Innostage creates a new methodology for evaluating blue hackers

[Lord777]

Innostage, an integrator and developer of digital security services and solutions, is developing a new methodology for evaluating the performance of blue hackers participating in cyber battles. It will make the process of creating defender ratings uniform, clear, and transparent. This was reported to CNews by representatives of Innostage.

Today, cyberbits are one of the most effective tools for finding highly qualified information security specialists and developing their competencies. The red and blue hacker ratings compiled based on the results of cyber battles help companies understand which of the contest participants are valuable personnel. Ratings of red hackers are now quite transparent, as they are compiled on the basis of evaluating the work of teams, and have the main component-determining the number of successful attacks. And blue hacker ratings are quite subjective, they do not reflect the full contribution of teams to infrastructure protection, since their criteria do not cover all aspects of the work of blue hackers. There is no common understanding of what can be considered an incident.

The Innostage method will allow you to effectively evaluate the work of blue hackers. For example, points will be awarded in accordance with specific and measurable indicators of the level of skills and knowledge of defenders and the effectiveness of their work (incident detection, response time, and prevention).

"It is necessary to standardize the scenarios of all cyber battles, their organizers, various vendors in the field of information security, should create a working group and start discussing the development of standards. This will help blue hackers ' ratings be equally considered in the business community. And it will give defenders confidence that the results of their participation in any cyber battle will be credited to the employer. The Innostage methodology will allow cyberbatv organizers and infrastructure owners to better understand the shortcomings in the work of teams and the shortcomings of their information systems, " said Anton Kalinin, head of the Innostage Cybersecurity Skills Development Center.

To ensure that the methodology for evaluating the work of blue hackers is not only objective, but also transparent, it is necessary to make the process of calculating and summing up indicators completely understandable for defenders, taking into account all aspects of their work. It is also important that rating creators give defenders feedback – they need to understand which aspects of their work have received a positive assessment and in which areas they need to develop. It is important to post the final ratings in the public domain – so they will become widely known and motivate defenders.

At the same time, rating creators should guarantee blue hackers full protection of their confidential data, which should be built in accordance with the basic principles and standards of information security, in order to prevent leaks of confidential information of defenders and the use of ratings of their work by intruders.

 

[Carding Forum]

The IT company Innostage, a system integrator in the field of digital security, has added new conditions to its open cyber testing program. They relate to rewards for intermediate actions on the way to the implementation of an invalid event (NS).

On May 26, when launching open cyber tests on the Standoff Bug Bounty platform for security researchers, Innostage identified the theft of 2 thousand rubles from the corporate financial system and their transfer to controlled hacker accounts. For the successful implementation of the proposed scenario and a report on the actions taken, the company undertakes to pay 5 million rubles.

Open cyber tests are a format for checking for cyber stability, the rules of which are formed in the process of conducting "pilot" launches. In the future, Innostage plans to implement the practice of open cyber testing as widely as possible, forming a new industry standard. More than 360 hackers responded to the offer to assess the level of digital sustainability of a business and its reliability for customers, but none of them has yet managed to hit the jackpot.

Based on the results of a month-and-a-half monitoring of the actions of independent researchers, Innostage Information Security decided to encourage their activity and is ready to additionally reward them not only for the implementation of an unacceptable event, but also for other significant actions.

Starting from July 10, the following remuneration conditions will be introduced: compromise of the company's corporate user account with pinning on a corporate workstation — 100 thousand rubles; overcoming the network perimeter and pinning on a node in the infrastructure — 200-300 thousand rubles. (depends on the type of node, account, or segment where this was done); getting access to the financial accounting system and creating payment orders under a relevant or privileged account for an invalid event — up to 1 million rubles.

"Initially, we set a very difficult task for white hackers. Our unacceptable event can be compared to setting an Olympic record, where, despite hundreds of failed attempts, motivation and perseverance ultimately help athletes achieve their cherished goal. Incident monitoring shows that experienced cybersecurity researchers were invited to participate in our open cyber trials, and we decided to support them by introducing interim rewards on the way to implementing the NA," said Ruslan Suleymanov, Director of Digital Transformation at Innostage.

 

[Friend]

IT company Innostage has announced a twofold increase in remuneration for participants in open cyber trials (OHI). The program is implemented on the Standoff Bug Bounty platform for security researchers and is designed to test and improve the cyber resilience of businesses.

Under the terms of the CMI from Innostage, an unacceptable event is the transfer of up to 2000 rubles from the company's accounts to the controlled accounts of independent researchers. At the start of the program, on May 26, white hackers were promised a reward of 5 million rubles for the implementation of the accident and a report on the actions taken. On the first day of the international IT forum Kazan Digital Week, Innostage increased the rate to 10 million rubles.

At the same time, intermediate rewards for information security researchers who were able to penetrate the infrastructure, but were stopped halfway to the goal by specialists of the Innostage SOC CyberART Center for Countering Cyber Threats, remain within the same limits. Compromise of the company's corporate user account with a pin on a corporate workstation – 100 thousand rubles. Overcoming the network perimeter and fixing on the node in the infrastructure is 200-300 thousand rubles. Gaining access to the financial accounting system and creating payment orders under a relevant or privileged account for an invalid event — up to 1 million rubles.

To date, more than 600 independent information security researchers have registered as participants in open cyber tests. The decision to increase the main reward is aimed at attracting even more highly qualified security researchers, as well as speeding up the process of detecting and eliminating critical vulnerabilities.

"By increasing remuneration and making the program more attractive to experienced researchers, we plan to increase the likelihood of identifying the smallest vulnerabilities, the exploitation of which can lead to risks to the business. Our goal is to continuously improve our cyber security, responsibility and reliability as business partners. And we are ready to pay millions of rubles to independent experts who will help us with this," said Ruslan Suleymanov, Director of Digital Transformation at Innostage.