SecurityBrief Asia - Technology news for CISOs & cybersecurity decision-makers

Bugcrowd partners with Least Authority for security boost

The latest look inside the minds of professional hackers using the Bugcrowd platform reveals that AI is increasingly becoming a tool, target and threat.

New Cybersecurity Warning As 1,000 Elite Hackers Embrace AI

In addition to Google's new bug bounty program, announcements this week around generative AI also include an upcoming Biden administration executive order, as well as studies by OpenAI and the United Nations.

Google launches AI bug bounty program as organizations plan to study risks

Kantata has announced that Concurrency, Inc., a Wisconsin-based IT consulting firm, a ServiceNow partner and a Microsoft-based systems integration partner, is successfully using its... Outreach has announced the appointment of Abhijit Mitra as its new ...

Dave Gerry, CEO of Bugcrowd

Bugcrowd has reported significant customer growth in the last year. The company has seen growing demand for its crowdsourced cybersecurity platform. It

Bugcrowd experiences continual customer growth

At Dreamforce, Enterprise Times sat down with Andres Restrepo of Klient to talk about the PSA company and Dreamforce. We met at the Canada Lodge, a hotel that had been taken over by Canadian organisations within the Salesforce ecosystem. Restrepo only ...

A conversation with Klient

Company helping to protect data and environments of top brands including Rapyd, ExpressVPN and T-Mobile SAN FRANCISCO, Oct. 10, 2023 /PRNewswire/ -- Bugcrowd, the only multi-solution crowdsourced ...

Bugcrowd Announces Rapid Growth of Customer Base Year Over Year

SAN FRANCISCO, Oct. 10, 2023 /PRNewswire/ -- Bugcrowd, the only multi-solution crowdsourced cybersecurity platform, today announced significant global customer momentum, highlighting the market ...

Bugcrowd

bugcrowd

Today, announced a $6M Series A financing, led by Costanoa Venture Capital, with participation from existing investor Rally Ventures. As part of our investment, I have also joined Bugcrowd’s board of directors. Bugcrowd . In the short time since then, a number of large-scale breaches have occurred, including and . The problem continues to get worse, and companies are scrambling to protect themselves with the latest and greatest technologies. This problem has produced several notable startup successes including Palo Alto Networks, Splunk, and FireEye. However, despite their increased vigilance and spending on , there is one problem that chief information security officers (CISOs) can’t buy their way out of: talent. There are more than . I wrote about our interest in security in October the famous ‘Sony Hack’ a massive online bank robbery security technology 200,000 unfilled cybersecurity jobs and open job postings have increased by 74% over the past five years Pioneered by Netscape, and refined by large web companies like Google and Facebook, bug bounty programs have emerged as a way for security teams to leverage talent outside of their companies, and continue to gain mainstream adoption. By offering financial rewards to security researchers who discover vulnerabilities in their systems, organizations are able to harness the power of crowdsourcing to have more security experts, working on their behalf, exactly when they’re needed. While these programs have been in existence amongst large web companies for some time, running such a program has been very difficult for “the other 99%” of companies until very recently. Bug bounty programs not only require a unique software platform, but also the resources and expertise to review and process the high volume of submissions that a well-run program will generate. This is why Costanoa is absolutely thrilled to be partnering with Casey, Chris, and the rest of Bugcrowd team. Already counting Pinterest, Blackphone, Western Union and Aruba Networks among its customers, Bugcrowd gives companies of any size the ability to run bug bounty programs, and access to their globally distributed team of 15,000+ researchers. They have built a unique, end-to-end platform offering a turnkey solution for running and managing bug bounty programs, while also curating a diverse community of security researchers that are intelligently matched with companies based on their specific expertise. We are very excited about the profound impact that Bugcrowd is having on the security industry, and look forward to building a great company together. If your company is interested in getting started with a bug bounty program, learn more and get started . here For more information, read the press release . here By: Neill Occhiogrosso and Bucky Moore

Our Investment in Bugcrowd

Cybersecurity is vast and exciting, and bug bounty hunting is one of its most rewarding paths. Imagine being paid to find security flaws in websites and apps—yes, that’s what bug bounty hunters do! If you’re curious about how to get started in this field, this guide is just for you. Prefer watching instead of reading? Here’s a quick video guide Prefer watching instead of reading? Here’s a quick video guide https://youtu.be/MlUWfVSzTbk?embedable=true https://youtu.be/MlUWfVSzTbk?embedable=true What is Bug Bounty Hunting? Bug bounty hunting is the activity of discovering and reporting security flaws in software, websites, or mobile applications for rewards, or "bounties". Businesses operate bug bounty programs on platforms such as HackerOne, Bugcrowd, or Synack, inviting ethical hackers to test their systems. If you discover a vulnerability that qualifies, you can earn money, fame, or even job offers! Who Can Become a Bug Bounty Hunter? You don't require a computer science degree or a professional hacker background to dive in. Anybody with curiosity, patience, and the willingness to learn can be a bug bounty hunter. A lot of successful hunters are self-taught. You'll just need: Basic knowledge of web technologies (HTML, JavaScript, HTTP, etc.)
A strong learning attitude
Time and commitment Basic knowledge of web technologies (HTML, JavaScript, HTTP, etc.) A strong learning attitude Time and commitment Why Do Companies Offer Bug Bounties? Despite having good security teams, no software is ever 100% secure. Bug Bounty Programs: Identify hidden vulnerabilities before attackers do
Promote ethical hacking
Enhance product security
Save millions in breach costs Identify hidden vulnerabilities before attackers do Promote ethical hacking Enhance product security Save millions in breach costs Most Common Types of Bugs You Can Discover Following are some of the most prevalent vulnerabilities bug bounty hunters hunt for: Cross-Site Scripting (XSS) This occurs when an attacker injects malicious scripts into a website. If they succeed, they can steal cookies, session tokens, or other sensitive information. SQL Injection This exploit enables an attacker to disrupt database queries, and this might cause unauthorized access or data leakage. Cross-Site Request Forgery (CSRF) This scam manipulates users to do something they didn't intend to do, like alter account settings. IDOR (Insecure Direct Object Reference) When an application allows you to view or edit information (such as someone else's profile or invoice) by just altering an ID within the URL. Authentication/Authorization Issues Identifying vulnerabilities to enable users to log in under another user's account or access admin-level functionality. Tools Every Newbie Should Master You don't require a professional setup to get started. The following basic tools will suffice: Burp Suite: Most widely used tool for manipulating and intercepting HTTP requests.
Browser Developer Tools: Your browser's in-built developer tools (Inspect Element, Network tab) prove very useful.
OWASP ZAP: A free, open-source equivalent of Burp Suite.
Nmap: For scanning the network and discovery.
Google Dorking: Utilizing advanced Google search techniques to discover exposed information or vulnerable endpoints. Burp Suite: Most widely used tool for manipulating and intercepting HTTP requests. Browser Developer Tools: Your browser's in-built developer tools (Inspect Element, Network tab) prove very useful. OWASP ZAP: A free, open-source equivalent of Burp Suite. Nmap: For scanning the network and discovery. Google Dorking: Utilizing advanced Google search techniques to discover exposed information or vulnerable endpoints. Learning Resources for Beginners Begin with the fundamentals and work your way up. Here are some suggested resources: Free Learning Platforms: PortSwigger Web Security Academy (https://portswigger.net/web-security)
Hack The Box (HTB) Starting Point (https://www.hackthebox.com/)
TryHackMe – Web Fundamentals Path (https://tryhackme.com)
OWASP Top 10 (https://owasp.org) PortSwigger Web Security Academy (https://portswigger.net/web-security) https://portswigger.net/web-security Hack The Box (HTB) Starting Point (https://www.hackthebox.com/) https://www.hackthebox.com/ TryHackMe – Web Fundamentals Path (https://tryhackme.com) https://tryhackme.com OWASP Top 10 (https://owasp.org) https://owasp.org YouTube Channels: LiveOverflow
NahamSec
STÖK
HackerOne's official channel LiveOverflow NahamSec STÖK HackerOne's official channel Books: Web Application Hacker's Handbook by Dafydd Stuttard
Bug Bounty Bootcamp by Vickie Li Web Application Hacker's Handbook by Dafydd Stuttard Bug Bounty Bootcamp by Vickie Li Where to Look for Bug Bounty Programs When you feel at ease with web hacking fundamentals, you can begin hunting on sites such as: HackerOne
Bugcrowd
Synack
YesWeHack
Intigriti HackerOne Bugcrowd Synack YesWeHack Intigriti These sites include lists of public and private programs. Begin with public programs—they are open to all. Getting Started Tips Here's a step-by-step guide: Step 1: Familiarize Yourself with Web Security Learn about how websites function and learn OWASP's Top 10 vulnerabilities. Step 2: Practice Labbing Practice exploiting vulnerabilities on platforms such as PortSwigger Academy and TryHackMe in a safe manner. Step 3: Select a Bug Bounty Platform Make an account and sign up for some public programs. Carefully read each program's rules and scope. Step 4: Begin Hunting Select a target, browse the site manually, and search for anything out of the ordinary—such as URLs with user IDs, hidden parameters, or API endpoints. Step 5: Document Everything Record everything you test and find, even if it doesn't result in a bug. Step 6: Report Ethically If you spot a bug, prepare a good report. Write down: What it is vulnerable to
How to reproduce it
Effected by (what the attacker can do)
Screenshots or proof of concept (PoC) What it is vulnerable to How to reproduce it Effected by (what the attacker can do) Screenshots or proof of concept (PoC) Step 7: Stay Updated Subscribe to bug bounty hunters' Twitter feeds and read write-ups. You'll pick up tricks and techniques periodically. How Much Can You Earn? Bounties may vary from $50 to $50,000+, depending on the severity of the bug and the company. Although some individuals turn bug hunting into a full-time profession, others begin as part-time hunters or hobbyists. Even if you don't encounter high-paying bugs immediately, you'll have real-world experience in cybersecurity. Challenges You May Encounter Let's face it—bug bounty hunting isn't a cakewalk. It can be frustrating initially. You may spend hours and find nothing.
Others might find a bug before you.
Some of your reports have been rejected. You may spend hours and find nothing. Others might find a bug before you. Some of your reports have been rejected. But don't give up. Every failure is something new that you learn. Keep trying, and your abilities will improve quickly. The Ethics of Bug Bounty Hunting Always adhere to these golden rules: Obey the program rules.
Don't try systems beyond the approved scope.
Never use a bug more than necessary to demonstrate that it exists.
Don't reveal bugs in public without permission. Obey the program rules. Don't try systems beyond the approved scope. Never use a bug more than necessary to demonstrate that it exists. Don't reveal bugs in public without permission. Bug bounty hunting is all about securing the internet. Be ethical and responsible. Final Thoughts Bug bounty hunting is a combination of creativity, logic, and persistence. As a beginner, your objective shouldn't be to earn money immediately but to learn, develop, and acquire real-world hacking skills. Begin with small things, continue practicing, and never hesitate to ask questions or get assistance from the community. Remember, every expert hacker was once a beginner—just like you. Bonus Tip: Join Online Communities Reddit’s r/bugbounty
Discord servers of HackerOne or Bugcrowd
Twitter (follow tags like #bugbountytips, #infosec, #websecurity) Reddit’s r/bugbounty Discord servers of HackerOne or Bugcrowd Twitter (follow tags like #bugbountytips, #infosec, #websecurity) You’ll learn faster and stay motivated. Happy Hunting!

Becoming a Bug Bounty Hunter: A Beginner's Guide

Cybersecurity is one of the fastest-growing industries in technology today. With increased cyber attacks and data breaches, companies and governments are spending more on security than ever. This has led to a massive demand for cybersecurity experts. If you're curious about joining this field, you might be wondering: Do I need a cybersecurity degree? Is it worth shelling out years and thousands of dollars for a degree, or is there a faster, better way to break into the industry? Today, we'll take a look at the reality about cybersecurity degrees—what they do, their strengths and weaknesses, and whether or not they're really worth it in 2025. What is a Cybersecurity Degree? A cyber security degree usually is a Master's or a Bachelor's level course which studies how students are to protect computer networks, computer systems, and data against cyberspace intrusions. Programs in cybersecurity also usually comprise curriculum on: Network Security
Cryptography
Ethical Hacking
Security Policies
Risk Management
Digital Forensics
Operating System Security
Cloud and Application Security Network Security Cryptography Ethical Hacking Security Policies Risk Management Digital Forensics Operating System Security Cloud and Application Security Students can attend colleges, universities, and a number of accredited courses on learning institutions on the net. Benefits of Having a Cyber Security Degree 1. Organized Studies One of the advantages of a degree is that it gives you guided, structured learning. You begin at the basics and step by step move into advanced ideas. This aids beginners who have no idea where to begin. 2. Good Theoretical Foundation Degree courses frequently study computer science, networking, and cybersecurity theory at length. This enables you to grasp the "why" behind security practices—not merely the tools. 3. Facility for Labs and Resources Universities typically provide hands-on labs, simulated spaces, and equipment that assist you in acquiring hands-on skills in a secure environment. 4. Networking Opportunities College exposes you to professors, guest lecturers, alumni, and classmates—all of whom can be beneficial for future employment opportunities and mentorship. 5. Some Jobs Require It Many jobs in government agencies, defense, and large corporations require a degree—especially for high-security roles. Without a degree, these positions may be off-limits. The Downsides of a Cybersecurity Degree 1. Costly and Time-Consuming Let's face it—a cybersecurity degree can cost $30,000–$100,000 or more, depending on the school. It also takes 3 to 4 years, which is a long time compared to alternative paths. 2. May Lack Practical Skills Some degree courses emphasize theory and do not include practical tools such as Burp Suite, Wireshark, or Nmap. This will require you to have additional courses or certifications. 3. Not Always Current Cybersecurity is a rapidly changing environment. University education will be slow to revise their lesson material, so you'll end up learning outdated tools or ideas. 4. Doesn't Always Lead to Employment Having a degree is not enough; employers also seek skills, certifications, hands-on training, and your capability to actually solve real-world problems. Do You Really Need a Cybersecurity Degree? Short answer: No, but it can help. You don't require a degree to be a cybersecurity worker. Numerous successful cybersecurity professionals are self-taught or started in other areas such as networking or programming. The most important thing in this profession is: Skills: Do you have the capability to solve real-world security issues?
Certifications: Are you certified through industry-recognized credentials
Experience: Do you have projects, labs, bug bounties, or internships experience
Portfolio: Can you demonstrate your capabilities through write-ups, GitHub project work, or CTF achievements? Skills: Do you have the capability to solve real-world security issues? Certifications: Are you certified through industry-recognized credentials Experience: Do you have projects, labs, bug bounties, or internships experience Portfolio: Can you demonstrate your capabilities through write-ups, GitHub project work, or CTF achievements? Other Ways to Break into Cybersecurity If a degree isn't for you (because of the cost, the time, etc.), here are some solid alternatives: 1. Self-Study There are numerous free and paid materials online. Sites like TryHackMe, Hack The Box, and YouTube are good for hands-on training. Books and blogs offer loads of information too. 2. Certifications Certifications can advance your career and prove to employers that you are a pro. Some well-known ones are: CompTIA Security+ – Suitable for beginners
CEH (Certified Ethical Hacker) – Explores penetration testing fundamentals
CISSP – More technical, usually for managers or seasoned professionals
OSCP – Extremely well-regarded in offensive security and pen testing CompTIA Security+ – Suitable for beginners CEH (Certified Ethical Hacker) – Explores penetration testing fundamentals CISSP – More technical, usually for managers or seasoned professionals OSCP – Extremely well-regarded in offensive security and pen testing 3. Bootcamps Cybersecurity bootcamps are intensive, short-term programs centered around real-world skills. These are excellent if you need job-ready skills quickly (typically 3–6 months). Look for those with hands-on labs and job assistance. 4. Internships and Freelancing Experience counts. Seek out internships, work on open-source projects, or participate in bug bounty programs like HackerOne and Bugcrowd to establish your reputation. 5. Community and Networking Participate in cybersecurity communities such as Reddit's r/netsec, Twitter (or X), Discord servers, or local meetups. Community involvement can keep you informed and provide job leads. Who Should Consider a Cybersecurity Degree? A cybersecurity degree may be the best option if:
You like academic learning and desire a structured path
You're new to the field and desire a solid foundation
You want to work in a field that requires a degree (like government or defense)
You have the time and money to invest in college A cybersecurity degree may be the best option if: You like academic learning and desire a structured path You're new to the field and desire a solid foundation You want to work in a field that requires a degree (like government or defense) You have the time and money to invest in college Who Might Skip the Degree? You might not need a degree if: You already have experience in IT, networking, or programming
You’re motivated and enjoy self-study
You’re looking to switch careers quickly
You prefer hands-on learning and real-world problem solving
You want to avoid student debt and start working ASAP You already have experience in IT, networking, or programming You’re motivated and enjoy self-study You’re looking to switch careers quickly You prefer hands-on learning and real-world problem solving You want to avoid student debt and start working ASAP Final Verdict: Are Cybersecurity Degrees Worth It? They can—but they're not the only option. A cybersecurity degree is a good choice for individuals who desire structured learning, a solid foundation, and access to long-term career opportunities. But it's not the only route to success. In 2025, with so many free and cheap resources, it's highly likely to become a successful cybersecurity professional without a degree. At the end of the day, employers don't care about what's on your diploma so much as what you can do. So focus on developing skills, experience, and a good portfolio—with or without a degree. TL;DR Cybersecurity degrees provide structure, theory, and credibility—but they cost a lot and take a long time.
You don't need a degree to enter cybersecurity.
Alternative routes include self-study, certifications, bootcamps, and hands-on projects.
Focus on developing actual skills, getting experience, and demonstrating your work.
A degree might help, but it’s not the only way to break into this exciting field. Cybersecurity degrees provide structure, theory, and credibility—but they cost a lot and take a long time. You don't need a degree to enter cybersecurity. Alternative routes include self-study, certifications, bootcamps, and hands-on projects. Focus on developing actual skills, getting experience, and demonstrating your work. A degree might help, but it’s not the only way to break into this exciting field.

Are Cybersecurity Degrees Worth the Cost?

Previously Undisclosed Flaw Let Hackers Hijack Millions of Systems Through Innocent-Looking Files

পূর্বে অপ্রকাশিত ত্রুটি হ্যাকারদের নির্দোষ চেহারার ফাইলগুলির মাধ্যমে লক্ষ লক্ষ সিস্টেম হাইজ্যাক করতে দেয়

Una falla no revelada anteriormente permitió a los piratas informáticos secuestrar millones de sistemas mediante archivos de apariencia inocente

Aurretik ezagutarazi gabeko akatsak Hackerrek milioika sistema bahitu ditzakete itxura errugabeko fitxategien bidez

Une faille jusqu'alors non révélée a permis aux pirates de pirater des millions de systèmes via des fichiers apparemment innocents

Una falla precedentemente non rivelata ha permesso agli hacker di dirottare milioni di sistemi tramite file dall'aspetto innocente

これまで公表されていなかった欠陥により、ハッカーは無害に見えるファイルを通じて何百万ものシステムを乗っ取ることが可能

កំហុសដែលមិនបានបង្ហាញពីមុន អនុញ្ញាតឱ្យពួក Hacker លួចចូលប្រព័ន្ធរាប់លានតាមរយៈឯកសារដែលមើលទៅគ្មានកំហុស

Faute oyo elobamaki te liboso Tika ba pirates ba détourner ba millions ya ba systèmes na nzela ya ba fichiers oyo emonanaka lokola innocent

Өмнө нь илчлэгдэж байгаагүй алдаа нь хакеруудад гэмгүй мэт харагдах файлуудаар дамжуулан сая сая системийг хулгайлах боломжийг олгосон.

Ранее нераскрытая уязвимость позволила хакерам взломать миллионы систем с помощью невинных на вид файлов

Mbere Amakosa Ataramenyekana Reka Hackers Banyere Amamiriyoni ya Sisitemu Binyuze muri dosiye zisa n'inzirakarengane

Ilgari oshkor etilmagan kamchilik xakerlarga begunoh ko'rinadigan fayllar orqali millionlab tizimlarni o'g'irlashiga imkon berdi.

Hey there 👋 In your journey as a developer, the common way to make money is by . securing a full-time job However, you may not be in a position yet to secure a job ( ), or you began working, but you are looking at ways to make some extra cash. aka you are still studying Now, you can try to make a side income in many ways. Some are more realistic than others. In this article, we will learn about the . side-income gigs that you can get started with today achievable Take a deep breath, and let us wash our souls with this new knowledge. 🧎 I did not try every option in the list. If you think something should be added to the list or you want to share a personal experience, please comment below (I'd love to hear from you!). 🙇‍♂️ Disclaimer: ⚔️ Creator Quests Creator Quests is a way for developers to monetize their skills. are open-source challenges happening every two weeks. Creator Quests and for playing around with the developer tools of the future. 🚀 It is like a 24/7 Hackathon that rewards developers for building cool apps The community decides the winner by giving kudos to projects they love. The projects with the most kudos will earn the most. 🤑 💃 MaaS - Me as a Service Freelancing is hard to start with. However, it is very much to everyone. achievable and accessible I had some experience in freelancing with data analytics. If I had to redo it again, here is how I would approach it: Understand the differences between , , and . Pick a platform you prefer and focus on that. I found to be an interesting platform, but if you think you are very good, you can always look into . 1️⃣ Pick a platform: Fiverr Upwork Freelancer Malt TopTal Build a profile around a very specific service, e.g., I specialize in coding Python scrapers and building a database using MongoDB, which ultimately displays dashboards through Plotly (not exactly that, but you get the idea 🙃). 2️⃣ Don't be Mr/Mrs know-it-all: Getting your first clients is extremely hard, so contact job postings and explain that you are happy to do it If they are happy with the job, ask them to provide a good rating. 3️⃣ Charge NOTHING for your first Client: for free. Start charging for your work - still at a lower rate - and build your reputation. 4️⃣ Get your First Pay: Once you have a stronger position on the platform, you can decide to up your pricing. 5️⃣ Increase your pricing: My final comment is that although I believe everyone can start making money by freelancing, There are many drawbacks that could not fit with how you like to work (difficult clients, deadlines, platform dependency, etc). I don't think everyone should be doing it. In London, I found a little trick to get some clients. You can approach some relevant consulting/recruiting agencies, and they can help you find clients for you. Look into agencies like this if you are struggling to get started. 💁 Special Tip: 🧪 Test it. Get Paid for it. As a developer, you understand the technicalities behind a webpage or an app. This means you have the skills to perform great QA. Depending on the platforms you focus on, you can spend between 10-60+ minutes trying out an app or a website. There are various platforms out there, but the three known websites for you to check out are: Trymata UserTesting UserLytics PS: There is also the option for complete surveys which, in my opinion, pay very little. If you are still curious about it, you can check or . Wynter SwagBucks 🐛 Bug Hunter You can monetize this skill if you have a great eye for detail and enjoy web security. You can make money there if you are curious and have good programming skills. 🥂 You will likely get paid $20 at the start, but the rewards can increase to astronomical amounts like £100k+. I would stress that this is not how you become a millionaire. There is some decent competition, and you likely won't earn very high figures. You should still try it and see if it works for you. The most known platforms for this are: HackerOne BugCrowd If you somehow become good at this, you can look into big companies, as this tends to be where the big bucks are. You can find the vulnerability programs here from , , and . Microsoft Apple Google If you find vulnerabilities in a website you enjoy using, there is no harm in asking them for compensation. 🙃 Last tip: 🧑‍🏫 You learned something? Teach it back Tutoring is my personal favourite "side hustle.” It may seem "meh" for some, but it is very much achievable, and it . strengthens your knowledge around a specific topic while making good money Also, you don't necessarily need to be an expert. That's right! As long as you are more knowledgeable in a specificic domain, you can charge a service for teaching that knowledge. There are three ways you can approach this: 📜 Old School Way 1️⃣ : Post physical ads around schools/colleges with your offering and contact details. Identify the right schools 2️⃣ Find and get involved in relevant Discord, Facebook, and Linkedin groups. Make the community in question aware of your services in a respectful way. Identify Communities: 3️⃣ Start your first sessions with a lower pricing to get the ball rolling. After some experience, consider raising your prices. Don't be too greedy: 👶 New School Way Look into the platforms below: Codementor Superprof Tutor Register as a tutor and start below market rate to get your first students. 📦 Digital Content You can look into building some video courses. My personal favorite is a new tool called . Stan Store This is the all-in toolkit for digital creators, and there is much more than just building video content. I personally made a couple hundred dollars using this platform. Alternatively, you can look into more conventional platforms like or . SkillShare Udemy Slightly less achievable paths (but worth a mention) 👇 : Some hackathons provide good cash prizes. The downside is that there is usually a decent amount of competition. To scout for the right hackathons, the best website by far is . 🚧 Hackathons DevPost You can build a boiler template based on your knowledge. What is "slightly less" achievable in this case is how much money you can make (at least initially). This is because it requires a big following (or significant marketing). If you want to give it a shot, you can check out and . 🏷️ Selling Boiler Template: Gum Road AppSumo I hope you enjoyed this article and that it helped you understand how to leverage your dev skills for a side hustle. The above gigs are not trying to paint a picture that you will be wealthy overnight. However, they are side hustles with a high chance of getting paid. With some consistency, you can expect to earn much more over time. 🚀 This post was inspired by a great piece written by . @lissy93 If you are interested in learning about alternative ways to monetize your dev skills (especially if you are more experienced), please check their and give it some love. article See you next week, Your Hackernoon buddy 💚 Bap Also published . here

Developer Side-Hustles: 5 Practical Ways to Monetize Your Coding Skills

Joining the cybersecurity field as an outsider without a technical background was a transformative journey for me. What immediately captivated me about the industry was its relentless pace and the exhilarating challenge it constantly presented. Interacting with professionals in the field, I was heartened by their overwhelming support for newcomers who genuinely exhibited the will to learn. However, I quickly found a prevailing sentiment: there's a general expectation for newcomers to be independent self-learners. This could be a daunting expectation, especially considering that many potential beginners in aren't inherently self-learners. While innate curiosity is undoubtedly a valuable trait, it's essential to recognize that many individuals, even those with immense potential, need a structured framework to move their initial steps into this vast domain. cybersecurity In the last few years, significant progress has been made in filling the talent gap in the industry. However, as of 2023, according to the , there were 440,000 new jobs created in cybersecurity globally (an 8.7% increase year over year), but a staggering 4 million positions remained unfilled (a 12.6% increase year over year). This enormous gap results from the disconnect between employers' needs for experienced professionals and the real-world shortage of such expertise ISC2 Cybersecurity Workforce Study The solution to this talent crunch lies in focusing on the early stages of potential cybersecurity professionals' careers, particularly young students. As a community, it's imperative that we equip the youth with the tools they need to explore cybersecurity as a viable career option. The key is to offer structured, practical, and accessible learning paths. Below are some steps and examples of how to do so. Study Frameworks Like NIST-NICE The NIST-NICE framework categorizes cybersecurity work into seven high-level categories: Analyze, Collect and Operate, Investigate, Operate and Maintain, Oversee and Govern, Protect and Defend, and Securely Provision. Each category is further divided into specialty areas and work roles, providing a comprehensive roadmap for career progression. Table 1: NICE Framework Work Role Categories Category Description Number of Work Roles Securely Provision (SP) Conceptualizes, designs, procures, and/or builds secure IT systems. Responsible for aspects of system and/or network development. 11 Operate and Maintain (OM) Provides the support, administration, and maintenance necessary to ensure effective and efficient IT system performance and security. 7 Oversee and Govern (OV) Provides leadership, management, direction, or development and advocacy so the organization may effectively conduct cybersecurity work. 14 Protect and Defend (PR) Identifies, analyzes, and mitigates threats to internal IT systems and/or networks. 4 Investigate (IN) Investigates cybersecurity events or crimes related to IT systems, networks, and digital evidence. 3 Analyze (AN) Performs highly-specialized review and evaluation of incoming cybersecurity information to determine its usefulness for intelligence. 7 Collect and Operate (CO) Provides specialized denial and deception operations and collection of cybersecurity information that may be used to develop intelligence. 6 This table showcases the broad spectrum of roles within the cybersecurity landscape. By understanding these categories, beginners can better position themselves for a more tailored and informed career trajectory. For a comprehensive understanding of the NIST-NICE framework and to access a myriad of resources tailored for beginners, one can visit the . NICE's Getting Started Resource Center The goal is to explore various facets of cybersecurity and determine where passion intersects with proficiency. Since cybersecurity is a dynamic field, there's always room for an individual to pivot, learn, and evolve. Become Friends with Real Hackers The cybersecurity community is exceptionally supportive of newcomers. Even seasoned professionals are often open to sharing tips and advice and are incredibly accessible to beginners. The secret to meeting these people is to attend live events. Real-time interactions at in-person events offer spontaneous questions, discussions, and the possibility for deeper understanding. It’s not just about soaking in knowledge; it's also about networking. These venues are prime opportunities for establishing meaningful connections, potentially leading to mentorships, job placements, or even collaborative projects. Furthermore, many such gatherings have live challenges or hands-on workshops where attendees can put theory into practice, often under the guidance of an expert. Here's why attending in-person events can be so beneficial for a cybersecurity enthusiast: Directly engage in challenges or workshops, honing skills in real time. Skill Demonstrations: Cybersecurity is ever-evolving. Engage in fresh, cutting-edge discussions that might not have reached the wider online community yet. Staying Updated: Share experiences and challenges with peers. It's comforting and motivating to know others face similar challenges. Moral Support: When it comes to venues, some platforms and organizations stand out: (Open Web Application Security Project): Renowned for its insights into web vulnerabilities, its global chapters regularly hold meetings and workshops. OWASP : These community-driven events offer a cozier, more intimate setting for discussions and learning. BSides : One of the hacker conventions, it is an excellent place for someone keen on diving deep into hacking and cybersecurity. DEF CON When planning to attend, here are a few tips: Don't just be a passive participant. Engage, ask, discuss! Engage Actively: Go through the event's schedule, note down sessions of interest, and research the speakers. Prepare: Did you connect with someone interesting? Drop them a thank-you note or a simple message post-event. It could be the start of a valuable relationship. Follow-up: So, if you're aiming to deepen your cybersecurity knowledge and network, attending such events could be the stepping stones to your next big opportunity. Participate in CTF Challenges and Hackathons Capture The Flag (CTF) challenges are competitions where participants solve cybersecurity puzzles ranging from cryptography to web application vulnerabilities. These challenges offer beginners a practical, hands-on experience in solving . For example, the DEF CON CTF event annually attracts a global audience and has puzzles suitable for all skill levels. real-world cybersecurity problems Engaging in CTF challenges directly correlates with several areas outlined in the NIST-NICE framework: Analyze (AN): Deciphering cryptographic puzzles in CTFs sharpens skills pertinent to the Analyze category, where one evaluates incoming cybersecurity information. Protect and Defend (PR): Addressing vulnerabilities during a CTF strengthens a participant's capabilities in identifying, analyzing, and mitigating threats to IT systems, aligning closely with the Protect and Defend category. Investigate (IN): Some CTFs involve forensic challenges, aligning with the Investigate category, where one examines cybersecurity events or crimes related to IT systems. Securely Provision (SP): Tackling challenges where participants must secure or harden systems mirrors the Securely Provision category, emphasizing the design and creation of secure IT systems. By immersing oneself in CTFs, beginners not only gain valuable hands-on experience but also better understand the different roles and areas they might be interested in as per the NICE framework. It provides a tangible, engaging way to explore and deepen specific cybersecurity competencies. Join Bug Bounty Campaigns In a bug bounty campaign, companies incentivize ethical hackers to find and report vulnerabilities in their systems. This practice is becoming increasingly prevalent among leading technology companies, realizing the value of the global pool of independent security researchers. For instance, tech giants like Google, Facebook, Apple, Microsoft, and Twitter have all rolled out their own bug bounty programs, encouraging ethical hackers to identify and responsibly disclose potential security flaws in their platforms. By offering these campaigns, these organizations not only enhance the security of their systems but also foster a symbiotic relationship with the cybersecurity community. For example: Google's Vulnerability Reward Program (VRP) rewards researchers who uncover security vulnerabilities in Google's products and services. Their reward amounts can range from $100 to over $30,000, depending on the severity of the flaw and the product affected. In some exceptional cases, even higher rewards have been granted. Google's VRP has been instrumental in ensuring the security of products such as Google Chrome, Android, and Google Cloud Platform. Apple's Security Bounty Program invites security researchers to find vulnerabilities across iOS, macOS, and other Apple software. The payouts can be quite substantial, with rewards for the most critical issues reaching up to $1 million. This reflects Apple's commitment to user privacy and security. Platforms like Bugcrowd, Hackerone, and Intigrity have also streamlined the process, acting as intermediaries connecting ethical hackers with organizations, including those that might not have independent programs like Google or Apple. Once a vulnerability is identified and reported through these platforms or directly to the companies with established programs, it undergoes a verification process. If validated, the researcher could receive a financial reward, recognition, or both. Focus on Practical-led Training For beginners, there are web browser-based labs. These labs allow users to practice in a controlled environment directly within their browsers. While convenient and easy to access, these platforms might not fully replicate the complexities and intricacies of real-world systems. They are good introductory tools, but as users progress in their cybersecurity journey, they might find them less challenging. On the other hand, there are virtualized environments that require VPN access. These platforms offer environments that are almost identical to actual company infrastructures. The virtualized scenarios are meticulously crafted to emulate real-world networks, servers, and workstations. As users connect via VPN, they feel as if they are truly inside an operational network, providing a level of authenticity that web browser-based labs might lack. This type of environment allows for a deeper exploration of tools, tactics, and procedures, effectively training the participant to tackle genuine cybersecurity threats. The rigorous training in these environments ensures that participants are job-ready and fully prepared to address the multifaceted challenges they might face in their cybersecurity careers. By experiencing both types of training, candidates can appreciate the gradient of complexity in cybersecurity challenges and better hone their skills to be effective professionals. Here is a list of free or affordable practical cybersecurity training resources for beginners: : Provides a series of war games designed to teach the principles of security from the basics to advanced concepts. It's a great starting point for beginners wanting to learn Linux commands and simple penetration testing techniques. OverTheWire : This platform offers more than 300 challenges across different domains to help users improve their hacking skills. It provides a hands-on approach to learning about network security, web application security, and more. Root Me : Developed by the creators of the Burp Suite, this academy offers free hands-on web security training. It covers a wide array of topics from basic to advanced web vulnerabilities. PortSwigger Academy : Provides a beginners-friendly courses paired with VPN-based real-world training experience, emulating genuine cybersecurity scenarios. PWNX.io : A platform designed primarily for students to learn about cybersecurity. It offers educational modules tailored to different skill levels. PWN.college : An online platform that aids learning in cybersecurity through hands-on virtual labs. Its gamified challenges range from the very basics to more advanced, catering to users of all skill levels. TryHackMe A platform that provides various cybersecurity labs and challenges. While it does cater to users of all skill levels, some of the challenges can be very advanced, making it ideal for those looking to progress beyond the basics. Hack The Box: TCM Security offers self-paced cybersecurity courses that cover topics such as penetration testing, security training, and compliance. Additionally, they provide certifications that are increasingly gaining reputation in the industry. TCM Security: The resources mentioned above represent just a snapshot of the many tools and platforms that have gained attention and appreciation within the cybersecurity community. The realm of cybersecurity training is vast, and the list of valuable resources extends far beyond what's provided here. Additionally, there are numerous open-source projects and other content available online that can be instrumental in enhancing one's learning journey. Specialized forums and websites, which I will detail in the next paragraph, can be invaluable in discovering reviews or feedback from other community members. This feedback provides insights into the quality of new resources that are constantly being released. Leverage Social Media and Forums to Find a Mentor In the vast realm of cybersecurity, guidance from someone experienced can make all the difference. Platforms like LinkedIn can be particularly beneficial, not just for networking, but also for identifying potential mentors. By carefully reviewing profiles, joining relevant groups, and actively participating in discussions, you can showcase your eagerness and catch the attention of experienced professionals willing to guide newcomers. Discord, a platform initially created for gamers, has burgeoned into a hub for various professional communities. Specialized forums and websites further amplify the opportunity: Reddit’s Cybersecurity Communities: Platforms like and subreddits are teeming with professionals and enthusiasts discussing the latest in security trends, challenges, and solutions. The subreddit is particularly designed for students and beginners, fostering a nurturing space for queries and guidance. Reddit's Cybersecurity Netsec Netsecstudents Wilders Security Forums: Dive deep into discussions about online privacy, security, and data protection on . The vast range of threads and posts signifies a dedicated community, making it an invaluable resource for all cybersecurity-related topics. Wilders Security Forums MalwareTips and Antionline Forums: Websites like and are vibrant communities where one can engage in in-depth discussions on various facets of security, from malware threats to network safety. MalwareTips Antionline Bleeping Computer and Spiceworks Community: Forums such as and the are dedicated to comprehensive security-related discussions, from firewalls and VPNs to password managers and malware attacks. Bleeping Computer Spiceworks Security Forum Hacklido: A unique platform, is where the brightest hackers come together to share knowledge, experiences, and guidance. It's a rich source of practical insights and real-world examples. Hacklido By actively engaging in these forums and communities, not only can one expand their knowledge but also build meaningful connections. As you participate and contribute, the chances of meeting potential mentors who recognize your passion and dedication increase significantly. Remember, mentorship in cybersecurity is not just about learning the ropes; it's about guidance, feedback, and understanding the nuances of the rapidly evolving world of digital protection. Make Use of Free Tools As you embark on your cybersecurity journey, it's essential to familiarize yourself with the plethora of free tools available. These tools, widely recognized and utilized by professionals in the field, can significantly augment your learning experience: Wireshark: An open-source packet analyzer, Wireshark allows users to see what's happening on their network at a microscopic level. It's widely used for network troubleshooting, analysis, software, and communications protocol development, and education. Description: The tool comes with a range of to help newcomers grasp its functionalities. Resource: official documentation and guides OWASP ZAP (Zed Attack Proxy): Developed by OWASP (Open Web Application Security Project), ZAP is a free, open-source web application security scanner. It helps find security vulnerabilities in web applications while you are developing and testing them. Description: New users can benefit from the tool's and various community-contributed guides. Resource: official documentation Metasploit Community Edition: Part of the Metasploit Project, this edition is a free-of-charge penetration testing tool that helps verify vulnerabilities and manage security assessments. It aids in the discovery, analysis, and exploitation of vulnerabilities. Description: Metasploit provides a plethora of for various functionalities. Resource: tutorials and user guides Snort: As an open-source network intrusion prevention system (NIPS) and intrusion detection system (IDS), Snort is adept at performing real-time traffic analysis and packet logging. Description: Beginners can find extensive documentation and a community of users on the . Resource: Snort official website OpenVAS (Open Vulnerability Assessment System): OpenVAS is a full-featured vulnerability scanner that comes with numerous tests and offers updates for the latest vulnerabilities. It assists in identifying issues in systems and applications. Description: The OpenVAS community provides a to support new users in understanding and maximizing the tool's capabilities. Resource: comprehensive set of documentation Kali Linux: Kali Linux is a Debian-based Linux distribution that's geared towards advanced penetration testing and security auditing. It comes pre-installed with hundreds of integrated security tools, making it a staple in the cybersecurity community. Description: For those new to Kali, the offers comprehensive guidance, ranging from installation to utilizing its vast array of tools. Resource: official documentation Harnessing the capabilities of these tools not only gives beginners a practical understanding of various cybersecurity domains but also provides a hands-on approach to combating potential threats. Remember to explore the associated documentation and tutorials for each tool, as they often hold a wealth of knowledge and best practices. Untapped Potential and the Need for Guidance While there are self-learners who manage to connect the dots on their own, a vast number of budding talents are not yet part of the , mainly because they lack initial guidance. By providing targeted and practical guidance, we can help pave the way for a new generation of cybersecurity professionals ready to take on the challenges and opportunities that this rapidly evolving field has to offer. cybersecurity ecosystem Structured learning can be achieved in various ways, and this guide aims to offer an alternative perspective, coming from a non-traditional cybersecurity professional who had the unique opportunity to learn from genuine hackers.

You are Not Learning Alone: a Structured Guide for Cybersecurity Beginners

আপনি একা শিখছেন না: সাইবার সিকিউরিটি নতুনদের জন্য একটি স্ট্রাকচার্ড গাইড

Sie lernen nicht alleine: ein strukturierter Leitfaden für Einsteiger in die Cybersicherheit

No está aprendiendo solo: una guía estructurada para principiantes en ciberseguridad

Vous n'apprenez pas seul : un guide structuré pour les débutants en cybersécurité

आप अकेले नहीं सीख रहे हैं: साइबर सुरक्षा के शुरुआती लोगों के लिए एक संरचित मार्गदर्शिका

あなたは一人で学んでいるわけではありません: サイバーセキュリティ初心者のための構造化ガイド

혼자 배우는 것이 아닙니다: 사이버 보안 초보자를 위한 체계적인 가이드

Você não está aprendendo sozinho: um guia estruturado para iniciantes em segurança cibernética

Вы не учитесь в одиночку: структурированное руководство для новичков в области кибербезопасности

Yalnız Öğrenmiyorsunuz: Siber Güvenliğe Yeni Başlayanlar İçin Yapılandırılmış Kılavuz

Bạn không học một mình: Hướng dẫn có cấu trúc dành cho người mới bắt đầu về an ninh mạng

你不是一个人学习：网络安全初学者的结构化指南

248 Stories To Learn About Cyber Threats

Let's learn about via these 58 free stories. They are ordered by most time reading created on HackerNoon. Visit the to find the most read stories about any technology. Vulnerabilities /Learn Repo 1. CVE-2022-42856: Adjoining Splittail Vulnerability Report A look at CVE-2022-42856, reported by Apple as a vulnerability under active exploitation. 2. What is Broken Access Control and Why Should You Care? With broken access control being one of the most prevalent weaknesses for web applications, it’s important to not only understand it, but to prevent it also. 3. Command and Control Frameworks in a Nutshell A glimpse over Command and Control attacks and frameworks, how they happen, and how they can affect our daily lives. 4. How to Exploit Prototype Pollution? Prototype Pollution is a JavaScript related vulnerability. This article explains how it works and how to exploit it bypassing security checks of the app. 5. CVE-2022-31705: Bridged Creek Vulnerability Report Information on the CVE-2022-31705 critical sandbox escape vulnerability announced by VMWare. 6. Check Point Security Breach: A Leading Cybersecurity Company Has Been Breached Check Point, which bills itself as the leader in cybersecurity solutions, has been breached. Data records of over 5k ZoneAlarm forum users have been hacked. 7. Building a Web Vulnerability Scanner In May this year I was part of a team that launched SecAlerts, a free security product that sends subscribers a customised weekly report of vulnerabilities and security news relevant to their software stack. The service was deliberately made a low-barrier of entry way to keep users informed and, as it nears 1,000 subscribers, the decision to 'keep it simple' appears to have merit. 8. Key Questions to Ask your DevOps Teams About Containers and Kubernetes DevOps teams are responsible for balancing two important forces
in their organizations’ software development efforts: shorter delivery cycle
times for applications that continue to increase in size and diversity. 9. API Architecture: Components and Best Practices While API Architecture and API Design are different, when it comes to securing them, both need to be kept in focus. 10. Common Web Security Vulnerabilities In the movies, hacking is like fast keyboard typing and hitting the Enter but in the real world, hackers find and exploit vulnerabilities to hack websites. 11. There Are More Risks Associated With SaaS Data Security Than Potential GDPR Fines The growing reliance on SaaS business calls for an improvement in security. On occasions, data security can be of existential importance to organizations. 12. Crypto Wallets Exposed "Mnemonic Phrase Vulnerabilities" (4 Already Fixed) MetaMask and Phantom said today that they had patched a security flaw that could, in some cases, allow attackers to obtain mnemonic phrases. 13. Safe Storage: Hacks vs. Vulnerabilities Vulnerabilities found in hardware wallets is to be expected. All systems are hackable. The safest place for your coins is still your private keys. 14. Military Grade Encryption Won’t Save You, or Your Business With two recent vulnerabilities making headlines this month, notably CVE-2019-14899, impacting VPNs running on Linux distros and Atlassian’s zero-day flaw reported by SwiftOnSecurity concerning leak of private keys, it should be no surprise anymore as to why encryption merely breeds a feeling of security rather than guaranteeing it. 15. How to fix Security Vulnerabilities in NPM Dependencies in 3 Minutes Hola people!!! 🥑 16. Common Vulnerabilities and Exposures - Top Offenders in 2019 In 2018, the #1 spot on the "Top 10 Software with the Most CVEs" list went to Debian Linux, with 1197. 17. 5 CSRF Vulnerabilities Known For Highest Bounty Rewards If you don’t know, a bug bounty program is a modern strategy to encourage the public to find and report bugs or vulnerabilities in software — especially the security bugs that may be misused by cybercriminals. Most of the big technology companies like Facebook, Google, and Microsoft employ bug bounties. 18. Improving Open-source Software Security for Java Developers How can security be stepped up for the open-source Java ecosystem?
Enforcing automated scans before components are published is one of the ways. 19. Newest Malware from China “I think malware is a significant threat because the mitigation, like antivirus software, hasn’t evolved to a point to mitigate the risk to a reasonable degree.” Kevin Mitnick 20. 3 Types of Security Policies You Can Use with Your Kubernetes Pods On August 20, 2020, a provider of access management tools released an advisory detailing several misconfiguration issues that affected the kubelet. This feature of Kubernetes functions as the primary “node agent” running on each node. In order to support this functionality, the kubelet maintains full control over a pod running in a node. 21. Securing your NodeJs Express Application — Part 1 Review common mistakes and vulnerabilities in JavaScript like command injection and see how to secure NodeJs and express using npm packages like hpp and helmet 22. How to Keep OpenSSL Updated in an Enterprise Environment Outdated systems can leave us vulnerable to bad actors. Zero-day exploits are common with just about every system that exists. If we do not upgrade regularly, we leave ourselves at the mercy of black-hat hackers who regularly take advantage of any out-of-date application they can find. This is equally true with OpenSSL as with anything else. 23. Breaking Down 3 API Security Breaches The following three API security breaches provide helpful lessons for improving security today. 24. How to Protect Your Kindle From Hackers On August 6, 2021, findings of a security flaw in Amazon’s Kindle e-reader were disclosed by Slava Makkaeveev, a researcher from Check Point. You can patch it. 25. How to Optimize Your Web Server for Better Website Performance In this digital world, the success of your website lies in its first impression and user experience. A website that takes a loading time more than a blink of an eye makes them so frustrated and abandoned the website. It can create an adverse impact on search engine ranking and business of that website. 26. Spotlight on the Server-Side: A Guide to SSRF Vulnerabilities Server-side request forgery (SSRF) vulnerabilities can lead to total system compromise. Discover where they’re common, examples, and prevention tips. 27. How Does the Adversarial Cycle Apply to Coding and Security? Even if the code is perfect, an attacker can exploit it. 28. Common Vulnerabilities and Exposures: A Poem There's still some cases of malware
always-alarmed-and-on, always
large-in-scale in sight and run via
spray pray on-site. 29. Top 9 Security Practices at Kubernetes in 2020 In January 2019, Kubernetes, the world's most popular container orchestration system, discovered the first major security vulnerability that hit the project’s ecosystem. Vulnerability CVE-2018-1002105 allows attackers to compromise clusters via the Kubernetes API server, which allows malicious code to be executed to install malware, etc. 30. BREAKING New Threat Analysis: Killnet Hack-for-Hire Group New threat analysis detailing research performed by Quadrant Security on the Killnet hack-for-hire group. 31. Stack Overflow Vulnerability Stack overflow is a type of buffer overflow vulnerability. When we  pour water in a glass more than its capacity the water spills or  overflow, similarly when we enter data in a buffer more than its  capacity the data overflows to adjacent memory location causing program to crash. This is know as buffer overflow. 32. Handling Vulnerabilities Due to De-serialization in Java Applications When it comes to vulnerabilities, it's crucial to understand how Java objects are stored and accessed. 33. How We Could Have Listened to Anyone’s Call Recordings How PingSafe managed to find and report a vulnerability in an automatic all recorder that would have allowed us to listen to anyone's call recordings 34. Roadmap and Resources to Become an Ethical Hacker How to become an ethical hacker 35. How to Fix Your Broken Vulnerability Management CVSS scores are broken measures of vulnerability criticality.  SSVC is a viable solution to the problems created by CVSS scoring when used in isolation. 36. Crack Open the IoT Vulnerabilities of Realtek Taiwanese chip designer Realtek has warned of four recent vulnerabilities in three SDKs in its WiFi modules. 37. AU Government Fails Cybersecurity Targets as PM Warns of Cyber Threat On June 19 this year Australian Prime Minister, Scott Morrison, alerted the nation to the fact they were undergoing cyber attack. 38. Planning Cyber Security Budget Thoroughly: 2021 Edition Budgeting for cybersecurity is a challenging process. Here are some tips, how you can plan your cyber security budget effectively. 39. 10 Common Java Vulnerabilities Every Security Engineer Should Know This article covers the most common security vulnerabilities for Java programming 40. Your Top 5 Software Composition Analysis Questions Answered With the fast growth of the usage of open source in all industries, the need to track its components becomes dire as ever. Software Composition Analysis (SCA) is an open source component management solution for providing and automating visibility into the open source in your software. 41. How The Rise of Vulnerabilities Has Shaped Modern Patch Management Practices Vulnerabilities can seriously damage company’s operations and reputation, but you can protect it by automating live patching of infrastructures with KernelCare. 42. How To Deal With Common Open Source Vulnerabilities Most successfully IT Companies like Google, Microsoft including small Saas organizations relies on open-source software to power their software and applications architecture, deployments and so on. It really helps speed up the rate at which developers work on a project and also gives developers access to a myriad of top-notch projects. 43. 4 Common Web App Vulnerabilities and How to Combat Them Expert's advice on how to protect a web application against malicious attacks, accidental damage, and commonly known vulnerabilities in 2021. 44. The Best Practices for Web3 Security Risk Mitigation This article highlights the risks and vulnerabilities within the Web3 ecosystem and the best practices for Web3 security risk mitigation. Read on. 45. How To Fix The Most Common Linux Kernel Vulnerabilities The Linux kernel is widely considered the pillar of some of the most popular projects among the open-source community. As the central module of the O.S, the system’s stability, performance, and security rely heavily on the kernel. 46. What Is the Vulnerability Rating Taxonomy (VRT)? Developed and open-sourced by Bugcrowd, it’s a system designed to address the inherent shortcomings of CVSS ratings when viewed in isolation. 47. How To Block Security Vulnerabilities from Penetrating Your Code As continuous software deployments grow and become the accepted standard, security measures gain even more importance. From development and all the way through to production, security requirements should be adopted by all teams in an organization. 48. How a Supply-Chain Breach Put at Risk Atlassian Accounts On November 16, 2020 Check Point Research (CPR) uncovered chained vulnerabilities that together can be used to take over an account and control Atlassian apps. 49. The Powerdir  MacOS Bug Could Allow Attackers to Snoop On You The vulnerability allows malicious apps to bypass privacy preferences. Precisely, it could allow an attacker to bypass the operating system's Transparency, Cons 50. The Rise and Fall of APTR1 Exploit Jian Cyber weapons are digital and volatile by nature. Stealing them and transferring from one continent to another, can be as simple as sending an email. 51. How Should Companies Build a Robust Cybersecurity Culture? In the modern age of information and technology, there’s not a single individual or organization that would object to the tightening of cybersecurity within an enterprise. 52. Viewing K8S Cluster Security from the Perspective of Attackers (Part 2) This article will continue to introduce attack points on K8S Cluster security. 53. CVEs: How Keeping a Catalogue of Common Vulnerabilities and Exposures Helps Your Company CVE combines a dictionary and a catalog containing names for vulnerabilities and other information security vulnerabilities. 54. PCI DSS – Compliance Requirements and How to Meet Them Is your business involved in any type of payment card processing? Then you need to be aware of the PCI DSS requirements. In this article, we take a closer look at some of the requirements defined by PCI DSS and show how they can be met. 55. Over 35 Tech Companies Compromised in Novel Software Supply Chain Attack Security researcher Alex Birsan breached systems of over 35 tech companies in what has been described as a novel software supply chain attack. 56. Time Bombs Inside Software: 0-Day Log4Shell is Just the Tip of The Iceberg CVE 2021–45046, says the fix to address CVE-2021–44228 in Apache Log4j 2.15.0 was "incomplete in certain non-default configurations." 57. Top 10 C++ Open Source Project Bugs Found in 2019 Another year is drawing to an end, and it's a perfect time to make yourself a cup of coffee and reread the reviews of bugs collected across open-source projects over this year. This would take quite a while, of course, so we prepared this article to make it easier for you. Today we'll be recalling the most interesting dark spots that we came across in open-source C/C++ projects in 2019. 58. What Vulnerabilities FreakOut Takes Advantage of for Creating a Botnet Check Point Research encountered several attacks that exploited multiple vulnerabilities, including some that were only recently published, to inject OS command Thank you for checking out the 58 most read stories about Vulnerabilities on HackerNoon. to find the most read stories about any technology. Visit the /Learn Repo

58 Stories To Learn About Vulnerabilities

Working in cybersecurity can be a very fulfilling career, but most jobs require some amount of experience or formal training. While there are many great courses and certifications for learning pen-testing out there, it might be the case that they are simply above your budget. But that is totally fine. I think it is still possible to get job-ready knowledge about and pen-testing from free resources. cybersecurity A little warning: While I feel like it is possible to spend no money on your way to the first pen-testing job, it is the case that some paid resources provide knowledge in a condensed and easy-to-digest form. Having access to those resources might accelerate your learning journey. So I will provide some recommendations on which of them are worth it and which are not. I also created a GitHub repo with free cybersecurity resources. Check it out, and feel free to add some: https://github.com/her0marodeur/awesome-free-cybersecurity A few words about my own career I got really lucky in terms of getting a job. My first contact with cybersecurity was back in my teenage years when I Googled “ .” That was back when there were no such resources as HackTheBox and TryHackme. So, a lot of the learning was more theoretical and, in general, kinda slow. How to become a hacker After I finished school, it was time to look for a job. I started out with a student job for a big software company. There, I had the opportunity to work with different security teams. During this time, I did my eJPT certification and got in contact with the internal pen-testing team. They provided me with the opportunity to do an internship and paid for my OSCP. After I finished my Bachelor’s degree, I got offered a full-time job as a pentester. As I mentioned, I got lucky, but I think there are a couple of takeaways from my own story: The demand for pen-testers is currently very high, so many companies are willing to train existing employees. So if you are already working for a company, see if they have an internal pen-testing or security team. The most important characteristics of a pentester (hacker) are willingness to learn and curiosity. Getting them does not cost a penny. One of the mistakes I made was focusing too much on the theory and not getting enough hands-on experience. This is really important, and you should try to get as much practice as possible. The role of certifications and degrees I know you probably want to get into learning right away, but I think we should have a brief discussion about this topic. There is a decade-long ongoing discussion about the difference between and which is better and a lot more. I don’t want to dive into all that stuff. certifications and degrees Generally speaking, a degree or a certification is a verifiable and easy way for employers to assess the skills of an applicant. The OSCP or a computer science degree does show that the candidate has skills and knowledge in a certain area. If you have to filter through hundreds of applications, they give a good orientation. But there are two big things to take into consideration: There are other ways of getting experience and knowledge. I have friends who have maintained Minecraft servers since they were twelve years old, and they have extremely good programming skills, even without having a degree. And their salaries are comparable to some seniors in the industry. Even tho there has been a huge interest in pen-testing in the last couple of years, the demand has skyrocketed as well. That means employers are not getting hundreds of applications. Many times, it is actually the case that pen-testers are getting many job offers just because they have a LinkedIn profile. Paid Certifications to avoid: For some reason, this is still seen as a good certification, but from everything I have heard, they provide a really dry course, and the exam requires you to memorize a lot of stuff. So you can save your money. Certified Ethical Hacker (C|EH): I did this one myself, and it was fun; the exam was really hands-on and enjoyable. The reason I don’t recommend it is that I don’t think it is really beneficial in terms of getting a job because I don’t feel like employers are valuing it. eLearning Security Junior Penetration Tester (eJPT): Paid Certifications you can do (if you have the money): I don’t hold this certification myself, but I did Heath Adams courses back in the day. The content is just great and really well explained. It covers a lot of topics. The exam is more relaxed than the OSCP, and it has industry recognition at the lowest price. Practical Network Penetration Tester (PNPT): The OSCP has its pros and cons, and I wouldn’t recommend that you take a loan to do it or bust your bank account. But in a situation where you can really afford to do it (considering money AND time), I have to admit it has a great course, and it is basically a job guarantee. If you want to learn more about it, check out my blog here: Offensive Security Certified Professional (OSCP): https://infosecwriteups.com/methodology-and-mindset-for-passing-the-oscp-d609592a7dcb Getting the knowledge To know where you should start, you have to know where you stand. It is a big difference if you already have fundamental IT knowledge or if you are coming from a different profession because it is absolutely necessary to understand basic computer science concepts like networking and how programs, web pages, and computers are built and running. Since I suspect that many readers of this article will have this knowledge, I will not talk too much about learning all that stuff. has some really cool courses to learn the basics, and I think installing your own web server and learning the basics of Python really helps a lot. There are also basic computer science courses on sites like . TryHackMe Coursera TryHackMe and HackTheBox As well as for basic knowledge, I think you should really start with for learning the basics of pen-testing; they have some really good paths for this. Sadly, some of them might be only accessible via a paid membership. I think the paid membership is really one of the best investments you can make because it is quite cheap and provides access to a lot of knowledge. TryHackMe If you are thinking about what kind of pen-testing (mobile, web, network, Red Teaming, etc…) to learn first, I suggest you go with web pen-testing because there are many resources about it, and when we talk about Bug Bounty later, most of the targets are available in this area. But if you feel like doing something else, do it; all of this is just my opinion. Additionally, to do the learning path, you should also do some of their boxes that don’t give you any hints about how to solve them. Also, check out for this; they also have some great boxes, but beware of their rating system. I recommend you really start with easy boxes. HackTheBox When solving boxes, I recommend you give yourself a time limit. I recommend something like this: If you don’t have the initial foothold after 30 minutes, you should check a writeup. Afterward, you try 30 mins for privilege escalation, and if you don’t get it, check the writeup again. It might be true that there is no writeup in a real pentest, but doing boxes is about getting as much knowledge as possible. Also, start pushing yourself as soon as possible and increase the difficulty. It may mean that you might need a write-up for almost every step, but it also means you learn something new with every box. Free certifications: This one is a must-have. It is just the right mix between great course content and realistic and challenging exercises. APISec University: This one is not really about pen-testing but covers a lot of the basics of cybersecurity. But these topics are important for pen-testers as well because they always have to see the bigger picture of cybersecurity. The course and exam are free, but it requires an annual maintenance fee. ISC2 Certified in Cybersecurity (CC): : Another one that is not directly about pen-testing. It explains one of the essential policies of cybersecurity, and employers would like knowledge about this one. Skillfront ISO/IEC 27001 Information Security Associate™ If you love certifications as I do and want some more for free, please check out my GitHub Repo over here: https://github.com/her0marodeur/awesome-free-cybersecurity Getting the experience By now, you already hacked some machines and websites, but all of them were in a simulated environment and left vulnerable by design. While this provides valuable experience and gives you the ability to learn how to exploit vulnerabilities, it is not necessarily the experience employers are looking for. Therefore, I recommend you try your skills against some real-world targets (in a legal way). Luckily, Bug Bounty platforms allow you to do this and maybe earn some money. Bug Bounty Platforms You can check out the following platforms: https://www.bugcrowd.com/ https://www.hackerone.com/ https://www.intigriti.com/ https://yeswehack.com/ Look at their programs and get familiar with the general topic of Bug Bounty (try to avoid the Twitter and Medium hustler bubble; there is some really bad stuff out there). I suggest you start by looking at Katie Paxton-Fear’s stuff ( ). She has some great videos that are really for beginners. But don’t stress too much about all of it; sign up for a platform, pick a program, and hunt. This is what life as a pentester is going to be like. Also, be careful and don’t bother too much about all of the tools, oneliners, and scanners. Learn about the recon fundamentals ( ) and start hunting. https://insiderphd.dev/ https://www.youtube.com/watch?v=krCsMZfbuB4 If you get one or the other bug, it is great for your CV because it shows you know how to apply your pen-testing knowledge to real-world targets. Synack Red Team https://www.synack.com/red-team/ This one really depends on how much time you want to spend before getting a job as a pentester. I am not part of it, but I heard really good stuff about it. It basically is a closed Bug Bounty platform, but they additionally offer some fixed pay jobs like checking default credentials or OWASP Top 10. However, you have to apply to them, and this process can take a while. But it gives you the chance to have some experience with a real-world job application. It offers great hands-on experience and looks good on your CV. So check it out and see if it is for you. Getting the job If you are following this blog (btw. please read more resources than just this one; there is a lot of great career advice out there), I hope you don’t think of it as something that has to be done in chronological order. You can skip things and do them in parallel, or however it feels right for you. Writing a CV Before you go out and look for a job, you should write a CV. This really should focus on showcasing skills that you can apply to your pen-testing job. So if you have worked in another job, think about how you can translate the skills you gained to pen-testing. If you are a programmer, tell them you have a deep understanding of technology and for sure you had to implement security measures in your code, and probably you know how developers think and fail. If you have worked as an executive assistant, you have probably done a lot of writing and have clear communication skills, which is also really beneficial for pen-testing. By now, you have done at least some certifications and courses, but be careful what you include in your CV. I think, if you have done the three free certs I mentioned, you should include all of them, as they really showcase skills and knowledge needed for your job. But you want to be careful not to include every little thing. Rather than including the certificate of completion for every TryHackMe track you did, you should just include your TryHackMe profile. And for bug bounty profiles, you only want to mention the sites where you have at least one accepted submission. If you put too much basic stuff in there, it probably seems desperate. For writing the actual CV, you should not get too creative. It is best to either download a Word template and fill it in with your experience and skills or use one of the online generators (consider privacy implications). Be aware that your CV is often times read by machines, so make it “machine-readable.” Getting yourself out there Being visible can be really helpful if you want to get a job. I think having a is crucial. So create one, put a nice photo and some experience on it, and maybe include “aspiring pentester” in your bio to make yourself visible when recruiters search for possible candidates in this area. well-maintained LinkedIn profile You can also do a little bit more to increase visibility. A nice thing to do is to start a blog. Like this one, you are just reading. Even tho you might not have a lot of expert knowledge; you can talk about your journey and experiences or write a tutorial for a tool or a writeup for a box you did. But please don’t go down 1337 Hacker Road. I don’t think that blogs like “Hack a webcam with only three steps,” “Hacking Instagram password,” and other clickbait help find employment. Other things you can do are contribute to GitHub projects (for example, Nuclei and Spiderfoot allow you to contribute new rules and templates), create your own tools, or speak at a conference. All of these things will increase your network and look great on a CV. Applying for jobs Go for quality over quantity. The job has to be a match for you as much as you have to be a match for the job. So, really try to find jobs that match your expectations. While I say that, it is also true that it is probably easier to pivot from one pen-testing job to another than getting into the industry, but I feel bad advising anyone to take a job they don’t enjoy. I highly recommend you reach out to recruiters/headhunters. You can easily find them on LinkedIn, add them to your network, and ask if they have a role that fits your profile. It will not cost you a penny because the employers are paying them. They will also be a big help with streamlining a lot of the process. They know their clients and where you have a good chance of getting hired and, most of the time, allow you to skip steps like writing a cover letter. Even if they are not able to offer you something right away, they will add you to their contact list and reach out in the future. Interviews There are just better resources than I am, so I will link to them: The Cyber Mentor- Mock Job Interview: https://www.youtube.com/watch?v=IDpjaS6OYPU The Cyber Mentor — What to Expect in an Ethical Hacking Job Interview: https://www.youtube.com/watch?v=nrewE1mLlaU Security Interview Questions: https://github.com/justinltodd/security-interview-questions Conclusion While it should be entirely possible to get a pen-testing job without spending a dollar, it will still require a lot of work. Spending at least some money can make the process if you spend it right. I also have to mention that all of this is just my personal experience and perspective. Your mileage may vary. If you liked this blog post, you can follow me on Twitter @Secbyaccident or read my other stuff over at . https://security-by-accident.com/ And if you have read this far, I want to offer you a little Thank You. My DMs on Twitter are open, and you can reach out to me if you want me to review your CV, help you with some studying, or set you up with some recruiters. I will do all of this for free, but expect a little delay in response time. Also published here.

Cybersecurity Job Hunting, Pen-Testing Study Plans, and Certifications on a Budget

In the world of engineering, there are many different ways to rate the severity of a vulnerability. The most common way is to use the Common Vulnerability Scoring System (CVSS). However, there is also a newer system called the Vulnerability Rating Taxonomy (VRT). Developed and by , it’s a system designed to address the inherent shortcomings of CVSS ratings when viewed in isolation. open-sourced Bugcrowd The result is a method in which vulnerabilities are prioritized, simplifying most of the vulnerability management process. Here's a look at how these two systems compare. What Is a “Vulnerability Rating Taxonomy”? The term "vulnerability rating taxonomy" is one that has been batted around for quite some time. In theory, it's a great way of encapsulating something very complex - categorizing vulnerabilities according to severity and threat level. But in practice, understanding what the taxonomy covers can be an adventure akin to Herculean labor! Ultimately, it gets down to a classification system that puts vulnerabilities into descriptors based on the extent of their danger. Think of it like sorting apples from oranges; shorthand descriptions to help differentiate between them. Once understood, the taxonomy provides an invaluable tool for prioritizing security patches and deploying resources efficiently. So, do yourself (and your IT team) a favor and take the time to familiarize yourself with such vocabulary, so you can control the chaos! How Is the Vulnerability Rating Taxonomy Is Used? The vulnerability rating taxonomy is an important tool for security professionals. It's the go-to source to identify and evaluate a system's weaknesses, as well as strategize mitigation options. This comprehensive rating system is designed to not just rank, but also categorize common vulnerabilities found in systems. Essentially, it brings order to chaos and gives security staff the much-needed insight into potential security issues so they can develop an effective risk management plan. To top it off, this system can be gradually adapted to account for new threats or advances in technology. In other words, the vulnerability rating taxonomy allows us to stay one step ahead of the bad guys - not a bad way to stay safe should we say! What Are the Benefits of Using a Vulnerability Rating Taxonomy? Using a vulnerability rating taxonomy can feel daunting at first, but it's worth the effort. While there's a lot to learn if you don't have experience with this type of system, its advantages greatly outweigh any initial hangups. Once you are familiar with the organization and language of a vulnerability rating taxonomy, it makes assessing the risk associated with security issues much easier than before. Not only that but going through the process increases accountability within an organization and helps prevent important details from falling through the cracks. So, while investing time and energy in understanding vulnerability rating taxonomies may sound like a drag, it's really just another way of protecting your stuff - so pull up your socks and get started! Are There Any Drawbacks to Using a Vulnerability Rating Taxonomy? While a vulnerability rating taxonomy can be a great way to organize the various cybersecurity threats you face, it's not perfect. These systems help us make sense of what can often seem like a jumble of different levels and kinds of security threats; however, they can also lead to oversimplification. By reducing our understanding of vulnerabilities down to two or three categories, it becomes harder to account for the nuances and complexities that security threats present. In addition, if we rely solely on these systems, we may spend too much time labeling certain vulnerabilities instead of researching new mitigation techniques or performing important updates. So, keep your eyes open and stay alert--there are both advantages and drawbacks to using vulnerability rating taxonomies! How Can You Create Your Own Vulnerability Rating Taxonomy? Crafting a custom vulnerability rating taxonomy can be an arduous task, but it can also be quite rewarding! Think of it as designing your own suit from scratch - you get the exact product that meets your specifications. The first step is creating a classification system, defining what parameters will generate the ratings for your particular vulnerabilities. The next step requires some introspection - where does your organization draw “the line?” Determining what severity of risk exposure is acceptable and which is unacceptable will create the framework to accurately rate each potential security breach. And that's all there is to it! With some careful thought, you'll have yourself a fresh set of tailor-made vulnerability ratings in no time. Vulnerability rating taxonomies have become increasingly important tools in the world of cybersecurity in recent years. With the ability to help you quickly assess the risks that your organization could be facing and take steps to address those risks, they are invaluable assets for any business. While creating one can seem daunting, it's definitely doable if you break down the process into small, achievable tasks. Additionally, staying up-to-date on threat intelligence is a great way to build out your taxonomy and remain proactive about risk mitigation. In an ever-changing digital landscape, having a comprehensive vulnerability rating taxonomy is essential for comprehensive risk management and resilience.

Stories, News & Mentions about BUGCROWD

Categories

Trending Topics

Stories, News & Mentions about BUGCROWD

Bugcrowd’s Stories on HackerNoon

Bugcrowd's News & Mentions

Categories

Trending Topics