top of page
Elizabeth Rasnick

Day 45 of 100 Days of Cybersecurity - Bug Hunter Callahan


On Day 35, I talked about bug bounties. Today is a related topic: bug hunters. Bug hunters may be independent in their tracking or they may be an internal bug hunter. Many large technology organizations have internal quality assurance teams. Bug hunters could be part of this team or on their own team. It depends on the structure and functions of the organization. However they are managed, bug hunters have the task of locating flaws in code or in system settings that cause (or have the potential to cause) the system to work improperly.

Sometimes these flaws are created in-house. Other times bugs enter a system via purchased software or services. This can make tracking down the glitches difficult. In my time on a response team, we hunted bugs as part of our charge. The system we worked on was built in-house, however, it also integrated with partner systems. This just complicated matters. Our standard procedure if it looked like the bug was located in or on the edge of the integrated system was to hand-off the issue to the integrated team. They had the ability to examine both sides of the system.

We would receive a report of an issue. In order to find and fix it, we needed as many details as possible. Recreating the problem was typically the first thing we did. Doing this allowed us to pinpoint the location in the code where the glitch occurred. Then, it was a matter of combing through the process that code location belongs in and where the data used in it originates. From there, we would work backwards.


You may be wondering how bugs get into code or systems to begin with. I’ll explain. In the software development lifecycle, there is a testing phase. It is at this point that the quality assurance analysts (QAAs), also known as testers, enter the scene. Their mission is to run new or updated software and systems through as many tests as possible to ensure that it functions as expected. They are required to create a set of testing circumstances and input that will put the system through its paces. Limitations of time and resources prevent QAAs from being able to run absolutely every possible combination of inputs. This is what provides the opportunity for bugs to make it to production and the open market. The vast majority of QAA teams do their utmost to make sure they code they sign off on works properly. As a programmer, I was indebted to my QAA team.


Callahan serves as our bug hunter. He has a quick eye for identifying things that are amiss from their usual condition or situations that are likely to not go well. Callahan is happy working by himself and yet, knows when it’s time for him to pass something off to his big golden-lab sister. That’s important for bug hunters. He also knows when the task he is on calls for teamwork and he recruits his basset hound sister to help him in the underbrush.

1 view0 comments

Recent Posts

See All

Comments


bottom of page