonomy, it makes assessing the risk associated with security issues much easier than before. Not only that but going through the process increases accountability within an organization and helps prevent important details from falling through the cracks. So, while investing time and energy in understanding vulnerability rating taxonomies may sound like a drag, it's really just another way of protecting your stuff - so pull up your socks and get started! Are There Any Drawbacks to Using a Vulnerability Rating Taxonomy? While a vulnerability rating taxonomy can be a great way to organize the various cybersecurity threats you face, it's not perfect. These systems help us make sense of what can often seem like a jumble of different levels and kinds of security threats; however, they can also lead to oversimplification. By reducing our understanding of vulnerabilities down to two or three categories, it becomes harder to account for the nuances and complexities that security threats present. In addition, if we rely solely on these systems, we may spend too much time labeling certain vulnerabilities instead of researching new mitigation techniques or performing important updates. So, keep your eyes open and stay alert--there are both advantages and drawbacks to using vulnerability rating taxonomies! How Can You Create Your Own Vulnerability Rating Taxonomy? Crafting a custom vulnerability rating taxonomy can be an arduous task, but it can also be quite rewarding! Think of it as designing your own suit from scratch - you get the exact product that meets your specifications. The first step is creating a classification system, defining what parameters will generate the ratings for your particular vulnerabilities. The next step requires some introspection - where does your organization draw “the line?” Determining what severity of risk exposure is acceptable and which is unacceptable will create the framework to accurately rate each potential security breach. And that's all there is to it! With some careful thought, you'll have yourself a fresh set of tailor-made vulnerability ratings in no time. Vulnerability rating taxonomies have become increasingly important tools in the world of cybersecurity in recent years. With the ability to help you quickly assess the risks that your organization could be facing and take steps to address those risks, they are invaluable assets for any business. While creating one can seem daunting, it's definitely doable if you break down the process into small, achievable tasks. Additionally, staying up-to-date on threat intelligence is a great way to build out your taxonomy and remain proactive about risk mitigation. In an ever-changing digital landscape, having a comprehensive vulnerability rating taxonomy is essential for comprehensive risk management and resilience.

What Is the Vulnerability Rating Taxonomy (VRT)?

Open Bug Bounty Community https://www.openbugbounty.org/bugbounty-list/ The complete list of bug bounty and security vulnerability disclosure programs launched and operated by open bug bounty community. Resources — Disclosure Email, Website security page, Number of reports fixed. BugCrowd bug bounty list https://www.bugcrowd.com/bug-bounty-list/ The most comprehensive, up-to-date crowdsourced list of bug bounty and security vulnerability disclosure programs from across the web curated by the hacker community. Filters — Program Name, Bug Bounty eligible, Swag, Hall of Fame, Submission URL, Safe harbor. Project Discovery Chaos web program list https://github.com/projectdiscovery/public-bugbounty-programs The JSON file includes the public bug bounty programs listed on . chaos.projectdiscovery.io { "name":"HackerOne", "url":"https://hackerone.com/security", "bounty": true, "swag": true, "domains":[ "hackerone.com", "hackerone.net", "hacker101.com", "hackerone-ext-content.com" ] } Disclose DB program list https://raw.githubusercontent.com/disclose/diodb/master/program-list.json A true, community-powered, vendor-agnostic directory of all known VDP and BBPs, contact details, policy location, preferred languages, and the status of Safe harbor, Availability rewards, hall of fame, swag, and Disclosure policy. FireBounty https://firebounty.com/ Government VDPs https://github.com/cablej/hack-your-government Vulnerability disclosure policies and bug bounty programs are becoming standard across industry and government. Beginning with the U.S. Department of Defense, several government agencies worldwide have implemented vulnerability disclosure programs. This is a list of government agencies that have bug bounty programs or vulnerability disclosure policies. Note: This list is not an invitation to hack any of the listed organizations. Ensure that you comply with all listed terms of an organization’s vulnerability disclosure policy. Includes details about — Organization, Type, Rewards, Link, Notes. Google dorks List https://github.com/sushiwushi/bug-bounty-dorks List of Google Dorks to search for companies that have a responsible disclosure program or bug bounty program which are not affiliated with known bug bounty platforms such as HackerOne or BugCrowd. If you found this article helpful 👇🏻 https://buymeacoffee.com/sam5epi0l Comment your queries. Check out other articles. Open terminal — https://sam5epi0l.github.io/ Also Published here

Top Bug Bounty Programmes You Can Participate in Today

Today, we live in an era of innovation and technology. Information technology has been rooted in our daily lives and every aspect of our life is dependent on technology in one way or another. Software engineers play a prime role to further this tech wagon. Software development is a vast field with plenty of job opportunities all around the world and the freelance market makes up a major portion of the IT business. According to statistics, 37% of Americans are involved in some sort of side business one way or another. However, still, many engineers remain exclusive of the benefits that side hustles offer. Diversity of Side Hustles Software development is a vast field with many possibilities available depending on the route that you take. Each side hustle needs a different set of skills and each has its own pros and cons. We have sifted through the many available possible side hustles and have selected the best out of these. Let’s take a look at some of these . side hustles for software engineers 1. Take on the Freelance Market According to a survey, there are 57 million freelancers in the world, 86% of whom work from home. Freelancing has been active in the tech sector for quite a while but saw the ultimate boom during the pandemic. The COVID pandemic led to a complete shutdown of office culture all over the world with employers telling their employees to work from home. Despite the initial shock, this situation answered a much-asked question, “ ”. Well as it turned out we don’t. Almost all the work shifted to online platforms with many people opting to work in the freelance market as a side hustle. Do we really need offices to work? The freelance market lets you choose not only the type and scope of work you want to do, but also the time of work. These features along with competitive prices led to many software developers and engineers leaving their current jobs and shifting to freelance as a full-fledged career. Let’s take a look at some of the pros and cons of the . freelance market to get a deeper insight Pros – You get to decide the type of project. Flexible Scope of Work – Get better checkout rates than your market salary. Competitive Rates – Choose when you want to work, and where you want to work. Flexible Timings Cons – Freelance sites usually keep a certain percentage of your earnings. Company Share – Finding clients can be hectic for new users. Finding Clients – You don’t get paid vacations and leaves. Solo Commitments , and are some of the most renowned freelance sites with millions of freelancers using these each day. Fiverr Upwork Guru 2. Try Bug Bounty Hunting Bug hunting is termed the hunting sport of the software realm. Bug hunting involves going through the coding of software to find bugs and errors. This leads to refined code as software vulnerabilities and errors get weeded out. Many Fortune-400 tech companies like Facebook and Twitter host bug bounty events where they hire hundreds of software developers all around the world. Let’s take a look at the pros and cons associated with bug bounty hunting in order to fully assess this work as a suitable side hustle. Pros – Chance to get higher payouts depending upon the severity of the bug. Fortune Bugs –You contribute to the market as a white hat hacker. Ethical Hacking – All you need to get started is a laptop and internet connection. Remote Work Cons – You don’t get paid unless you find bugs Unstable Profits – Ethical bug hunting is a highly competitive work with many hackers working to find the same bug. Competitive Market – Hacking competitions usually have fixed start and end dates. Schedule of Work and are some of the most used sites by software developers for . Many software companies also offer open bug-hunting invitations where users get paid for each bug reported. BugCrowd Cisco bug bounty hunting 3. Mentor other Developers Software development is a skill that needs years to master. The tech market values individuals with unique skill sets. to master their skills and practice until they gain profound knowledge of the field. However, there are many developers who are just starting their coding careers. These new developers need guidance as they climb the tech ladder and the experience and impact of a veteran coder with a unique set of skills may just be the much-needed light. Development mentoring has its own pros and cons that need to be discussed here. Software developers work Pros – Choose when you want to work, and where you want to work. Flexible Timing – You get the price you ask. Flexible Rates – You get a continued source of income. Stable Income Cons – You cannot pursue a career in teaching if you don’t have the right mindset. Teaching Mindset – You need to find students to teach during the early days of your career. Finding Clients – You will teach the same thing over and over again. Learning Hiatus Experts in the trade usually share their achievements and findings in the form of online portfolios to attract possible leads and students. Blogs and professional platforms are a great way to get started. Final Words If you’re a software engineer who is looking to invest his time in building multiple sources of income, these side hustles are a perfect start for you. However, each of these tasks requires a specific set of skills, and it is up to you to choose the one most compatible with your taste. There are many other side hustles available in the market today other than these, so take your time, build your portfolio, and get started since the possibilities are endless.

An Insight into Side Hustles for Software Engineers

With the rise of the Gig Economy throughout the late 2010s, the phrase “side hustle” has firmly planted itself in our daily vocabulary. Considering that , nothing is stopping you from also stepping up to the plate. In this article, I’ll be covering the 5 best side hustles for software developers, detailing how you can use your existing skillset to generate extra money each month. 37% of Americans already have a side job If you’re a software engineer, you have a valuable skillset that you can mobilize to create a side hustle that allows you to make money online, cultivate an additional stream of income, and make progress towards financial freedom. Be sure to read to the end, as I’ll be discussing the best side hustle last! What are the Best Side Hustles for Software Developers? While there are many side hustles that a software developer can decide to pursue, each of them offer their unique set of pros and cons. The 5 side hustles I’ve selected range across active and passive income sources, letting you select whichever works best. I’ll be discussing the following side hustles: Freelancing Bug Bounty Mentoring Selling code/themes Micro-SaaS Apps Let’s take a look at each of these in more detail. Freelancing There’s a reason that the total number of freelancers in the US has increased from . Especially over the recent pandemic, more and more people are flocking to this flexible side hustle. 53 million in 2014 to over 59 million in 2020 Freelancing is one of the easiest side hustles to begin, and one that can scale into a fully-fledged career. Considering that freelancing has no minimum or maximum hourly cap each week, you’ll be able to do as much or as little of this side hustle as you’d like, allowing you to fit this into your weekly schedule. If you’re looking for an extra few hours of work after your 9-5, or maybe to even fill your Saturday with freelance projects, you’ll have the flexibility to do so. As a freelance software developer, you’ll mainly be finding projects through Freelancing job sites like and . These allow you to quickly set up a profile and advertise your services. Depending on your particular skill set, the actual content of the tasks you’re involved in may vary. Upwork Fiverr Benefits of freelancing as a software developer: choose your hours. Flexible schedule – work from anywhere. Location-independent – – experience a number of different technology stacks working for a number of clients. Project variety Downsides of freelancing as a software developer: paid per hour work, income constrained by available time. Money is capped – finding new contracts can be difficult, especially in the early days. Clients – – if you’re sick or unable to work due to family issues, you don’t get paid. No work, no pay Bug Bounty Bug Bounty is a side hustle in which a software developer will look for bugs within a person or company’s code. Your primary aim will be to uncover any vulnerabilities in the code, looking for exploits or errors. You’ll be paid for any bugs that you uncover, working quickly to discover as many as possible before other software developers find them. There is a range of Bug Bounty programs, both public and private. However, if you’re just getting started with this side hustle, I’d recommend you try out . Bugcrowd Benefits of Bug Bounty: one hacking event garnered over . Chance for substantial payouts – $1 million in payouts to several hackers as long as you have internet, you can work from anywhere on the planet. Location freedom – your work goes to improve software security and ensures that millions of users’ accounts are safer and more secure as a result. Ethical Hacking – Downsides of Bug Bounty: if you’re not the first to find a bug, you don’t get paid. This generates a great deal of income instability. Instability – you’ll be working against other hackers, seeing when they discover bugs before you. This can lead to burnout and frustration. Comparison and Burnout – – if these bug bounty competitions have a start/end date that don’t work for you, then it’s likely you’ll miss out on the income opportunity. Schedule concerns Mentoring It’s undeniable that software development is a valuable skill. Just like any other skill, it must be cultivated over time, a developer refines their skillset until they have thorough knowledge and experience of the field. If you are particularly skilled in the area of software development, you’ll be able to offer your services as a mentor, helping people learn or improve their own skills. There are a variety of platforms to mentor on. If you’d like to stay online and increase the convenience of this side hustle, then or are great places to get started. CodeMentor SuperProf Benefits of Mentoring: you decide your own rate. Rates – you decide when you’re available to mentor. Time – after finding a pool of students, you’ll have a stable additional income. Consistent – Drawbacks of Mentoring: no matter how fantastic you are at coding, if you aren’t a particularly gifted teacher, you may struggle. Teaching Skills – you’ll have to find students and get reviews under your belt before having a stable income. Slow beginning – – unfortunately, mentees in need of a mentor with your skillset aren’t available on tap. As such, you’re best not to rely on this as a primary income source. Unpredictable demand Selling Custom Themes for Shopify as A Side Hustle With the incredible over the last several years, custom themes for Shopify have never been in higher demand. If you’re looking for a lucrative source of additional income, then building these templates and themes can work fantastically. boom of eCommerce The backbone of Shopify themes is the programming language Liquid. If you have knowledge of Liquid or learn how to code in this language, then you can begin to build custom Shopify themes. There are two main ways you can go about this. The first is creating themes and then listing them on the Shopify store for others to buy. This will create a recurring source of passive income, as you create something once and sell it many times within the listings. Alternatively, you can combine these skills with freelancing, offering your services on a contractual basis and coding custom themes for businesses that request them. Either one of these can work wonderfully as a side hustle, allowing you to gain an additional income stream alongside your day job. Benefits of Selling Shopify Themes: many people seek a way to have their store stand out. High Demand – this is a true source of passive income if you list your builds on the Shopify store for users to purchase. Build It Once, Sell to Many – there’s great documentation for Shopify’s programming language Liquid and you can have your first theme knocked out in just a few hours. Easy to get started – Drawbacks of Selling Shopify Themes: there’s no guarantee that users will buy your theme, which in turn would mean you’ve wasted your time. Uncertain – people may copy your themes and then undercut you. It’s difficult to protect your intellectual property. Copycats – – imagine if you’d invested months into the building and maintaining several themes only for the Shopify platform to lose popularity or worst still, go bust! Ecosystem reliance Building a Micro SaaS Application Finally, we arrive at the crown jewel of side hustles for software developers. are subscription-based apps that users buy to solve a specific problem in their niche. Just like SaaS (software as a service), they benefit from the concept of “build it once, sell to many”. Micro SaaS apps By creating a Micro SaaS application, you’ll be able to list your product on the market, collecting recurring payments as your userbase is billed monthly or annually. Micro SaaS apps are completely scalable, meaning you can start this out as a side hustle, before then turning it into a stream of passive income that is large enough for you to quit the corporate 9-5 (this is exactly ). what I have done! One of the core characteristics of a solid Micro SaaS application is that it directly solves a problem. Due to this, people will continue to subscribe as your application actively makes their life easier, providing them value on a continual basis. While the seeds of building a Micro SaaS app begin as a side hustle, this pathway can become so much more, eventually leading you to complete financial freedom. But that’s not all; there is a range of benefits of micro SaaS apps that you can capitalize on. This is by far one of the very best ways of earning additional income as a software developer. Benefits of Micro SaaS Apps: you are no longer being paid per hour, but rather for the result of your efforts in building a great product. As such, it’s not uncommon for solo developers to generate disproportionately large monthly incomes ($10k - $100k monthly recurring revenue). Disproportionate Income - instead of starting at zero each month as you do in other side hustles, you build upon both the existing subscriber base and the app’s features each month. Compounding Results – – it’s just your spare time you’re risking. Minimal Start-up Costs Drawbacks of Micro SaaS Apps: If you build your app on a platform, your own success is tied to that platform's ecosystem. If the system fails or declines in popularity, your app will also suffer the consequences. If you’re just building your own app rather than a plugin then you’ll be protected from this reliance. Reliance on Ecosystems – if people see your app gaining popularity, they may launch a competing product. Minimise the effects of copycats by obfuscating your code and offering a great customer experience so they won’t need to look elsewhere. CopyCat Potential - – you better be good at multi-tasking as you’ll need to wear many hats. Ranging from programmer to project manager, marketer, support agent, finance manager, etc. Multi-tasking Mayhem Final Thoughts If you’re looking to earn additional income as a software developer, then any one of these 5 side hustles is worth pursuing. You’ll be able to make money online, receive a recurring income, and perhaps even make enough to quit your 9-5 software engineer job. Out of the five software developer side hustles I’ve listed, I highly recommend you look into creating Micro SaaS apps. It is by far the most rewarding side hustle as it utilizes the coding skills you have and offers the additional benefits of location, time, and financial freedom. What more could you need! Not sure where to get started? Take a look at my free 12 chapter , which will walk you through the entire process of bootstrapping your first SaaS from idea to exit. Micro SaaS Handbook First Published here

Stories, News & Mentions about BUGCROWD

Bugcrowd’s Stories on HackerNoon

Bugcrowd's News & Mentions