How HackerOne Helps Ardoq Squash Bugs

Cybersecurity has to maneuver rapidly. Attackers solely want seconds to search out and exploit a vulnerability. As Forbes reported in 2021, a cybercriminal takes round 9.5 hours to acquire unlawful entry to a goal’s community. Each minute an organization fails to behave offers hackers an opportunity to trigger higher harm.

Ardoq is not any exception. As we scale and develop, our safety should additionally hold tempo to make sure our knowledge is protected. We have labored arduous to acquire and preserve our common SOC 2 attestation and ISO 27001:2017 certification. To place these defenses to the check, our CEO Erik Bakstad initiated Ardoq’s Bug Bounty Program in 2016.

This system, managed by HackerOne, is one among many steps in our safe improvement technique. HackerOne works with moral hackers to check their expertise by looking for bugs in our code in alternate for a “bounty fee” for his or her work. These hackers are totally vetted and subjected to fixed critiques, having dedicated to a stringent set of moral requirements previous to beginning any initiatives with HackerOne. Hacker-powered safety analysis is part of our safety lifecycle and is vital for our ongoing dedication to safety for our prospects.

Ardoq’s Bug Bounty Program

Cybersecurity is a vital a part of organizational technique. We leverage standard instruments, reminiscent of operating automated safety checks, as a part of our vulnerability administration technique. If these instruments aren’t in a position to detect high-risk and extra delicate vulnerabilities, we wish an additional degree of safety. Hacker-powered safety crowdsources the data and expertise of moral hackers to offer Ardoq with continuous safety testing. This system has additionally generated wonderful knowledge that permits us to measure the effectiveness of our safety actions. However how does it work?

All About Bugs

At Ardoq, we’re always growing and updating our code – adjustments that imply we will frequently enhance our product. After adjustments have handed our stringent inner testing, they’re launched into our manufacturing environments, giving our prospects essentially the most up-to-date model of our software program at any time when they entry our platform. 

Nevertheless, no code is ideal. Errors can creep in whereas builders are constructing and adjusting options. Such errors happen in a number of varieties and have completely different penalties, from needing easy fixes to extra problematic bugs that require pressing restore. For instance, a mistake within the code might make a quantity on a kind incorrectly present up as a date. A extra critical bug may inadvertently change the entry rights of somebody within the system and grant entry to info that’s protected or off-limits to them.

Safety bugs can threaten a system’s safety and create a “vulnerability.” Relating to vulnerabilities, the stakes are excessive. Simply how excessive relies on how the vulnerability is categorized; that is usually based mostly on how straightforward it’s for somebody to use it and the way a lot harm that will trigger.

The Bounty

That is the place the bounty a part of our Bug Bounty program is available in. This system allows us to have an ongoing course of to search out, establish, and repair vulnerabilities that may inevitably seem in all methods. 

Since launching this system in 2016, Ardoq has provided ranges of rewards or “bounties” to hackers who will help us discover issues in our methods. These are awarded proportionate to the extent of danger introduced by the bug that they discover. So whereas some are simply “good to know” and don’t current any rapid hazard, different bugs might pose a better danger.

Though hacking will be enjoyable and rewarding, it takes ability and time to check massive advanced platforms correctly, so we really feel moral hackers deserve their “bounty” as a reward for this work. In spite of everything, it’s very important to establish and repair these bugs earlier than somebody with malicious intent tries to use them. 

Utilizing Bounties vs. Not Utilizing Bounties

For a lot of corporations, it may possibly really feel uncomfortable inviting moral hackers to take a look at their methods. You’re primarily inviting individuals to search out probably critical safety points in your software program. Nevertheless, it’s probably that there are already individuals on the market attempting to interrupt your methods, and never all of them could have good intentions. “Black Hat” hackers are always on the lookout for vulnerabilities in methods to use, generally to display their expertise, and generally to promote to others with probably bigger and extra nefarious motives through the darkish internet.

On the flip facet, “White Hat”, or moral, hackers are motivated to search out safety points to allow them to be mounted, and a Bug Bounty program offers them each a mechanism to report what they discover and a solution to be rewarded for his or her efforts. Whereas some corporations have mechanisms to allow moral hackers to reveal safety points responsibly, we imagine the bounty fee is an effective solution to incentivize and acknowledge the work of exterior specialists. Importantly, it additionally helps us mitigate our safety danger.

Guidelines of the Sport

With nice transparency comes nice accountability – this system has a coverage that tells hackers what they’ll and may’t do. HackerOne manages a specifically curated checklist of hackers to make sure that this system and hackers align with our ethics. In addition they assist us triage the reported bugs by reviewing what has been reported and validating that they’re actual vulnerabilities. 

This system’s construction offers us a filter that permits us to discover vulnerabilities and assess their severity via Ardoq’s inner processes. When a hacker experiences a medium or excessive vulnerability subject, HackerOne will examine it for us and filter out a number of the noise that may include having a public program. 

Attending to the Root of What We Can Enhance

Having moral hackers check our code occurs after we’ve already subjected it to a number of inner checks earlier than it’s deployed into our manufacturing atmosphere. This exhibits us how effectively our engineering course of is working and permits us to establish methods to enhance.

Root Trigger Evaluation

We encourage openness in our engineering crew and supply a protected area for individuals to debate what we will enhance. When a big bug is discovered, we invite everybody to sit down down and speak via what the hacker was in a position to do. Generally we apply one thing just like the “5 Whys” methodology: we hold making use of “why” questions till we now have a root trigger. As a fictional instance:

• Why had been they in a position to do X? 
• ⇢It is as a result of this piece of code allowed them to.
• Why did that piece of code permit them to do it? 
• ⇢As a result of the code assumed that in the event that they acquired to right here, they need to have been allowed to do it. 
• Why does it make that assumption?
• ⇢As a result of it relied on outdated authorization logic that ought to have been up to date throughout a current refactoring effort.
• Why did we not replace the authorization logic throughout refactoring? 
• ⇢As a result of we missed it whereas testing.
• Why did we miss it throughout testing?
• ⇢As a result of our check suite doesn’t cowl the sort of use case.

Within the above instance, an affordable name to motion could be to make sure we replace our automated exams to at all times examine that the authorization logic is appropriate (i.e. regression testing). To keep away from an analogous subject from popping up elsewhere, it additionally is sensible to take the learnings from this bug and apply it in different situations it’d come up.

Utilizing the Bug Bounty Program for Uncover

Once we launched our Uncover module earlier this 12 months, we ran a particular marketing campaign to draw extra bounty curiosity. We invited our HackerOne group to focus on our new Uncover options. In return, we might give them a bonus as a part of our bounty funds. Though no critical points had been uncovered, we nonetheless discovered it a rewarding expertise.

The comparatively small variety of points reported is each a credit score to Ardoq’s builders and our safety consciousness, and proves the worth of getting daring methods to method our safety. We additionally discovered that researchers who maybe hadn’t checked out our platform earlier than got interested, which we hope will result in extra engagement.

Utilizing the Bug Bounty program has improved how we steadiness the pace of our developments whereas sustaining a excessive degree of safety for our prospects. As well as, this system permits Ardoq the flexibility to repeatedly monitor our safety by leveraging the facility of crowd-sourced and moral hacking. This system has empowered us by driving our safety analysis and contributing to the general energy of our safety lifecycle. 

Need assistance with uncovering hidden safety dangers? Find out how an EA resolution can maintain your enterprise’ cybersecurity danger evaluation.