Windows 10: MSRC Recognizing Security Researchers in 2020

Brink · Feb 4, 2020

Is it too early to talk about the 2020 MSRC Most Valuable Security Researchers? Five months from now, at the end of June, the program period closes for researchers to be considered for inclusion in the Most Valuable Researchers list. The top researcher list will be revealed at Black Hat North America in August.

For now, we want to explain who will get recognized as a MSRC Most Valuable Security Researcher for 2020, introduce the new MSRC Contributor tier in our researcher recognition program, and share some tips that can help you get into our top researcher tiers.

2020 Most Valuable Security Researcher

How do I get in?

Similar to last year, we take report volume, accuracy and impact into consideration. Here are the two paths to get into this top tier for reporting over the program period:

Path One: Contribution-based (recognizes a larger body of work)

Volume: you reported at least five valid vulnerabilities during the evaluation period

Accuracy: at least 50% of your reports are valid (your accuracy score)

Impact: the average points of your valid vulnerability reports put you at or above the 50th percentile for report impact

Path Two: Impact-based (recognizes a smaller body of higher-impact work)

Volume: You reported at least three valid vulnerabilities during the evaluation period

Accuracy: at least 50% of your reports are valid (your accuracy score)

Impact: the average points of your valid vulnerability reports put you at or above the 90th percentile for report impact

What do I get?

If you are identified as a 2020 MSRC Most Valuable Security Researcher, you’re eligible for benefits, including but not limited to:

Annual recognition on the MSRC’s Most Valuable Security Researcher list

Special SWAG box for Most Valuable Researchers

Access to Microsoft products and services for research purposes

Access to invitation-only MSRC events

Invitation to private MSRC programs

How about the ranking?

Either the contribution-based or impact-based model can get you into the top tier. Once you’re in, your rank within that tier will depend on the total number of points you’ve received.

2020 MSRC Contributor

How do I get in?

MSRC Contributor is the next tier in our researcher recognition program. The criteria for getting into this tier are:

Volume: you reported at least three valid vulnerabilities during the evaluation period

Accuracy: at least 50% of your reports are valid (your accuracy score)

Impact: the average points of your valid vulnerability reports put you at or above the 50th percentile for report impact

What do I get?

If you are identified as a 2020 MSRC Contributor, you’re eligible for, including but not limited to:

Special SWAG box for MSRC Contributors

Access to invitation-only MSRC events

When do I need to report by to be considered?

The program period for the 2020 Most Valuable Security Researcher and MSRC Contributor includes cases that fall into either of these categories:

Reported and assessed by the MSRC team between July 1, 2019 and June 30, 2020

Submitted between July 1, 2018 and June 30, 2019 (last program period), but assessed after July 1, 2019

What’s next?

We are five months away until the end of the program period. Here are some tips to help you get into the top tier:

Research in certain areas (e.g. Azure and Identity) can help you earn additional research multipliers. Check out our MSRC Recognition Program page showing you where you can find additional multipliers to improve your standings.

Focus your reach on critical and high impact vulnerabilities to get higher base points. Here are some useful readings:

Security Update Severity Rating System

Directory of Azure Services

Example of High Quality Reports

Microsoft Documentation for end users, developers, and IT professionals

Microsoft Security Research & Defense Blog

HackerOne’s Hacker101 training

Bugcrowd University

Ready to submit your next vulnerability report? Submit it today via our researcher portal aka.ms/secure-at.

Sylvie Liu, Security Program Manager, Microsoft Security Response Center
Click to expand...

Source: https://msrc-blog.microsoft.com/2020...chers-in-2020/

Tweet

— Twitter API (@user) View on Twitter
Click to expand...

:)

Brink · Feb 4, 2020

MSRC 2017 list of Top 100 security researchers

Security researchers play an essential role in Microsoft’s security strategy and are key to community-based defense. To show our appreciation for their hard work and partnership, each year at BlackHat North America, the Microsoft Security Response Center highlights contributions of these researchers through the list of “Top 100” security researchers reporting to Microsoft.

This list ranks security researchers reporting directly to Microsoft according to the quantity and quality of all reports for which we’ve issued fixes. While one criteria for the ranking is volume of reports a researcher has made, the severity and impact of the reports is very important to the ranking. Higher-impact issues carry more weight than lower-impact ones. While this list does not include security researchers who report to our partners ZDI and iDefense as we do not always have full information to recognize their efforts, we very much appreciate the partnership with ZDI and iDefense as they ensure that we know about any reports affecting Microsoft products.

Given the number of individuals reporting to Microsoft, anyone ranked among the Top 100 is among some of the top talent in the industry. Regardless of where security researchers are ranked in this list, we appreciate their active and ongoing participation with the Microsoft Security Response Center, and encourage new researchers to report potential vulnerabilities to us at L: secure@microsoft.com. We’re excited to see who’s going to be on the list next year.

MSRC team
Click to expand...

Source: The MSRC 2017 list of “Top 100” security researchers MSRC

Brink · Feb 4, 2020

Announcing 2019 MSRC Most Valuable Security Researchers

Earlier today we announced MSRC’s 2018-2019 Most Valuable Security Researchers at Black Hat. The following 75 researchers hail from all corners of the world and possess varied experience and skills, yet all of them have contributed to securing the Microsoft’s customers and the broader ecosystem.

For over a decade, one of Microsoft’s partners in vulnerability research and disclosure has been Trend Micro’s Zero Day Initiative. In addition to ZDI’s vulnerability rewards program, Trend Micro is a longstanding member of the Microsoft Active Protections Program (MAPP). This year Trend Micro’s original security research was tracked with the community contributions of the ZDI program, and subsequently only recognized in our individual Most Valuable Researcher program. Moving forward, Trend Micro original research will also be recognized in our MAPP Top Contributing Partners program, better recognizing the substantial impact Trend Micro has in protecting Microsoft customers as well as the broader ecosystem.

If you are interested in how we identified the Most Valuable Security Researchers this year, our Recognizing Security Researchers in 2019 blog provides additional details on our points model.

Looking forward to another great year working with all of you!

Sylvie Liu, Security Program Manager, MSRC Community Programs
Click to expand...

Source: https://msrc-blog.microsoft.com/2019...y-researchers/

Tweet

— Twitter API (@user) View on Twiiter
Click to expand...

Brink · Feb 4, 2020

Announcing 2019 MSRC Most Valuable Security Researchers

Earlier today we announced MSRC’s 2018-2019 Most Valuable Security Researchers at Black Hat. The following 75 researchers hail from all corners of the world and possess varied experience and skills, yet all of them have contributed to securing the Microsoft’s customers and the broader ecosystem.

For over a decade, one of Microsoft’s partners in vulnerability research and disclosure has been Trend Micro’s Zero Day Initiative. In addition to ZDI’s vulnerability rewards program, Trend Micro is a longstanding member of the Microsoft Active Protections Program (MAPP). This year Trend Micro’s original security research was tracked with the community contributions of the ZDI program, and subsequently only recognized in our individual Most Valuable Researcher program. Moving forward, Trend Micro original research will also be recognized in our MAPP Top Contributing Partners program, better recognizing the substantial impact Trend Micro has in protecting Microsoft customers as well as the broader ecosystem.

If you are interested in how we identified the Most Valuable Security Researchers this year, our Recognizing Security Researchers in 2019 blog provides additional details on our points model.

Looking forward to another great year working with all of you!

Sylvie Liu, Security Program Manager, MSRC Community Programs
Click to expand...

Source: https://msrc-blog.microsoft.com/2019...y-researchers/

Tweet

— Twitter API (@user) View on Twiiter

Windows 10: MSRC Recognizing Security Researchers in 2020

MSRC Recognizing Security Researchers in 2020

MSRC Recognizing Security Researchers in 2020

MSRC Recognizing Security Researchers in 2020

MSRC Recognizing Security Researchers in 2020 - Similar Threads - MSRC Recognizing Security

Filing an MSRC Report

Filing an MSRC Report

PROBLEM MSRC

Announcing 2019 MSRC Most Valuable Security Researchers

MSRC Website Not Allowing Submissions

Security researcher pleads guilty to hacking into MSFT and Nintendo.

Inside the MSRC - How we recognize our researchers

Inside the MSRC - The Monthly Security Update Releases

MSRC 2017 list of Top 100 security researchers