KM
Kamil Malinka
We keep saying there are not enough security experts, while cybersecurity students are still practicing on problems nobody needs solved because we are afraid to let them test real systems. Attackers won’t ask for permission.
— On the schedule —
Student Bug Bounties for OpenSSL-Based Products
Organizations lack security experts, while universities need meaningful ways to teach practical cybersecurity. Our research explored whether bug bounty programs can help address both problems. Over the past four years, we have integrated real-world bug hunting into cybersecurity courses. Students work on commercial bug bounty programs and, more recently, internal university systems. Most find real vulnerabilities, while the assessment focuses on methodology rather than successful discovery, keeping the assignment fair and realistic. The talk summarizes our findings on the educational benefits, legal and organizational barriers, and practical lessons from running this model. It also discusses whether similar university partnerships could provide open-source projects with additional capacity for security testing. Could OpenSSL be next?
— Compositor's note —
Kamil Malinka is an associate professor at the Faculty of Information Technology, Brno University of Technology (FIT BUT), where he leads the Security@FIT research group focused on information technology security. His current research centers on the security aspects of artificial intelligence in two main areas. The first focuses on deepfakes, including their detection, source attribution, forensic analysis, and the risks associated with their misuse. The second focuses on the security of large language models, particularly model integrity, LLM forensics, and emerging topics related to AI Bills of Materials (AI BOMs). In his teaching, he focuses on cybersecurity and systematically incorporates emerging trends and technologies, including artificial intelligence, while examining their impact on both education and professional practice.