Author:
Becky Bracken
May 14, 2021

Experts from Intel, GitHub and KnowBe4 weigh in on what you need to
succeed at security bug-hunting.

Zero-day disclosures, those known bugs without a fix, can have
potentially catastrophic results. One of the best ways to combat them is
by discovering them before the bad guys do.

Some of the biggest tech brands on the planet have been pummeled by a
rash of high-profile zero-day exploits. In the past handful of weeks,
Apple announced a patch for its MacOS bypass bug and rushed four
out-of-band fixes for zero-days under active attack; Chrome’s zero-day
was posted on Twitter in mid-April; and of course the Microsoft Exchange
zero-day attack is still fresh.

Threatpost invited zero-day experts to dig beyond the headlines,
including Katie Trimble-Noble, the former DHS official who runs Intel’s
bug-bounty program; Greg Ose, who runs GitHub’s bug-bounty program, and
James McQuiggan, a security awareness advocate for KnowBe4.

During the conversation, the panel discussed the lifecycle of a zero-day
vulnerability, the inner workings of bug-bounty programs and tips for
researchers looking to break into big-time bug hunting. They even threw
in a couple of predictions for good measure.

The entire conversation, on the Economics of 0-Day Disclosures: The
Good, Bad and Ugly, was recorded and can be viewed in its entirety
on-demand for free.

https://threatpost.com/how-to-bug-bounties/165657/

--
David B.