WEBVTT 00:05.210 --> 00:06.050 All right. 00:06.050 --> 00:07.790 Thank you, everybody, for joining us today. 00:07.790 --> 00:15.890 And I would like to thank HackerOne not only for sponsoring the Red Team Village this year, but you have been a very, very good partner throughout the years. 00:15.930 --> 00:18.430 So thank you for your support. 00:18.510 --> 00:23.370 And with that said, I'm going to pass it to my colleague, Greg, to ask you a couple of questions. 00:27.170 --> 00:27.570 Hey, Dane. 00:27.570 --> 00:31.290 Thanks again for sponsoring the Red Team Village. 00:31.290 --> 00:35.990 We only have three or four hundred questions that we're going to go over with. 00:35.990 --> 00:37.130 No, I'm kidding. 00:37.170 --> 00:45.350 So for the thousands and thousands of viewers that we don't have, if you would tell us a little bit about you and what you do for HackerOne. 00:45.670 --> 00:46.570 Yeah, happy to. 00:46.570 --> 00:49.850 I'm very happy to be here and glad to be supporting Red Team Village. 00:50.230 --> 00:54.790 First off, my name is Dane Sheritz, and I'm a senior solutions architect with HackerOne. 00:54.970 --> 01:07.190 As a solutions architect, I serve on the security advisory team and help our customers improve their security posture with our platforms and services, with a focus on working with the hacker community. 01:07.270 --> 01:11.350 And in my free time, I also enjoy doing some bug bounty hunting a bit myself. 01:11.710 --> 01:12.690 That's awesome. 01:12.690 --> 01:19.190 So why does your company believe that the Red Team operations that everyone does is so important in the industry? 01:19.730 --> 01:20.130 Yeah. 01:20.130 --> 01:30.510 So in general, I think any kind of adversarial type of testing is essential for organizations once your assets reach a certain level of security maturity. 01:30.690 --> 01:38.110 It's having those SAS, DAS, security scans, and the compliance-focused pen tests are important for hardening your attack surface. 01:38.250 --> 01:46.430 But at a certain point, you're going to need that weaponized curiosity of skilled hackers to find novel and elusive bugs in your assets. 01:46.590 --> 01:57.030 And when you have a well-run bug bounty program, specifically, you're going to find unique vulnerabilities that are much more similar to what an adversary would exploit in the real world type of attack scenario. 01:57.610 --> 01:58.410 That's so true. 01:58.410 --> 02:06.730 And I've got to ask, because it's all the rage, with AI shaking up the industry, how is it affecting you and your industry? 02:06.870 --> 02:11.530 Yeah, it's impossible to make it through a talk without talking about AI these days, right? 02:12.070 --> 02:23.850 So really, when I think about the AI of today, I'm not going to talk about 10 years, 20 years down the line, but the AI of today, there's typically three groups I think about as it relates to cybersecurity. 02:24.230 --> 02:27.350 It's the attackers, defenders, and implementers. 02:27.350 --> 02:33.690 So attackers, I'm typically talking about bug bounty hunters, pen testers, red teamers, etc. 02:33.750 --> 02:45.210 I'll start by saying I think we're a long way from AI fully replacing the attacker, but I think today it's already incredibly helpful as an assistant or a helper, right? 02:45.210 --> 03:07.290 For doing things like generating payloads, generating word lists, helping you understand code in maybe a language you don't already know, for writing code and quickly spinning up some TLCs, and for report generation, I think it's also pretty helpful, especially for some hackers in our community that English might be their second language and they're reporting vulnerabilities to a primarily English-speaking team. 03:07.290 --> 03:13.670 I think that there's a lot of value in using AI for those kinds of cases. 03:14.070 --> 03:29.630 For defenders, I mean, I think it's just impossible to overstate how impactful it's going to be as we have tools to quickly sift through the mountains of data that come in when dealing with incidents or responding to things that come through a SOC. 03:29.630 --> 03:39.470 Now you're looking at the simplicity of the logs that Windows generates, yeah, because they're so small, especially, anyway, no. 03:39.470 --> 03:44.150 But how does your company see red teaming evolving and making impact? 03:45.090 --> 03:59.110 Yeah, so really when I think about how it's going to make an impact, I'm going to keep my answer focused on the bug bounty world, but I think there's going to be an evolution in what is tested and how it's tested. 03:59.410 --> 04:13.710 So starting with what is tested, I think today a lot of programs might put their web app or mobile applications in scope, and maybe sometimes they'll allow for all subdomains of a given domain to be in scope as well. 04:13.770 --> 04:19.110 But philosophically, does that fully capture your entire attack surface? 04:19.350 --> 04:25.790 I think as bug bounty evolves, we'll start to see the concept of scope evolve as well. 04:26.370 --> 04:33.530 And we're already seeing today that the more mature a customer becomes, the more they treat their brand as part of their scope. 04:33.790 --> 04:39.270 So these customers treat anything that could impact the trust of users as something that they'd want to defend against. 04:39.590 --> 04:50.010 So this could look like them paying more for vulnerabilities further down in their supply chain, or a video game company paying for hackers for bypassing some of their anti-cheat implementations. 04:50.390 --> 04:55.310 We see a little bit of this today, but I think it's going to become a little bit more widespread as the years go on. 04:55.870 --> 05:01.530 And I think we're also starting to see organizations wanting to work with hackers further left in their SDLC. 05:01.670 --> 05:09.370 So having people find bugs in code before it's pushed to production, and it's something we try to help facilitate with our code review products. 05:09.610 --> 05:18.770 But generally speaking, I think there's going to be a desire for organizations to have folks with a hacker mindset help them in ways that are different than what organizations have done in the past. 05:19.370 --> 05:27.870 Going on to the how it's tested piece, I think as scope evolves, so will the tools and techniques that hackers use to find vulnerabilities. 05:28.090 --> 05:37.490 So I gotta say, working at HackerOne, it's really fascinating to see the kind of recon arms race that has been happening with recon automation setups over the years. 05:37.490 --> 05:47.270 And I think as compute is getting cheaper, becoming more widely available, it's making me pretty bullish on the kind of vulnerabilities and assets hackers are going to be able to find. 05:47.590 --> 06:00.490 And going back to the AI piece here, I think it's often been the case that you could be really recon data rich, but insights poor, but AI and LLMs change all that. 06:00.490 --> 06:04.050 Now everyone has their assistant that can help them code. 06:04.810 --> 06:16.590 Yeah, I think that HackerOne is an invaluable service to companies that you really want to... it's worth paying a little bit as you go as opposed to being in the news and costing yourself a fortune later on. 06:17.090 --> 06:25.090 So you have any words to all the thousands of red teamers watching that you might want to suggest or advise, or especially if they ever come to work for HackerOne? 06:26.290 --> 06:36.210 Yeah, so I think that the main piece of advice for hackers, red teamers, anyone in general is staying curious, right? 06:36.210 --> 06:41.570 I think as technology is constantly evolving, so are the vulnerabilities. 06:41.830 --> 06:55.370 So whether it's learning more about GraphQL, smart contracts, LLMs, I just encourage everyone to poke around and build things and break things and just kind of always try to stay ahead of the attackers. 06:55.890 --> 07:01.930 And I mean, anyone that's watching this today can start working with HackerOne by signing up and becoming a hacker on our platform. 07:02.210 --> 07:03.850 It's really quick and easy. 07:03.850 --> 07:15.050 And at least even without logging in or creating an account, you can check out our activity page and see some of the really cool types of vulnerabilities hackers in our community are finding every day. 07:15.830 --> 07:17.310 And that's HackerOne.com. 07:17.310 --> 07:19.790 I'm a proud member, I must say. 07:19.870 --> 07:20.530 Very cool. 07:20.550 --> 07:22.230 I do love the HackerOne. 07:22.550 --> 07:28.290 So what do you think about the importance of sponsoring community-driven villages like the RTV? 07:29.170 --> 07:34.630 Yeah, I mean, at the end of the day, we're a platform with a two-sided marketplace, right? 07:34.630 --> 07:40.230 So we obviously have our customers, but the other half of that marketplace is the hackers. 07:40.390 --> 07:45.490 And that's why we're really proud and excited to sponsor community-driven events like Recon Village. 07:45.490 --> 07:50.410 And you know, we want to give back to the community and help them in their journey as they grow their skill set. 07:51.190 --> 07:51.970 Yeah, that's awesome. 07:51.970 --> 07:56.030 Do you have any final words before we wrap this one up? 07:56.030 --> 08:02.530 Well, yeah, I would just say we're helping out with a number of events this DEF CON in Black Hat. 08:02.530 --> 08:09.670 We had a Black Hat session on AI at a booth there, both Wednesday and Thursday. 08:09.870 --> 08:16.390 We will also be hosting a hands-on hacking workshop with Meta at the Red Team Village on Saturday morning. 08:16.530 --> 08:24.330 And we are also co-hosting an AI and policy happy hour at the Policy Village on Friday evening. 08:24.390 --> 08:28.590 And I'll also be at the conference, so if you see me around, please say hey. 08:29.270 --> 08:31.170 Well, I'll be in the village. 08:31.170 --> 08:33.130 So yeah, you won't be able to miss me or Omar. 08:33.130 --> 08:36.050 We'll be the strange guys pointing at stuff. 08:37.630 --> 08:38.670 That's awesome. 08:38.670 --> 08:39.410 Excellent. 08:39.510 --> 08:45.890 So once again, Dane, on behalf of the DEF CON Red Team Village, I want to thank you from the bottom of my heart. 08:45.890 --> 08:50.230 Thank you, HackerOne, for supporting us throughout the years. 08:50.230 --> 08:57.310 Our village has been very successful throughout the years, and it would have been possible definitely without your support and commitment. 08:57.650 --> 09:04.570 So before I lose my voice, thank you again, everybody, for tuning in, and I'll hope to see you next week in Vegas. 09:04.710 --> 09:06.350 Yep, we'll see you at DEF CON.