Salesforce and Zoom embrace ethical hackers. You should, too

This was HackerOne’s H1-4420 event, an annual fixture for a few years now, and at this year’s show, both Salesforce and Zoom put their platforms under the microscope.

For Salesforce’s Swartz, participating in the event was an opportunity to connect with and learn from the hacking community, increase the exposure of the Salesforce product set to ethical hackers, and seek feedback on what elements of its bug bounty programme were working well and which needed improvement.

“Something that was super valuable was being able to sit down and pick the brains of these hackers in terms of their methodology,” she says.

“As the threat landscape continues to evolve, I think it’s so helpful to not only work internally on evolving what that looks like in terms of security measures, but also to really understand what hackers are thinking about and what new strategies they are bringing.

“We started the day with intros and a welcome ceremony. And then the hackers just started working. There was a silent room where hackers could just focus on their work, there were common areas where hackers could collaborate, and a separate space for our triage team to intake those vulnerabilities, take quick action, review reports, coordinate on meetings with internal teams, and make sure that we can find, verify and fix, all within the same day,” she says.

Under normal circumstances, Salesforce coordinates with hackers from all over the world, so Swartz found being able to talk directly with them, ask them questions, and make sure her internal teams had all the needed details – or could revert to a hacker to ask them a question without having to wait for them to wake up in their time zone – exceptionally helpful.

“It was so cool to be able to look into a room and see five hackers sitting at a table and working on the same thing and learning from one another,” she says.

“At the end of the day, we had a ‘show and tell’, and it was great to see hackers looking at one another’s findings. That’s another value point of running a live event – it’s not only our team learning and evolving the way we think about bugs, but also seeing other hackers learn from the best,” she adds.

For the event, Swartz also provided a series of focus areas and target products that Salesforce wanted addressed – these included Commerce Cloud, Field Service Lightning, MuleSoft Anypoint Platform and Slack.

Zoom’s team rolled up to the venue near Liverpool Street Station off the back of a similar event in Las Vegas, with similar goals to Salesforce’s. “For us, it was an opportunity to put the full platform out there in front of security researchers and have them take a run at it,” says Adams.

“As we look to expand our impact in the market, it’s not about being first, it’s about being best, and this is a critical component of being best to market in my mind; security and privacy being part of the fabric of the company”

Michael Adams, Zoom

“I emphasise the full platform piece because that’s really important to us as we grow and diversify. It’s not just a focus on video comms or team chats, we spread out and present the whole play, which now includes things like Zoom Mail and Calendar, or Zoom IQ, which is our AI offering.

“As we look to expand our impact in the market, it’s not about being first, it’s about being best, and this is a critical component of being best to market in my mind; security and privacy being part of the fabric of the company,” he says.

Adams also wanted to test out a new, in-house Vulnerability Impact Scoring System (VISS). Zoom’s proprietary VISS is designed to complement the general Common Vulnerability Scoring System (CVSS) used by the security community at large.

“VISS allows us to tailor the security researchers’ work so that we’re focused on the things that are most important, that have the highest level of impact, and then our payouts are oriented accordingly,” he says. “So not only did we get the concentrated focus of the security researchers, but we got them to use VISS for the first time.”

Adams went into the hackathon fully prepared to receive all sorts of feedback and action changes to VISS based on that. This mentality paid off, and Zoom has since worked with one of the participants to weave more detailed examples of how severe a vulnerability may be in the real world into VISS. Adams hopes this will help hackers understand where they may want to focus their fire and what kind of payout they can expect.

“I don’t want security researchers to waste their time. I want them to know what is most impactful to us. I want that to be very clear and I want them to be able to focus their work in those areas,” explains Adams.

“That isn’t to say that if there’s a low or medium [impact] vulnerability I don’t want to know about it, but I’d much rather know about a high or critical [impact] vulnerability,” he adds.

“Not only do I want to pay accordingly, but I want to incentivise accordingly, and if I can’t provide clarity within my scoring system, it’s hard for them to understand. We’re now able to provide a certain degree of clarity – we iterated through the events and now we have some takeaways to move forward with and continue to refine the VISS,” says Adams.