Security influencers provide real-world insight and “in-the-trenches” experiences on topics ranging from application security to DevOps and risk management


Point of View: Tesla opens up bug bounty program


“Bug bounty programs have been surprisingly effective and I don’t see this being any different for Tesla.  I think they’re smart to start with their website as they learn how to handle the influx of security bug reports.  As they mature, they may eventually decide to extend the program to vehicles and more critical systems, but I wouldn’t expect it to happen very soon.  Letting people play around with the website is one thing, letting them attack a vehicle is a whole different matter.

These bug-bounty programs are getting real value, but there are costs too.  There are many reported flaws that are not actually vulnerabilities.  It takes work to track these down and deal with them. Most of these programs are run by organizations with a small number of very critical applications. I strongly recommend these programs as part of a balanced application security breakfast.  I hope Tesla has done as much security work as they can before this launch.  But once they've reached the limit of their security abilities, why not get some help from the rest of the planet.  The planet is doing the hacking anyway… all they want is a little recognition. 

I’m sure that Tesla will get value from the program, but I consider bug bounty programs a nice-to-have part of an application security program.  The real assurance comes from secure coding and verification processes across the software development lifecycle.”

Jeff Williams, Co-Founder, Chief Technology Officer

Jeff Williams, Co-Founder, Chief Technology Officer

Jeff brings more than 20 years of security leadership experience as co-founder and Chief Technology Officer of Contrast. Previously, Jeff was co-founder and CEO of Aspect Security, a successful and innovative application security consulting company acquired by Ernst & Young. Jeff is also a founder and major contributor to OWASP, where he served as the Chair of the OWASP Board for 8 years.