Assessing Current Vulnerability Management Processes

This chapter provides the information on assessing current vulnerability management processes. A bug bounty program manager should be whoever does the day‐to‐day work in coordinated application or web application security measures. The most difficult part of the entire process of executing a bug bounty program for an enterprise is evaluating the risk and risk mitigation programs. Risk analysis requires visualizing how all of the parts of a security team come together, and rationally determining how it plays into application security. Secure coding platforms such as checkmarx codebashing and security awareness incentives such as hacking demos, security riddles, and other fun educational events can help break down any barriers that may exist between application security and software engineering. Application security managers should attempt to build rapport with the legal department immediately. Bug bounty programs are an amazing security tool. A good program can provide valuable insight and help enterprises continuously test their assets.