Skip to content

Point of View: Tesla opens up bug bounty program

By Jeff Williams, Co-Founder, Chief Technology Officer

June 15, 2015

Hacked

    
Point of View: Tesla opens up bug bounty program
“Bug bounty programs have been surprisingly effective and I don’t see this being any different for Tesla.  I think they’re smart to start with their website as they learn how to handle the influx of security bug reports.  As they mature, they may eventually decide to extend the program to vehicles and more critical systems, but I wouldn’t expect it to happen very soon.  Letting people play around with the website is one thing, letting them attack a vehicle is a whole different matter.

These bug-bounty programs are getting real value, but there are costs too.  There are many reported flaws that are not actually vulnerabilities.  It takes work to track these down and deal with them. Most of these programs are run by organizations with a small number of very critical applications. I strongly recommend these programs as part of a balanced application security breakfast.  I hope Tesla has done as much security work as they can before this launch.  But once they've reached the limit of their security abilities, why not get some help from the rest of the planet.  The planet is doing the hacking anyway… all they want is a little recognition. 

I’m sure that Tesla will get value from the program, but I consider bug bounty programs a nice-to-have part of an application security program.  The real assurance comes from secure coding and verification processes across the software development lifecycle.”
Hacked
Jeff Williams, Co-Founder, Chief Technology Officer

Jeff Williams, Co-Founder, Chief Technology Officer

Jeff brings more than 20 years of security leadership experience as co-founder and Chief Technology Officer of Contrast Security. He recently authored the DZone DevSecOps, IAST, and RASP refcards and speaks frequently at conferences including JavaOne (Java Rockstar), BlackHat, QCon, RSA, OWASP, Velocity, and PivotalOne. Jeff is also a founder and major contributor to OWASP, where he served as Global Chairman for 9 years, and created the OWASP Top 10, OWASP Enterprise Security API, OWASP Application Security Verification Standard, XSS Prevention Cheat Sheet, and many more popular open source projects. Jeff has a BA from Virginia, an MA from George Mason, and a JD from Georgetown.

Previous

Point of View: Army's Public Website Hacked by Unknown Intruders
Next

Staying Compliant with PCI DSS Can Be Easier Than You Think