![\"A](\"https:\/\/www.backblaze.com\/blog\/wp-content\/uploads\/2020\/04\/bb-bh-whitehat-hacker.jpg\")
<\/p>\n<\/p>\n
Backblaze is responsible for a huge amount of customer, company, and employee data\u2014in fact, we recently announced that we have more than an exabyte<\/a> under management. With a huge amount of data, however, comes a huge amount of responsibility to protect that data.<\/p>\n This is why our security team works tirelessly to protect our systems. One of the ways in which they safeguard the data we\u2019ve been entrusted with is by working alongside hackers. But these aren\u2019t just any hackers…<\/p>\n Although it may sound odd at first, hackers have helped us discover and resolve a number of issues in our systems. This is thanks to Backblaze\u2019s collaboration with HackerOne<\/a>, a platform that crowdsources white hat hackers to test products and alert companies of security issues when they find them. In return, companies award the hacker a bounty. Bounty amounts are carefully outlined based on severity ratings, so when a vulnerability is discovered, it is awarded based on that bounty structure.<\/p>\n Tim Nufire, Chief Security and Cloud Officer at Backblaze, created the company\u2019s HackerOne program back in March 2015. One of the best things a company of our size can do is incentivize hackers around the world to look at our site to help ensure a secure environment. We can\u2019t afford to onboard several hundred hackers as full-time employees, so by running a program like this, we are leveraging the talent of a very broad, diverse group of researchers, all of whom believe in security and are willing to test our systems in an effort to earn a bounty.<\/p>\n When a hacker finds an issue on our site, backup clients, or any other public endpoint, they file a ticket with our security team. The team reviews the ticket and once they have triaged and confirmed that it is a real issue, they pay the hacker a bounty which depends on the severity of the find. The team then files an internal ticket with the engineering team. Once the engineers fix the issue, the security team will check to make sure that the problem was resolved.<\/p>\n To be extra cautious, the team gets a second set of eyes on the issue by asking the hacker to ensure that the vulnerability no longer exists. Once they agree everything is correct and give us the green light, the issue is closed. If you\u2019re interested in learning even more about this process, check out Backblaze\u2019s public bounty page<\/a>, which offers even more information on our response efficiency, program statistics, policies, and bounty structure.<\/p>\n Initially, our program was private, which meant that we only worked with hackers we invited into our program. But in April 2019, our team took the program public. This meant that anyone could join our HackerOne program, find security issues, and earn a bounty.<\/p>\n The reasoning behind our decision to make the program public was simple: the more people we encourage to hack our site, the faster we can find and fix problems. And that\u2019s exactly what happened at Backblaze. Thanks to the good guys on HackerOne we are one step ahead of the bad guys.<\/p>\n Let\u2019s take a look at some examples as we work through two \u2018classes\u2019 of bugs typically reported by hackers.<\/p>\n One class of bugs that hackers find is Cross-Site Request Forgery (CSRF)<\/a> attacks. CSRF attacks attempt to trick users into making unwanted changes such as disabling security features on a website they\u2019re logged into. CSRF attacks specifically target a user\u2019s settings, not their data, since the attacker has no way to see the response to the malicious request. To resolve issues like this, we make changes like adding the SameSite attribute to web pages, among other techniques<\/a>. Problem solved!<\/p>\n But sometimes making changes on our end isn\u2019t the right response. Another class of \u201cvulnerabilities\u201d that hackers are quick to point out is \u201cInformation Disclosure\u201d related to software versions or other system components. However, Backblaze does not see this as a vulnerability. \u201cSecurity through obscurity\u201d is not<\/em> good security, so we intentionally make information like this visible and encourage hackers to use it to find holes in our defenses. It\u2019s our belief that, by being as open with our community as possible, we\u2019re more secure than we would be by hiding details about how our systems are configured.<\/p>\n We call attention to these two examples specifically because they underline one of the most interesting aspects of working with HackerOne: deciding when something is truly an issue that needs fixing, and when it is not.<\/p>\n HackerOne has proven to be a great resource to scale our security efforts, but we\u2019re missing one thing: a capable new team member to lead this program at Backblaze! Yes, we are hiring an application security manager<\/a>.<\/p>\n Among other interesting tasks, whoever fills the role will be responsible for triaging and prioritizing the issues identified through the HackerOne platform. This is a new role for us which was identified as a must-have by our security team because Backblaze is growing quickly.<\/p>\n Security has been our top priority since day one, but as our company scales and the amount of data that we store increases, we need someone who can help us navigate that growth. As Tim Nufire points out, \u201cGrowth makes us a bigger target, so we need a stronger defense.\u201d<\/p>\n The application security manager will not only have the opportunity to apply their security knowledge, but they will also have the unique chance to shape a security team at a growing, successful, and sustainable company. We think that sounds pretty exciting.<\/p>\n If you are someone who has years of experience in the security field, but hasn\u2019t had the chance to take charge and lead a team, then this is your opportunity! We are looking for someone who is an expert in application layer security and is willing to teach us what we don\u2019t know.<\/p>\n We need someone who is not afraid to roll up their sleeves and get to work even when there is no clear direction given. There are a couple of technical skills that we hope the new hire would have (like Burp Suite), but the most important qualities are being hands-on and having organizational management skills. This is because the application security manager will formulate strategy and build a roadmap for the team moving forward. If that excites you as much as it excites us, feel free to send your resume to jobscontact@backblaze.com<\/a> or apply online here.<\/p>\nSometimes Hackers Can Be Good<\/h2>\n
Backblaze + HackerOne<\/h2>\n
How HackerOne Works<\/strong><\/h3>\n
Moving from Private to Public<\/strong><\/h3>\n
Some Issues We Resolve, Some We Contest<\/strong><\/h3>\n
Help Us Decide!<\/h2>\n
Who We Are Looking For<\/strong><\/h3>\n