Humans build communities of varying sizes, but there is a significant correlation in memberships of around 50 or 500, and even more often 150. This is known as the Social Brain Hypothesis[1]. Online social communities tend to follow the same fractally-described pattern and tend to be larger than in-person groups because there are no physical limits on how many can meet.
In terms of technology, online communities have completely changed the way the world works. Online communities of technology experts built the software infrastructure on which the entire internet functions. And now, in 2021, the vast majority of the software that runs on top of the internet (applications, servers, databases, services) is community-created and maintained.[2]
There are some amazing examples of community work in software that touch every person’s life practically every day: the Apache and NGINX web servers that publish most of the world’s websites and the Linux and BSD-based operating systems that run practically everything are two examples.
Source: Shutterstock
The power of communities stems from the adage of “many hands make light work,” where online it’s easier to find peer review for quality checking, people with specialist knowledge, mutual support networks, and a focus on an end-goal that everyone gets to use for free.
Unfortunately, hacking groups use the same community basis: sharing knowledge, checking each other’s work, and profiting from the combined labors of many. In response to community-driven bad actor groups, Crowdsourced Security Platform company Synack fights fire with fire: community-based white hats working together to combat cybercrime.
Fingers crossed security
Most organizations actively protecting themselves against cybercrime (and many take few or no steps to protect themselves[3]) rely on combinations of specialist solutions, like software agents on endpoints, packet filtering, port-based firewalls, zero-trust structures, and CASBs. To test their defenses, on occasion, they undertake penetration testing exercises.
Traditional pen testing is usually time-limited; two weeks is typical. It involves dedicated personnel onsite, and a pre-prescribed checklist that the experts work their way through, encompassing common attack vectors and methods, with results and recommendations coming in the form of a written report.
Despite the limitations of this form of testing (more on the common shortfalls in a moment), it’s an essential part of any proactive cybersecurity stance. After all, the organization must check it’s spending its defense budget as effectively as possible.
Source: Shutterstock
But penetration testing done in this manner is, by definition, limited. A couple, or even a couple of dozen, pen testers can only achieve so much, and there are no guarantees that the professionals onsite are suitably qualified or are doing any more than undertaking a box-ticking exercise.
Furthermore, it’s more than likely that while performing the test, the IT stack and its topology will have changed. Much will be different a year after the event, and new attack surfaces will have been presented.
Community-powered security
Synack operates a community of skilled and highly vetted security experts[4] that bring the latest security methods — and hacking methods — to bear on an organization’s defenses. Penetration testing exercises take place on a premier crowdsourced platform created by Synack, where the security community can congregate, share best practice, latest methods, and knowledge. This is, effectively, crowdsourced security through community-powered penetration testing.
There is nothing to stop a company from utilizing the large community of cybersecurity experts online all over the world. The issue is one of practicality and logistics. Organizing personnel, vetting credentials, providing training, creating peer review and support networks, and paying the pros for their time: these are the activities Synack takes care of, without budgetary surprises, under complete control, and with complete confidentiality.
Source: Shutterstock
The company ensures that the best people stay at their best, with training, peer review of others’ work, even a little friendly internal competition for results now and again! It also covers remuneration in various currencies, corralling the right people at the right time, scheduling work, and helping the community to thrive and prosper.
Users of the Synack crowdsourced platform will receive:
– highly vetted researchers that have been rigorously tested and screened (over five stages)
– the power of many from the cybersecurity community, from a single source
– a body of expertise that’s self-regulating and self-improving
– time-limited or continuous oversight by the team
– optional oversight and automated testing by Synack-designed security bots
Those companies and businesses that need the highest levels of protection, the top tiers of service comprise continuous human and automated monitoring and constant testing. There are time-limited options, too, for those that need a canonical scan of online systems done by the world’s finest cybersecurity professional (and their ‘bot helpers). All options can involve internal security staff of the client organization themselves being trained and mentored by Synack Team Red professionals, or the entire process can be outsourced.
To leverage the crowdsourced power of the cybersecurity community, reach out to Synack.
