WEBVTT 0:00:15.520 --> 0:00:22.480 Programming throwdown episode 130 Ethical Hacking with Ted Harrington Take it away, Jason. 0:00:23.200 --> 0:01:40.010 Hey everybody. So this is a super, super exciting episode. I think I remember and I'm totally drawing a blank, but there was, I remember some movies from the 90s about hacking. And when I got into computing when I was in high school and middle school, there weren't a lot of folks who were into it, at least in my neighborhood, in my area. And everyone thought that that was hacking. Like, oh, you know how to program. Does that mean you can just, you know, plug, plug into this ATM and take all the money? And sadly, I've never been able to do that, but it would be pretty awesome if you could just get money that easily. But I've always had a fascination with it. I think that it's an intersection of so many different disciplines. Sociology, psychology, computing, networking, so many different areas. And we've been wanting to do this episode for a really long time. I'm so excited that we have Ted Harrington, who's number one best selling author and a partner at ise, who's going to explain all about hacking and ethical hacking and what that all means. So thank you so much for coming onto the show, Ted. 0:01:40.010 --> 0:01:41.370 Yeah, thanks for having me, guys. 0:01:41.450 --> 0:01:55.600 Cool, so let's maybe just start with a bio on you. So how did you get into kind of this industry and what was sort of the path that led you to ise, where you're at right now? 0:01 --> 0:04:08.930 It's funny you mentioned hacking ATMs because there was this funny thing that happened in college. This is a little bit tangential, but it will color the picture a little bit. I went to school in Washington D.C. and it doesn't matter that it was DC. I went to college and ATM on campus. And I remember there was this thing that happened one time where there was a bug in the software where whatever the denomination was that you typed in the ATM actually spit out four times that. So like people were putting in, you know, a hundred dollars that they want to take out and they were getting 400. Wow. And so of course, you know, once the word spread about this, the whole student body went and like emptied this atm. It happened in like an hour. And I remember that time it sort of struck me, but it was one of these seeds of a thought that stayed in the back of my mind. I didn't really do anything with it at the time, but was, wow, software really runs everything. And when the software bugs out, you know, really bad things can happen. And it's kind of interesting to think that you know, that was however old I was in college, I don't know, 20 or something. And, you know, fast forward to many years later. That is my profession now is not specifically necessarily robbing ATMs, but helping companies who are building things using software to make sure that stuff like that doesn't happen. And I first got into it about 10 years ago when I met a guy who. Who has become my business partner now. And at the time, we were just talking about some of the things he was doing with his business, and I was talking about things I wanted to do with my life and some of my principles and philosophies, and they just. It was like the perfect marriage. You know, I'm. I'm driven to do difficult things that matter in the service of others. I want to get better every day. Like, those are kind of some of my defining principles, and those are the principles that are required to succeed in security. And so once I sort of found that, it was like, this is what I got to do. And I've since dedicated, you know, my entire life to it. And now I'm in the position that I get to lead a. Some of the smartest group of ethical hackers ever, anywhere. And that's what we do all day, is help companies build better, more secure systems. 0:04:09.090 --> 0:05:29.220 Wow. Super, super cool. So I have a similar story. It's not my story, but I'll share it anyways. And, Patrick, you also took this. We both took VXWorks training, probably at different times, definitely different times. But Patrick probably just breezed through it. I was having trouble. I hadn't done any embedded stuff, and so I was. I was working my way through it. But I remember the instructor saying that he noticed the gas dispenser at a gas station was running VX works, and he noticed it because it had a certain JTAG kind of connector. And he just connected in and got a VXWorks terminal. And he found that the price of gas was literally just called price of gas, and it was a global variable in the program. So he just changed it to zero, pumped his gas for free, and then. And then went back and like, you know, reported it to whatever, you know, multinational was running that gas station. But. But yeah, it does sound like, you know, the early days of computing was sort of this wild west. And then through a lot of work, you know, done by people like you, it's just. The security has just become a lot tighter now. And, you know, there's a lot more on the line now than there used to be back then, when, when you know, things weren't as so tightly connected as they are now. 0:05:29.540 --> 0:07:06.760 Yeah, I would, I would actually maybe even challenge the assumption that things are tighter now, because this is going to sound contradictory. They are and they aren't. So what's really good that we see happening all over the place is that where the efforts of the security community, the security research community, the ethical hackers, like, where those of us that are really driving and pushing for this type of improvement in security, where we focus our efforts, it is changing. Like things are getting better. But the problem is that the world, I mean we're talking about the entire planet, is so relentlessly adopting software to replace previous processes or systems. Sometimes they were often very done manually or by human action, are now being done by computers. And new ways of applying computational approaches are constantly being innovated. And that itself introduces two problems. One is change. Any type of change fundamentally adjusts the security model. But two, the second part of the problem is that oftentimes people will think, oh well, this is completely new. This is like the new age, state of the art, whatever, fill in the blank. We don't have to worry about those security challenges the same way anymore. It's like actually you have to worry about them more because it's now a different thing. So that mindset really becomes quite a problem. So I'm not necessarily disagreeing with you fully, but I'm just modifying the way you stated it. Some things are getting tighter, but some things are actually getting worse. And actually both are happening at the same time. 0:07:07.160 --> 0:07:36.500 Ah, interesting. Yeah, that makes sense. Yeah, it's a real arms race. It's an arms race between the ethical and the non ethical hackers. And it's also an arms race between the ethical hackers and productivity. The developers who want to just get this beta version of this code out really quickly and who cares if it has some security issue. We just need to get this result really quick. And so it seems like there's a sort of triangle there. 0:07:37.060 --> 0:09:47.530 So there's a lot of truth in what you just said. The conflict actually is less that developers don't care about security. I think any developer listening to this right now would probably dispute that because they're being told like either they already care about it or they're being told by their boss or any member of the leadership in the company like, you have to care about this. The problem isn't whether they care or not. The problem is how are they going to do that? Because building and breaking are two fundamentally different things. So here's a Way to think about it. I'm a big believer in using metaphors to try to explain what can be sometimes really complicated ideas. This one I don't think is that complicated. But this idea that you think about building a skyscraper right there is a person, a type of general contractor who, that's what they specialize in, they build high rises. If you went to that contractor and you said, okay, now we need you to be the demolition expert, can you demo skyscraper? They'd be like, maybe, yeah, I mean, I guess I know where the weaknesses. I could probably, yeah, yeah, okay, let's do that. But would they know what they're doing relative to the person who spends every waking minute demoing buildings? Right. It's like it's an impossible ask to think that just because they're related that someone can be the expert in both. And that's really, that's what businesses are asking of developers. They're like, you have to build it and you also have to be the expert in how to break it. And that's just unreasonable and that's impractical. And when push comes to shove, and when the boss says to the developer, you have to build it, it has to be done by this period, by this time, has to meet this quality standard. Oh, and it has to be secure. When push comes to shove, what's going to get axed, the security part, because it's also not what the developer's area of expertise is. So that sucks for a developer, right? Because that, that's, that's really bad for a developer because they're being pushed into this difficult box of so much empathy for that situation that they're in. Once we realize that is the business problem that it is, then we can start to figure out how do we address it. 0:09:48.570 --> 0:11:32.550 Yeah, that totally makes sense. Yeah, I think, yeah. To get to your analogy, I think there's a whole bunch of really interesting things, bits there on how people demo buildings in real life and how they make it so the building implodes, it doesn't fall on another building and kill a bunch of people or something. And so people who build buildings wouldn't know anything about that. And speaking from experience, I've built a lot of software and we had an issue, this is about a year ago where we had a external facing website for a team. My team was working on an open source system that was, you know, published in the open source, you know, really for brand awareness and advertising of our work and to contribute back to the research community. And we had an internal version and you Know, to kind of cut the story short, one of the engineers accidentally allowed anybody to, to take over to hijack our website. And, and there was a team internally that actually is just focused on hijacking company websites. And so within, I want to say within maybe even less than an hour, I mean, it must have been automated. Basically, they instantly hijacked our website and then, and then they set up a meeting on our calendar where we could talk about how we totally got owned and they explained a whole bunch of stuff to us that us researchers did, had never known before. But, but yeah, I mean, that team totally saved our bacon because we didn't. It would have been terrible if we had been hijacked by somebody else. 0:11:32.950 --> 0:11:45.910 Totally. Yeah. Well, I'm glad they reached out to you. They went through, it sounds like they went through responsible disclosure. There's maybe some questionable parts of what exactly they did. But yeah, you're right. You want the good guy to find it, not the bad guy to find it. 0:11:45.910 --> 0:12:06.530 Yeah, totally. So, so this is really interesting. So you were, you're in D.C. and you were in college. Right. And so you, you met this gent, you were in college and the two of you. Yeah. Can you bridge the gap from that to go to ise? Did you start ISE right then and there or is there what's in the middle there? 0:12:07.970 --> 0:15:24.080 No, there was actually a pretty significant gap there. And one of the things that I would highlight out of this is for anybody who's right now thinking about security as a career but thinks, well, I don't know as much as all these other people or I don't have enough, you know, the ship is already sailed, I'm already down. Whatever this engineering path is that I'm down, it's not too late. I didn't enter security until I was, I would have probably been at that point, I should know this, but I would have been probably my late 20s. So, you know, I'd been in, I'd had 10ish years of a career already and so I knew nothing by my late 20s. And then over the course of 10 years, I went on to figure out how to write a number one best selling book on the topic. And so if I can do it, other people can figure it out too. And the time in between, I was essentially, I wasn't in, I wasn't even in tech. I was chasing my entrepreneurial dreams, which was, you know, I was looking for some mentorship. So I worked at a company for a little while that I was able to work directly under the CEO of this one company. And then I became the CEO myself of a tech company that was focused around water. And then I met the guy who had become my business partner. Almost by chance, we knew a guy in common. I knew this guy from the NSA who went to the PhD program with my business partner. And this guy in common was like, you guys are in such different worlds, but you should meet. And. And so we did. And so, in a sense, it was being open to whatever opportunities might present themselves, because on paper, like, we shouldn't even have met each other. We were just, like, in such different worlds. And we knew pretty much right away because philosophically, we were very aligned. And in a way, all those years, not insecurity at all have helped me be able to be a better communicator about security, because I came in to this profession so much later than most people. I mean, I'm surrounded by people who are like, oh, yeah, I, like, ripped open a video game console when I was five. And I'm like, I didn't. What? I didn't even know what the principles of security were until I was like, 29. You know, like, there's a huge difference between that. But because I was able to come from this other perspective that was like, explain that to me. I don't understand that. All of the assumptions that I should know anything, I was not troubled by them. And that's one of the things I think holds a lot of people back. They're like, oh, I have a degree in computer science. I should probably know this thing. So I'm not going to ask a question that might make it seem like I don't know what I'm talking about. I'm like, hey, guys, Ted here. Don't know what I'm talking about. Quick question. And because of that, I was able to sort of, like, build this foundation of knowledge over a long period of time. And that was something I hope everyone listening to this can realize. Like, no one knows anything about anything. So just ask questions. No one's gonna judge you. Like, we all have imposter syndrome. We all think we're not smart enough. Just keep pushing and asking questions and you'll figure it out. 0:15:24.960 --> 0:17:28.480 Yeah, that's really, really good advice. Yeah, definitely. I think, you know, every job that I've ever had, I went through the imposter syndrome phase where basically I said, you know, I, you know, I kind of, you know, I got lucky in this interview. Or, you know, I interviewed at four places and I picked one job. That's because, you know, I Got lucky that one time and, you know, or you know, I really oversold myself in the interview. And now I don't know what I'm doing. This is completely common. Everybody goes through imposter syndrome every single time. And so I think that the thing that over time I've learned, it's kind of like I'm trying to remember what there's a program, but the first step of, I think it's like Alcoholics Anonymous or something. But the first step of a lot of these programs is like, recognize, you know, be able to see yourself from the outside as an outsider. And so I've learned that, you know, this imposter syndrome, I can kind of see it from the outside. And now when I start something new, a new team or a new job or new whatever, I say, look, I'm going to go into this, you know, the dumbest person in the room on this subject, and I'm going to know I'm the dumbest person in the room. And everyone else is going to know that. And that's okay. That's totally fine. Because the company is not hiring you or that person is not hiring you. If you're a freelance developer for what you can do in the first five minutes, they're hiring you to do a task that's going to take months, maybe even years. And especially if you're doing things that require NSA clearance. And these things, they have to have multiple year horizon when they, when they evaluate somebody. And so I think, you know, that you're always going to have that imposter syndrome. But recognizing it for what it is helps tremendously. 0:17:29.920 --> 0:18:36.130 Totally. I mean, I even think if for anyone who feels the imposter syndrome, which maybe we should define that real quick. For anyone who doesn't familiar with this, the idea is people who feel like I'm not smart enough, I shouldn't be in this room, I shouldn't be in this job. There's other people smarter than me. That's called the imposter syndrome. And I think anyone who feels that way actually is probably one of the smarter people in the room. Because you recognize there's more to learn. There's always someone who's more of the expert at something. And the fact that someone's more of an expert than you doesn't make you stupid. It makes you on the path to becoming an expert yourself. Or it makes you smart to realize that, let me get the expertise of this other person to help me solve this problem. And maybe I know, maybe I don't even ever want to become that expert. Like, I don't want to become an expert on how to fix plumbing in my house. I don't want to do it right. I am always going to have an expert plumber. I'm not going to watch YouTube videos to figure out how to re plumb any part of my house. I'm going to hire somebody. And I think that's, there's strength in that and realizing like, okay, well, I'm going to choose my brain power to focus on something else. Right? 0:18:36.850 --> 0:19:31.780 Yep, yep. Yeah, totally agree. So. So when a lot of people think about hacking, so we'll talk about hacking and then we'll talk about ethical hacking. When people think about hacking, I think there's two extremes. I think on one extreme, people think it's like csi, that meme where the person's like, I'm going to write a Visual Basic script to trace the hacker. Done. And now we know everything about them. And then there's the other extreme where they feel like there really is no such thing as technical hacking. It's all just phishing and sort of social engineering. Right. And so kind of where are things? How has that spectrum kind of changed over time? And what really is hacking? At the end of the day, that's. 0:19:31.780 --> 0:22:46.530 The question that we should answer first, is what is hacking? Or another way we could ask it is what is a hacker? And here's how we have to think about that, is that most people actually think that a hacker is a malicious person somehow associated with wrongdoing, evil, doing, whatever. And that's actually not entirely true. A hacker is a problem solver. A hacker is somebody who sees the way a system works and says, can it behave differently than it was intended to. That's not good or bad. That's just a way of thinking. That's a predisposition. I guess the fork in the road comes when we think about motivation. So someone who wants to take a system and repurpose it or make it behave in ways that it wasn't intended to behave, and they want to do that to obtain some sort of personal benefit at someone else's expense. They want to harm an organization or some other malicious outcome. That's what would be an attacker, a malicious hacker. But the other side of the fork of the road is people who come from my corner of the world, which are ethical hackers. And those are people who still want to find those same flaws in the way the system works, but they want to do that so that they can advise on how to fix it. And both are Professions. I mean there, there is a very mature marketplace for malicious attackers out there and there is a mature marketplace for ethical hackers. And so that's really what hacking is. And all the examples that you described, those all are hacking, you know, social engineering where you try to trick somebody or attacking via a technical method where you're actually manipulating a software system. Maybe the idea of trying to have some sort of like attribution or you know, chain of custody of who is a person that did a thing like that's a slightly different thing. That might not be hacking. That's more, more post incident. But these are all types of hacking because essentially they're like, how do I take a system, make it behave differently. A person is a system. I can give you a social engineering example that is a system, right? Like one time I wanted to get into a bar and there was a long line and there was a cover charge to get into the bar. And I didn't want to do either of those. And so I recognized for what it was, right? It was a system. There was a system that says, you know, you're a patron, you go through this line, at the end of the line you pay a cover and you go into the bar. That's how the system worked. But I also noticed there's another feature to this system which is if you're a vip, you can go in the VIP line, there's no wait and you don't pay cover. And so what did I do? I did what any, any hacker minded person would do. And they said, well, how do I make the system behave differently? I'm not vip, but how can I make it so the system thinks that I am? And so I went through a whole series of sort of leading questions and specially crafted inputs. The way that I said things to the VIP hostess to get her to reveal to me through the way I asked questions who was a group on the VIP list and then I could just say I'm with that group. And sure enough, that's exactly what I did. She was able to let me in the bar. Didn't wait in line, didn't pick over. 0:22:48.930 --> 0:24 I have a similar story to that. That's amazing. I have a story where I was. Yeah, I always fly coach pretty much. I mean I've flown first class a few times because I had enough points. One time I flew business class for work, but I'm generally flying coach. There was a massive line at the check in area. And this is before, I mean now you would just check in on your phone. It's no big deal. But this was before that. And so there was no line for first class. And so my idea was that I would get in the first class line and I would upgrade to first class and just pay whatever it is because it was worth it. Otherwise I was going to miss my flight. And that extra value made first class worth it. And so I did that. I got the first class line, I upgraded it. Cost me automated 200 bucks or something. And because of that, I didn't miss my flight. And the people who. A couple of people heard what was happening because when I passed hundreds of people in the regular line, obviously that drew a lot of attention. And a couple of people were listening and they saw what I did and they got really upset. And I think maybe that's part of hacking, is when you abuse a system, you instantly sort of draw the ire of everyone around you. But that was, I think, one of the few times I could think of my life where, yeah, I kind of purposely kind of took advantage of a bit of a gray area. I wasn't first class yet, but I was about to be. And so that got me on the flight. And so, yeah, those moments are a little bit magical. It is kind of a weird feeling, but when you kind of use a system in a different way, there's a certain feeling that you get. I can't really. You'd probably describe them way better than I do, but there's a certain feeling you get. Yeah, like I managed to pull this. 0:24 --> 0:26:30.100 Off, you know, Absolutely. There's. There's such an interesting element. I love that story, by the way. I would probably do that all the time. Like, if you knew that, like, hey, just go in this line, pay a little bit more, and then your life is. Yes. You know, transfer money for time anywhere that you can. I'm all about that. But there's a really interesting element to the story that you just described, and it is the reaction of. I don't mean this in a diminutive way, but the reaction of the regular people because. Because we're talking about what's the definition of hacking? Well, there's people who, most people, when they see a system, they say, how does the system work? And I'm going to comply with the rules of the system. And then there are hackers, and hackers say, how does the system work? And I am going to either modify the system or abuse the system within the rules or change the rules. And the reaction that you saw was the inherently human feeling we have about fairness of those people who are like, hey, I followed the rules and I didn't get the benefit. But most people are in that mode. Most people are, let's follow the rules. And that's why hackers, both of the good variety and the bad variety, are good at what they do and are necessary in. And we're talking about social engineering right now, but in all aspects of building anything, because the average person doesn't look at things that way. Those people who got mad at you for doing what you did, why were they mad? Because they didn't get the benefit. But what did they not do? They did not look at that system and say, how do I make it behave differently? It's a special kind of mindset that's required to do that. And that's why people like us have a profession and are able to actually, you know, get hired by companies to help them solve problems like these. And it's a really, really, really important distinction. 0:26:31.140 --> 0:26:43.460 Yeah, that makes sense. So, so would you say the majority of, let's say, breaches, for lack of a better word, are from social engineering nowadays or, you know, what's that mixture like? 0:26:45.780 --> 0:28:27.420 I wouldn't be able to answer that definitively. I'm sure there's endless statistics out there that could answer that question without a shadow of a doubt in their mind in any direction. Because the truth is that at some point, we don't actually know everything about every attack. In fact, we probably know very little about most attacks. But I do believe, not even believe this is a fundamental truth, is that there is a human element to any attack. Now, I spend my energy, our entire organization, our company, we spend our energy really focused on how do we prevent software systems from being breached. That's really the main thrust. And then by extension, networks, computer networks and things like that, we don't focus as much on social engineering. But even I, as a person who focuses on software, recognize that the human is actually at the heart of all of these problems. So even if it's not that, someone called up Engineer Jane and said, hey, Engineer Jane, I'm gonna send you something. Will you click it? Even if that's not what happened, Engineer Jane might have built something, and let's not make it Jane's fault. Engineer Joe. Engineer Joe and Jane together, they built this thing, but they're humans, and they didn't realize that an attacker might abuse functionality that they were building in a certain way. And that is why that particular software system got breached. So anyone who's out there saying that 85% of breaches are the result of Social engineering. It's like maybe. I mean, sure, there's data that might show that, but I don't know if that data set's complete. 0:28:27.580 --> 0:30:41.850 Yeah, that totally makes sense. Or maybe just the circles I run. This is such a cliche, but other people, People out there might have not heard this. Patrick, I'm sure you've heard this. The. The World War II story about the planes that came back with bullet holes. So I'll just recap this. People have never heard the story. You know, the. In World War II, they're sending out planes. Some of the planes were getting shot down. Some of them were getting, I guess, wounded or damaged and then come back. And then some of them were coming back, you know, totally undamaged. And so they were looking at the damaged ones and saying, oh, you know, they're getting shot a lot in this spot and that spot. Let's put some more armor so that they don't come back with a big hole in them in this spot. And it actually didn't. Didn't help at all or very little. It definitely didn't improve the kill rate. And the reason is because the ones that were downed were not coming back. So it's like, if your plane is coming back, that's actually a good thing. And so maybe those spots are actually fine and you want to reinforce all the spots that you don't have any bullet holes in. And so it's similar here where it could be such that the breaches that occur from social engineering just end up being more public. And so you're just not seeing the distribution accurately. And so to your point, it could really be anything. But I guess the high level bit we can take away from this is that they're both still used extensively, so there's still a lot of social engineering. I actually just got a text message saying, hey, I need some information, blah, blah, blah, signed, and it's the CEO of my company. And my first reaction is like, who signs a text message? And my second reaction is like, why does the CEO, why would he ever text me? And then sure enough, this got sent tons of people. So that's definitely happening all the time. But to your point, the software side I'm sure is happening just as often or is happening in large numbers. And it's something that folks should definitely be aware of. 0:30:42.810 --> 0:30:44.090 Absolutely. Yeah. 0:30:45.370 --> 0:30:58.330 Yeah. So is hacking kind of like magic, where kind of once you tell someone the secret is not useful anymore? What are the parallels there? 0:30:58.650 --> 0:32:22.850 Wow. First of all, I love the phrasing of that question a lot of people do think it's like magic. They think we have this magic wand. We get contacted almost every day by someone who's like, oh, can you. So what I do is what we do, we help companies, like, who are building software and there's like, big projects. But I get contacted all the time by individuals who are like, my ex hacked my phone and is looking at my email and I'm like, what am I going to do with that? They're like, well, you have a magic wand, right. So people always think that ethical hackers, we have this magic wand. But the. So I love the way you phrase the question. And the nuance to your question is that once someone knows how a magic trick works, it loses. It's not as enchanting. And that is, in fact, not the case with ethical hacking. It's not like, well, once we reveal the method, all of a sudden, somehow it's no longer effective. In fact, the methods have been long established for a very, very long time. And that was one of the things that I was thinking about a lot when I was writing my book is if you're going to write a book that has to do with technology and it's going to take, you know, I wrote my book actually very fast for writing a book. It was about 17 months from when I started it until it was published. That's like crazy fat. Most people take like 10 years to write a book or five. 0:32:22.850 --> 0:32:23.410 Yep. 0:32:24.450 --> 0:34:13.120 But even in my case, where it's like as fast as it can be, the question is, well, how will that be useful to people in 3, 5, 10, 20 years? Will it be useful? And when technology changes that fast, That's a valid, valid question. And so for that reason, I really focused on, well, what are some of the things that are either timeless or are going to be highly resistant to change in time? And that's the principles of security. These, these principles that we have to think about today are pretty much the same principles as they were 10, 20, 30 years ago in tech. And you can even see these same principles in ancient books about war. Like, for example, Sun Tzu wrote the Art of War, and many of the principles. The Art of War, many of the principles in Machiavelli is the prince. These books are crazy old. And these principles apply to how we defend software systems today. You have to think about it differently, obviously, than, you know, like an emperor ruling, ruling a kingdom. And it's, it's slightly different application of the ideas, but the ideas are the same. So when you read a book like the one That I wrote, it's called hackable. When you read a book like this and you see it lays out exactly like, here's how an ethical hacker goes through the process. Here's, here's what you're looking for. Here's why it matters. Here's why most companies are stumbling when they like skip this part. I point it all out, the whole thing, it's not going to change. It's not going to change the way the attackers attack. They're still going to attack. They're going to evolve and adapt. But now that it's completely open kimono and I'm not the first person to have described the ideas, it's not like the magic trick where now it's like, oh, well, the magic trick doesn't work anymore. It still works because these principles are pretty timeless or at least time resistant. 0:34:13.680 --> 0:36:37.050 That makes sense. I remember I somehow, oh, when I was taking systems engineering, that, that gentleman, the professor, he also taught this cyber forensics course which, which I, I didn't take that, that course but, but it was interesting. He would tell stories about it. And the one story that really resonated with me was he said, so at some point people were kind of challenging him and saying, well, I could do this and I could use this VPN and I can use. And I'm going to say a bunch of things I don't know a lot about. I could use this onion router and I could use that. And at some point he kind of stopped and he said, here's the thing, you could do all of these things, but it's just another sort of dimension, right? It's like, it's like if you commit a crime now, you have to deal with making sure that there's no evidence in the physical world and you have to deal with make sure there's no evidence in the digital world. And you have to be experts on both of those and all the different dimensions that you can think of within those two universes. He's like, and so this is an area where someone might slip up, they might have really good. Some evil person might have really good way to cover their tracks, but not digitally. And so that kind of really resonated with me. It's like there's so many different vectors here. And so even if you might learn kind of like one magic trick, it doesn't mean you know every magic trick, it doesn't mean that you know every. And people are constantly coming up with new. There's that Penn and Teller show on, I don't know where it's syndicated, but you can see it on YouTube, where people kind of invent new tricks and share it with Penn and Teller. And so to your point, what really stays constant is the philosophy and the principles, but then beyond that, there's always more to learn, and there's always sort of this adaptive. This complex adaptive system that's being played out. And so. And so just knowing if you were to. Even if you were to become an expert on all the different, you know, like, exploits, it doesn't mean that it doesn't put you, Ted, out of a job. 0:36:37.370 --> 0:36:52.090 Right? Yep. Things will continue to evolve and adapt. And I mean, let's be honest, if. If I could put myself out of a job, that would be a life's achievement, but I just don't think that it would ever be. Ever be possible. 0:36:53.210 --> 0:37:49.210 Yeah, it actually fascinates me, and it's something I just haven't ever taken the time to study, but just how things like trust really worked, especially in the past. My son is now getting older, and so I'm starting to show him the amazing glory of video games. And so I was showing him. I don't remember which game it was, but anyway, so I walked up to the king, and he gave me a quest, and I was showing this to my son, and it just kind of crossed my mind that, like, you know, I'm carrying this sword and I could decapitate all these different things, and the king just lets me walk right up to him, you know, and so it made me think, like, I wonder in the medieval world how that actually worked, you know, like, how did people with weapons get close to the king? And. And there's sort of a trust there. And how do you watch the Watchmen and all of that? And so to your point, I mean, these are just timeless parts of human nature that will just never go away. 0:37:49.760 --> 0:40:11.370 Yeah, the. The pandemic that we've all suffered through, I think was. Has been and will and continues to be a really interesting exercise in the principle of trust. And, you know, if we take the politics out of it, which unfortunately is in this day and age, is pretty hard to do now, but if we just look at, like, purely the idea of the scientific control of, you know, a pandemic, and you think about, like, why. Why did we have masks and social distancing and minimizing, you know, gatherings and close businesses and, like, why do we do all of these things? Because these were all exercises in defense in depth. Like, defense in depth is a security principle that essentially says, let's let's add layers of things to make it so that the bad outcome we want to make sure we avoid is less likely to happen. And so that's why you do masks and social distancing and washing hands and like all these things, because none of them, no single approach is wholly effective. And that's the same with, you know, building a system, the security mechanisms in a system. So kings, medieval times, wonderful metaphor when we think about the king. Actually, I talk about castles a lot as security metaphor. And you look at something like the Tower of London, you know, and that used to protect the crown jewels. It doesn't anymore. But that literally used to protect the crown jewels. Yeah. And if you wanted to get to the crown jewels, you had to get across the moat with the alligators in it. You had to somehow like now scale the walls that had the guys pouring the hot oil down on you and the archers up on the turrets. And once you get over the wall, then you have to deal with the king's guard. And you're now fighting them in hand to hand combat. And then you have to get through all these, you know, perimeter, concentric perimeter walls in the castle. And if you can eventually get through all that, then maybe you can get to the king. And then what? Now you have to get out. You have to, like, do the whole thing in reverse. Yep, that's such a good metaphor for this really important principle, defense and depth. And so you were obviously talking about a video game. They simplified it for like. Yeah, you could walk up to the king holding a sword because of video game. Absolutely not. An average person would not walk up to the king with a sword in medieval times, right? 0:40:11.370 --> 0:41:53.810 Yeah. Unless they got in through all those circles of trust. So that sort of closes the whole loop on the social engineering part. Like somebody's next to the king with a sword. And so there's the sort of physical layers of getting to the crown jewels, but then there's also all of these social layers. And if you could, I mean, if this person was willing to spend the time and energy and they had that evil in their heart or whatever, like they could eventually get to the point where they're right next to the king with the sword. And so that's a whole nother aspect of it. Someone said something interesting a while back about basically the, you know, that the people who are sort of most really interested and obsessed and focused on something that on average, more of them are good people. I'm like, you're mincing words here. But yeah, it's the Idea that so many people who will go through all that training to be the king's right hand person, the king's protectorate or something, that at some point you just. At some point the odds of that person being evil just become so incredibly low that it passes some bar. You say, okay, now this person gets to be right next to the king with the sword, or this person gets to be in the Secret service to, like, you know, make it more modern. And. And so that's. That's the social engineering. Moat and alligators and boiling cauldron and all of that. And so I think, you know, building that trust over time is equally important. 0:41:54.290 --> 0:42:12.730 Yeah, I think a great metaphor for how do you. How do you deal with that? Right. It's not even a metaphor. It's just real life is you look at something like the movie the Departed. I'm originally from the Boston area, so I'm, like, very partial to all things set in or about Boston, including gangster movies, like, for whatever reason. 0:42:12.730 --> 0:42:13.170 Nice. 0:42:14.050 --> 0:42:19.680 But so this movie, you know, I'm going to maybe include some spoilers, but it's like 20 years old, so if. 0:42:19.680 --> 0:42:21.560 You haven't seen it yet, go for it. 0:42:21.560 --> 0:44:45.730 Yeah, that's kind of on you. But you've got, you know, one of the main characters is an FBI agent, and he goes to go undercover to try to get close to the kingpin, this guy Whitey Bulger. And it really chronicles what it was like for that guy trying to do this right to. Because how do you earn the trust of a gangster? You have to do stuff that's directly opposed to. To your profession as a investigative police officer. Like, literally, you have to kill people, you have to rob people, you have to beat people up. And if you don't do those things, you fail the test and you'll probably die because the gangster is like, oh, this guy's not trustworthy according to gangster code. And. And then it talks about how it, like, you know, as you watch the movie, how it morphs this individual, and it's like, is he maybe starting to become bad himself now? And you don't necessarily, necessarily know. And it's. I guess it's supporting your point that it's like, at some point we have to trust people. We have to trust systems. And so we have to have a criteria by which we assign trust. And it shouldn't. We should assume hostility. We should assume everyone. Like, we should be like that gangster who's like, hey, I need to test everyone who's around me just so they can be around me. Otherwise, how do I know? And then eventually they go through enough tests that you can trust them or you cannot trust them. And that's. Unfortunately, we do have to cross that barrier at some point. Being able to trust. And this idea of trust is one of the big things that I actually argue about in my book, which is that security isn't actually just about securing something. It's about being able to earn trust, right? You need to be able to secure a system and you need to be able to prove it. And those are two different things. And one of the big failures that exists across industries, across geographic locations, across maturity of both individuals and security programs is that we oftentimes think that we can just tell somebody that something's secure. We think that we can prove it without actually securing it. And that doesn't work. That's like the person who's, I don't know, the Olympics are going on right now, right? It's like the person who's like, I'm the fastest speed skater, I should be on the team. And they're like, okay, well go in this race and if you win the race, you'll qualify for the team. And they're like, no, no, no, no, I'm the fastest, just trust me. 0:44:46.049 --> 0:44:46.770 Yeah, right. 0:44:47.170 --> 0:45:07.580 That's the way a lot of people talk about security. They'll say things all the time. Pick a website, right? They'll go to it and they'll be like, fast, reliable and secure. And you're like, I can determine if it's fast, I can determine if it's reliable, but only someone with security expertise can determine if this is actually secure. 0:45:07.820 --> 0:46:27.320 Yeah, that makes sense. Yeah, that's really interesting, the analogy with the movie, you know, I feel like, you know, because one could argue that it's hopeless, right? That, that there's no way of guaranteeing. And I'll go back to the medieval times, because I feel like talking about modern times. It makes me nervous. But there's nobody who can guarantee that the king's right hand person isn't going to kill him. You can't guarantee. But to your point, maybe that king's right hand person has to do so many things in service of the king and get so intimate with the king and his family and the whole thing that at that point, even if he came in with the intention of, you know, killing the king, he would have been like brainwashed with all of these experiences that would have eventually defined his life and then he wouldn't do it. So I think, I think, yeah, maybe you could make the claim that it is then possible to create, you know, such a comprehensive set of hoops that even the most like untrustworthy or mal, like intended person goes through that trial and comes out the other end, you know, trustworthy. It's kind of an interesting thing to think about. 0:46:27.480 --> 0:47:38.620 Yeah, I mean, I guess there's two ways that you'd get that insider. This is what we're talking about right now, right, the insider threat. One would be, yeah, someone joins the organization with the express intent to earn trust in order to harm the organization. But in other ways they could be recruited. And so in the case of, yeah, someone who's close to a high ranking head of state or whatever, how do you kill a king? Maybe there's a weakness of that person who's in the guard, or maybe they, I don't know what their weakness is, but whatever the weakness is, an enemy can take advantage of that and makes sense whatever the situation is. These are the things that, this is why every organization, irrespective of time, we're talking about medieval times, let's talk about modern times, like everywhere in between. This is why we really need someone, or not even someone like a team who is constantly thinking those more malicious thoughts, but for good. I mean, that's again, this is why my whole profession exists is because most people don't think this way. It's a very uncomfortable way to see the world. It's like, I forget in the Matrix which pill it is that you take that all of a sudden you unplug from the Matrix. But it's like taking that pill. 0:47:38.780 --> 0:47:42.700 Yeah, the red pill, you unplug the blue pill, you stay in the Matrix. I think. 0:47:42.700 --> 0:48:40.120 Yeah. So it's like you take the red pill, you're unplugged and now you're like, well, this is way worse than being in the Matrix was. Like, now I see it's so uncomfortable. I see the ugliness of the world. But just like the main characters in that movie, we need people to see the ugliness in the world in order to improve the world. And like those of us who come from the ethical hacking world, it's like we see everything this way. Like I told the story about the bar or whatever, but it's like literally every situation in my life I look at it in that more malicious like, well, how would you defeat this? And that's not for everybody to think that way. That's, that's probably not healthy in fact for everybody to think that way. But that's why we have to have someone or Someone's plural thinking that way. Because going back to the medieval king metaphor, if someone's not analyzing, like, who's close to the king and what are the weaknesses, that person might have a bad apple might get close. 0:48:40.600 --> 0:49:05.530 Yeah, totally. So, so when a company approaches you and says, you know, Ted, we want you and Ise to, to help us out, maybe they. Well, maybe let's. Let's say they haven't had a breach yet, because that's probably a totally different situation. But let's say that they just want you to come in and. And help to secure their company. What do you do? Like, what is day one like? I mean, how does that go down? 0:49:06.970 --> 0:50:27.960 Well, it depends on the scope of the project and what they're trying to do. But let's say, you know, someone who's building a software system and their motivations may be several. They might themselves realize, hey, we know we need this to be secure. Or we may realize we're building something that is going to be very, very valuable to attackers, so we should get out ahead of this. But most likely the reason that they want to do this or they're being asked to do it is a customer of theirs is asking them to do it, or a regulator in an industry they are building the system for is saying, hey, you gotta, like, prove it in some way. And so usually what happens is that we get to the heart of what do they want to achieve, why do they want to achieve that? Usually what they're asking for winds up being a little bit different than what they actually need. Most people think of security as like a box to check or a cost to minimize. Like, how do we. How do we do this? The least expensive way that will satisfy my customer. That's the way a lot of people think about it. But the smart companies are the ones who say, well, if one customer is asking for this, I bet a bunch of my others are too. So why don't I not do the minimum? Why don't I capture the competitive advantage that this is and do it the right way and be able to differentiate from everyone else who's going to see what's the lowest bar that I can do right now? 0:50:28.040 --> 0:50:52.040 That's kind of like. Yeah, the analogy is kind of like, you know, the robber in the neighborhood will try and rob the easiest target. Most people don't rob every house in the neighborhood or even half the houses they're going to find, like the one or two houses that they can rob. And so you just need to be better than them or I guess the other analogy is like, you know, if there's a lion chasing you, you just have to be the second slowest runner, you know. 0:50:53.830 --> 0:53:20.580 Well, here's maybe, okay, I like the combination of homes and lions. Let's, let's use a metaphor of homes in South Africa. Okay? So the home security South Africa is significant because there's, you know, home robberies are like a really big problem there. And so really what we're talking about is the person who sells homes in South Africa, what they want to be able to do is say to their rich clientele, look at how good this security system is. Look, here's the cameras, the guards, the walls, the doors, whatever. Whereas most people are like, yeah, this is a secure house. That's a really, really big difference. Someone who's like, I put some locks on the thing versus someone who's like, let me walk you through the many ways we thought about security, built it into the design and then executed on it, and then improved upon it throughout the build. A process that's really the key. And so to your original question, like, what, how do we get started? Once we define the goal, we help reshape, how do you, what's the best way to achieve the goal? Then we define what the scope of the project is. Like, are we talking about, let's say it's a web app, Are you talking about just the front end? Are you talking about the back end? You're talking about both, talking about any integrations with other third party systems. Then we go about actually looking at items within scope and trying to determine, well, how would someone break this? And where there's areas that might be of concern, we'll dig a little bit deeper to actually determine can you exploit it? And anywhere that the answer is yes. Now we actually will build a proof of concept, like how would it work? Not build it, like actually go run and execute it. But we would show here in the code is where the issue lies. And then we tell them, here's how you fix it. They go and fix it. And then we come back and verify, did that fix actually work? So that they can now turn around and turn to their customers and say, not only did we do some security testing that you asked for, Mr. Or Mrs. Customer, but look at how deep we went. Look at all the issues we found, look how we resolved them. Here are the ones we didn't resolve yet, and here's why we're not going to resolve them. It's a much more powerful position to talk to your customer when you've actually done it right than when you're trying to be really hand wavy and smoke signals and, you know, hope they stop asking questions. Because if there's one thing that makes people ask more questions, it's when they feel like that the person they're asking questions of is being evasive. 0:53:23.700 --> 0:54:31.180 Sponsor for today's show is Imparticle. At the end of the day, your customer has to be at the center of everything you do. This starts with the right customer data strategy as well as the right foundation to solve the challenges that typically inhibit success, such as data quality, data governance and connectivity. Nparticle is your real time customer data infrastructure that helps accelerate your data strategy by cleansing, visualizing and integrating your customer data from anywhere to anywhere. Ultimately, better data leads to better decisions, better customer experiences and better outcomes. Some of the best brands in retail, financial services, hospitality, media, travel, gaming and many other industries have chosen nParticle. Learn more by visiting www.mbarticle.com Better data, better decisions, better outcomes. Visit imparticle.com to learn how teams at Postmates, NBCUniversal, Spotify and Airbnb use mParticles customer data infrastructure to accelerate their customer data strategies. 0:54:34.220 --> 0:55:18.100 I worked on well I built this thing called Eternal Terminal, which is like an SSH replacement. That's my one foray into doing like C and kind of low level Unix stuff. And an ethical hacker reached out to me with an exploit. It ended up not being that big a deal. Basically it lets you masquerade as another user, but not root maybe or no. Even that is more than what it did. Anyways, it was not. Oh no, here's what it was. You could basically crash the equivalent of like the SSH server and that would kick everyone else off. That's basically what it so at any point in time you could run this and everyone would get kicked out of the server. They'd all have to log back in. 0:55:18.360 --> 0:55:23.400 So effectively like a denial of service in a sense. Or at least make service painful. 0:55:23.640 --> 0:56:19.630 Exactly. It's exactly denial of service. And the person they're super professional about it. They actually reached out to me in an email. They didn't like make a make a issue on GitHub, which would have just told everybody. And they gave me like literally a Python script and I didn't even know some of these things. You could even do them in Python. Like they're pretty like low level networking stuff, but they actually gave me this Python script and I could run it and sure enough like it kicked me out of of the terminal and it's just clear as day. And I could, you know, I put in a patch and then I ran with the patch and, you know, the Python script didn't do anything, but it was just, it was just, it was beautiful kind of the way it worked, it was repeatable. It wasn't like a suggestion or, oh, this happened when. Or I was able to do this to your point, like with the Olympic skater. It's like, here's a program and I can run this script and sure enough, it'll do this every single time. And that was really powerful to see. 0:56:19.950 --> 0:57:01.870 Yeah, it sounds like you're describing what's called responsible disclosure, which is where a security researcher, an ethical hacker, will perform research on an organization. When they find an issue, they'll then submit it to that afflicted organization in order to help them fix it. And then once it's fixed, then they can turn around and, you know, write a white paper about it or speak about it at a security conference, like defcon or something like that. And that is the way that security research is supposed to be done, as opposed to just publishing the issue. But one of the problems that comes up a lot. It sounds like you were very engaged with this researcher who was trying to help you. 0:57:02.350 --> 0:57:13.930 Yeah, he did tell me that after 60 days he would publish it, you know, externally, which I was fixed long before then, but. But it, it kind of did encourage people to upgrade to the latest version when they did find it. 0:57:15.290 --> 0:58:53.020 Yeah, you have to put the shot clock in there because otherwise you'd be surprised how many companies, despite being. Despite receiving these known issues, won't do anything. And that hamstrings the researcher a little bit, because first of all, the issue is not getting fixed, which is the real problem. But then it's. Researchers are essentially compensated in one of two ways, financially or through recognition. And so financially would be where. That's the business. Right. So I've talked before about how, like, companies hire us. That's the business. Someone will pay us to do a project for them. But the condition is, of course, this is private to them. This is. There is non disclosures. We don't talk about this to anybody. Occasionally we'll talk about broad strokes of a story, but no one's identified. No technology is identified. So that's one way you're compensated. Someone pays you to do it, but it's kept private. The other way is you don't get paid for it, but you can talk about it. And talking about it does a lot of things. It helps advance the state of the industry. It helps Educate other researchers. It takes a researcher's profile and elevates that profile so that they can maybe get a better job or start their own company or just be more prestigious or write a book or whatever they want to do. But the problem becomes when they're not getting paid and they're not allowed to talk about it. And so that's why responsible disclosure has to have a shot clock on it, because otherwise the companies could just not do anything. And that now both sides kind of lose because the company doesn't do anything. The researcher's like, when. When is appropriate for me to talk about this? If the company doesn't know now, at least the company's been notified. 0:58:53.730 --> 0:58:53.970 Yeah. 0:58:53.970 --> 0:59:02.610 And when. When they go talk about it, they won't disclose the actual attack script if the company hasn't fixed it, because that would just be irresponsible. 0:59:03.250 --> 1:00:13.900 Yeah, totally makes sense. Totally makes sense. I think some things might. Might be somewhat nebulous too. Like, in this case, it was a pretty deterministic thing. You could just run it and boom. But in some cases, it might not work every time. Like, it might be something that's. That's like, based on some context that's difficult to reproduce. And so the company might not know they fixed it 100%. They might not know if they fixed 90% of the cases or 100%. So they might have this. The company's gonna have a strong incentive for that reason, at least for that reason, not to disclose it. But as you said that, that. Then you have this problem of we can't really tell who's out there doing great work in the security space. So I've heard a lot about defcon. I've had friends who go every year and they're super into it. Can you explain DEF con? I've never been so kind of like, can you explain DEF CON to someone who hasn't been? And some of these stories, like, I've heard stories at the hotels tell, like, anyone you know, whether you're there for DEF CON or not to, like, put your phone in airplane mode because everyone gets hacked. Or, like, are these. How much of these are fantasy? How much of these are real? 1:00:16.090 --> 1:02:25.750 There's. Well, there's a combination of the two. They are very real. That stuff happens at defcon. But it's. I wouldn't say it's fantasy. It's not like you walk into the convention center and you're hacked immediately. But it is definitely the place you want to proceed with extreme caution in terms of your technical life or your Technology life. DEFCON is. It's a security research conference. So it's for researchers. And that's an important distinction because I think when most of us think about security conferences, we think about things like things that are more commercialized, like an RSA or something like that. Maybe if there are students listening, haven't been to conferences at all. Maybe you aren't familiar with the idea of conferences, but most where a commercialized conference is more about like the business of security. Rsa, sorry, DEFCON is really all about the security research itself. It's where new research is published. It's extremely technical. So if you don't have interest in learning the technical side, like, you might have difficult time there. But it's all about breaking things. And it truly is a community. I mean, like any community, there are people who are jerks and, you know, arrogant and stuff like that. But for the most part, I find that the DEF CON community is people who are very supportive of each other. They're all there to learn. They feel comfortable amongst each other. I mean, it really does. Community is the right word, I think, for what is a very, very large conference. And yeah, hot new research gets dropped all the time. Like, here's the newest way to attack a solar array or a satellite or cars or stuff like that. We organize part of it. They have this concept at defcon. They call it the villages and there's. The villages are kind of like a conference within a conference where it's focused on a particular area and we run one that's focused on Internet of Things and all the software that surrounds the Internet of Things. And yeah, it's just, it's just a cool place to learn and to meet people and hack stuff and learn, meet other hackers and it's just, it's a cool vibe. 1:02:26.810 --> 1:03:10.160 Very cool. I definitely want to dive into ISE and the company and what positions you have available and all that. But before we jump into that, what are some kind of tips, piece of advice you could give to people who don't want to get hacked? So this could be professional people who are developers, but it could also be just people out there who have a cell phone and they're worried about getting hacked or they hear about their friends getting hacked. What is sort of some advice you would give to people like that? 1:03:11.200 --> 1:03 So the question is advice for individuals as opposed to advice for companies or software development teams and things like that. 1:03:18.590 --> 1:03:32.910 Right. So this would be, you know, if it could be someone writing software on their side to say a college student or something like that, but this would be sort of non enterprise folks out there, what would be advice to them if they are worried a lot about this stuff? 1:03:34.270 --> 1:04:05.860 Yeah. So a lot of the common advice that you'll hear around this question is things like, first of all, just be aware. That's first and foremost you want to be aware. So that means things like being cautious of clicking links or downloading attachments that come your way. You mentioned at one point that you received a text message and I assume it had a link in it or something, some sort of request. 1:04:05.860 --> 1:04:06.620 Yeah, it had a link. 1:04:07.900 --> 1:04:56.070 Yeah. So anytime, something like that, just, you know, delete those things. Or better yet, report if you are at a company that has any sort of it, or ideally security team, you know, send that to them so they can hunt it down. But so many of these attacks originate from things like text messages or emails that have attachments or links. So, you know, being aware of that kind of stuff, being aware of how authorization is typically given. So for example, I still think it's pretty funny the way that doctors offices operate right now. They call you and they're like, hey, is this, you know, is this Ted? And I say, yeah. And they're like, all right, well we just, we just need to verify that you are who you say you are. So can you give me your Social Security number? And I'm like, no, you verify yourself. You just called me. 1:04:56.230 --> 1:04:57.030 Yeah, right. 1:04:57.830 --> 1:05:48.590 And so even though that one. That is actually the way most doctor's offices operate, which is ridiculous, still push it back on them. They have to prove that they are in fact your doctor before you give them any information. So just being aware that we live in kind of a hostile world and being aware of. Yeah. Attacks are coming, whether that's clicking links and dialing attachments are the biggest things, and forwarding that information to someone who can help with it, if you don't have someone to forward it to, at least just delete it and don't do anything with it. If it's something that matters, you'll find out about it. Like, it won't, it won't be the end of the world if you deleted a link that was like, oh, I was supposed to have that. Because that person will probably call you and be like, hey, I sent the thing. Did you, we got to sign this contract for this thing or whatever. You know, you're trying to sign a mortgage. Like it would. You'll figure it out. 1:05:49.870 --> 1:06:14.610 Yeah, really good advice. Yeah, I mean, I know my wife and I constantly get calls from the quote unquote irs, you know, and they're like, you owe us a bunch of money, and they're totally fake. I mean, that's a. That's. I think the IRS scam is now probably one of the most common. You know, we looked it up once, and there's just website after website after website telling you all about the scam and how it works and everything. 1:06:16.129 --> 1:07:57.730 But two other scams that, you know, if we're talking about maybe college students or younger audience, there's two others to be aware of that are really, really effective. And you can pick them out pretty easily, but they're still really effective. So one is similar to the IRS scam that says, hey, you owe back taxes or whatever. It's about student loan debt. And so I fortunately don't have student loans anymore. I paid them off already. So that's how I know these are scams, because they're like, oh, your loans are in default or whatever. And so every time I get them, I'm always looking at them and I'm like, how, you know, how does this work? What's. What psychological tools are they trying to use? I mean, I probably get one or two of those calls a day. And so that's a big one. Be aware of, like, if you're getting calls, especially if they seem really urgent and scary about your student loans, just go to whoever you have your loans with and call them directly and ask, don't, don't respond to someone who's contacted you. The second one that's really, really effective right now is these housing scams on Craigslist, especially if you live in a hot market. So if you're listening to a podcast like this and you're trying to get a job in tech, you're probably going to wind up in, like, San Francisco or New York or Los Angeles, Austin. You know, these places that rent is really high places are gone before they even hit the market. And so it can be really tempting when you find a place on Craigslist, and it's like, wow, that's in my budget. It's even a little nicer than my budget. Oh, wow, look at that. They replied to me. Oh, wow. They. They didn't need a background check. All I need to do is send my first month deposit, security deposit, first month's rent, and this is mine. They'll mail me the keys. 1:07:58.930 --> 1:08:00.530 Oh, yeah, yeah, don't do that. 1:08:01.490 --> 1:08:09.730 People who rent you places, even if they'll send in the scams, really effective because they'll send you what looks like a really legitimate Contract. A lease contract. 1:08:10.050 --> 1:08:10.530 Yeah. 1:08:11.010 --> 1:08:14.210 And you're like, well, how am I going to get housing if I don't? 1:08:14.210 --> 1:08:21.040 It might even be a place that's. That's being rented. Because you could just go on Zillow and find a place for rent and say, yeah, this is me, right? 1:08:21.840 --> 1:08:48.570 Totally, totally. Yeah. They'll always. There'll always be a story like, oh, I can't show it to you because, you know, I'm deployed overseas, or I had to go take care of a sick family member. But don't worry, I have the keys. I'm going to mail them to you. Just go look at the place from the outside. But I can't let you in. You know, you got to be able to see it. You got to know that this person can let you in. So those are two that I would definitely keep an eye out for that are targeted specifically at a student demographic. 1:08:49.050 --> 1:09:46.360 Cool. That makes a ton of sense. I saw one that was coming at it from a totally different angle, but it's still hacking, based off the way we were talking about it earlier, where someone found a place that had included utilities. So utilities were free. We were included in the rent, and they proceeded to set up a bitcoin mining farm and a Laundromat. And so the owner got a $300 electrical bill and $250 water bill the first month. Now, fortunately, you know, they're in the contract. It says you can't run businesses. You know, it's meant for living. And so I'm pretty sure that they're. The owner is able to take care of that. But that's also an example of hacking where you kind of, you know, the included utilities was kind of not meant to include you, like running your own Laundromat. 1:09:47.720 --> 1:10:04.520 Well, that's definitely an example. Yeah. Of someone who said, well, how can I make the intended use of this system be different? And so, yeah, they found that there was contract language. It sounds like that prevented that, but I even applaud that person. They're like, whoa, utilities are included. Hold on a second. Let's go. 1:10:06.120 --> 1:10:25.310 Yeah, it's pretty clever. So cool. So let's jump into ise. So ISE IO is the website, and I guess it's a group of folks who assist other companies with security issues. Is that correct? 1:10:26.510 --> 1:11:06.520 Yeah, yeah. So we're a company of maybe about 50 people or so today and growing. And yeah, essentially companies hire us when they're trying to understand what their security flaws might be in a given system and how can they improve them. And so basically we hack stuff all day and it's really rewarding, in fact, to see when people find out about our company who that's what they want to do with their free time on the weekend or whatever. And they're like, this exists as a job or yeah, you get to do bad guy stuff and don't go to jail. So it's great. 1:11:06.840 --> 1:11:27.080 Very cool. So for folks who are super into this space and we'd love to kind of work with you, what sort of positions do you have? Do you do internships? Is it full time? Where are these positions located if they're not remote? And yeah, what are some of the details there? 1:11:28.360 --> 1:13:03.750 Yeah, we have a lot of jobs that we're hiring for right now, ranging from security analysts to. We have some. I believe we have some project manager type positions, we have some software developer positions that we're looking for and there's probably some operational or administrative type jobs as well. The R we're headquartered in Baltimore. We actually came out of the PhD program at Johns Hopkins and our west coast office is in San Diego. But we already had a pretty liberal remote work sort of situation before the pandemic. And then as we've been polling our people as pandemic seems to be winding down. Who knows if it is or not? But I think the general consensus is everybody wants to have a hybrid work environment and some people want to be fully remote. And so whether people want to be fully in the office, fully remote or hybrid, we support all of that. Within the United States, there's all kinds of visa issues with people outside the United States that we still haven't quite crossed that barrier yet. But within the United States we're good with all those. And yeah, I mean, that's kind of the culture is community. I mentioned that about defcon, but that's one of the defining words of what our culture is about is it's definitely a community. It's like the first word in our mission statement is to build a community. And so for that reason, I think a lot of people do like to come into the office. I personally much prefer it to being remote because I want to interact with people. 1:13:04.070 --> 1:13:04.550 Yep. 1:13:04.550 --> 1:13:08.310 But we're, we're amenable to whatever situations people want. 1:13:08.950 --> 1:13:15.030 Cool. That makes sense. And so are there sort of internships or co ops or is it. Is it mostly full time at the moment? 1:13:15.990 --> 1:14:29.560 Oh, yeah, I knew that. I was like, there's one more aspect of the question you can answer. Yeah, our internship program is. It's one of our best. I Don't know if it's one of our best. There's so many great parts coming. But our internship program is very robust. At any given time we have one or a handful of interns. I mean, obviously they kind of follow internship cycles like typically summer. Yep. But what winds up happening with our interns pretty frequently is once they start an internship with us, they usually wind up like they don't go back to, I mean, they go back to school, but they stay where, you know, their availability shrinks. But they wind up doing, you know, maybe a project during the semester and then they'll ramp back up again for the winter and then do a project in the spring and then do summer. So it's really great. So they get, you know, our, the people who come for our internships generally don't have any security background. Some, some of course do, but really it's just computer science is the big thing that we're looking for. Depending on the job, if there's other jobs that we don't need computer science background for. But yes, we have internships and also obviously full time positions. There's a few part time positions and occasionally once in a while we'll hire a contractor. But it's primarily full time and interns. 1:14:30.120 --> 1:14:50.240 Very cool. Yeah, that makes sense. So what is something that makes working at ISE unique? What is something. Like it could be the desk layout. It could be. Maybe you have a. Once a month you have a competition to see who can break into Ted's iPhone. I mean, what is something that makes working at ISC different than working somewhere else? 1:14:50.640 --> 1:14:53.520 Yeah. You mean besides we pay people to hack companies? 1:14:54.640 --> 1:14:58.400 Yeah, totally. What's the unique thing about the culture? 1:14:58.880 --> 1:17:38.320 Yeah, we're not the only ones who do that. So one of the things that I love about our culture is it's just fun shenanigans and we, that we kind of grapple with. How do you communicate that to people outside the company? Right. That this, this is a fun place to work. Like people like working with each other and this is not your corporate toxic culture that people are like stepping on each other and backstab. It's not, it's like, it's a community. I mean that word is, that's, that is intentional. And some of the ways that that manifests is, I don't know, we do like a lot of the stuff that I think interesting tech companies do, like pay for a lot of meals, pay for a lot of like social events out. But we also have like awards to reward people for both the serious Contributions they make, as well as, like, the goofy and silly contributions that they make. There's like, one guy at the company right now who. His ability to create memes about what our culture is. It's like, how do you. It's so spot on. And we're, like, always disseminating those to people. And we have a. It's changed a little bit with offices being closed during the pandemic. But we have what we call the inter office travel budget. So, like, each person has an amount of money every year, earmarks, so that whether they're based in Baltimore or they're based in San Diego, they can go travel to visit the other office and, like, build relationships. But then also, like, hey, if you want to make a trip around that, it's cool. We have unlimited vacations so people can. Like. One of my big things when we were building this culture is I was. Earlier in my career, I. Before I went out and on my own, I worked for a company that their vacation policy allowed two weeks of vacation. And I was. And I told him when I signed the thing, I was like, just so you know, I'm gonna take more than two weeks. Like, if you have to not pay me, like, so be it, but it's just not gonna work for me. And I remember distinctly having this feeling, you know, that was my early twenties. All my friends are getting married. I was one of the few that lived in California. Everyone was sprinkled all over the country. And I remember being made to feel guilty when I had to fly on, like, a Wednesday so I could arrive in time for the events on Thursday and Friday for the wedding on a Saturday. And I was like, when it's time for me to build my company, like, I will never allow anyone to feel that way. And so our. Our culture is just like, you got to live your life like ise, and your life have to be integrated. You have to do work that matters. You have to be around people who are smart and make you better. And. And that's, I think, the culture that we've built. And that, I think, is very unusual. 1:17:38.880 --> 1:18:34.740 Yeah, I had a similar situation where I joined a company, and I was. I was just finishing my PhD, so I still had a commitment to go to a conference. And so I had to go to. I had to go to the conference, you know, after being at the company for, like, two weeks. And so I ended up having to go into, like, negative vacation. So I found out negative vacation was a thing. So. So I had, like, negative, like, one and a half weeks of Vacation. And it just kind of, it's kind of like seeing Mickey Mouse backstage. You know, it's like, like it's. The person takes the mask off and it's, you realize it's just a person running around with a Mickey Mouse costume. It's like, sorry to spoil it for people out there, Disney fans. But, but, but sort of like when, when you go, when you have to go negative vacation, you realize that it's just like another system to be hacked, you know, so, and, and so it's like, it's, it's nice to just say, look, like, let's, we're all adults here, you know, when you need to recharge and all of that. 1:18:35.780 --> 1:19:09.810 Yeah. I think the bigger problem that we have is actually making sure that people will take vacation, take enough vacation, actually take the time off. Like, I'm always berating my, within my reporting, berating is maybe the wrong word, but like within my reporting structure, I'm always telling people like, hey, you're taking the, you're taking next week off or two weeks or next three weeks, whatever it is. Like, I better not hear from you. You know, you better not be checking on your email and responding to, you know, messenger and all that stuff. And I think now people are like starting to get it because you have to really set that tone from the top. 1:19:10.380 --> 1:19:11.180 Right. Right. 1:19:11.580 --> 1:19:35.260 And most companies do the opposite from the top. Right. The, the leadership is so engaged in what's happening that they're willing to work on their vacation. That signals to everybody else like, oh, vacation isn't really vacation. I'm supposed to be checking email even though I'm like, you know, in Aruba with my girlfriend or whatever. Boyfriend. Like, no, that you have to clearly communicate that. And I think, I think we're doing a good job with it. 1:19:35.910 --> 1:20:48.320 Very cool. Yeah. I found that as an engineer, I could code on vacation, but as a leader, I make absolutely terrible decisions. And you know, at first I thought maybe it's because I'm just frustrated that people are reaching out to me on vacation. But then I realized it was much more fundamental than that. When you're on vacation, you only get emergencies. And so your view, you know, I've taken. There's been a few times where I've taken like, you know, one, two month long vacations, you know. Cause I'll kind, kind of batch it up that way. And so I'll notice that, yeah, while I'm gone, it's just all I see are emergencies and so, and, and it's kind of a compressed Timeline because you're not, you know, working a full 40 hours or anything. And so it just feels like everything is on fire and you just get really upset. And then. And I only in hindsight was I able to figure that out. And so, yeah, I totally want to echo what you're saying, you know, when you're on vacation. Yeah, definitely take your vacation, check out, put that person who's going to backfill you. Let them take that role and run with it and shine and just be totally off the grid. 1:20:49.600 --> 1:21:15.180 Totally. Yeah. I so strongly agree with that. And what we have to also realize. And I get that what I'm about to suggest probably feels like a leap for somebody who maybe is still like figuring out their career or maybe they're earlier in their career or whatever, but is that you actually have to let the organization figure out how to do your job or how to get the job done that you're there for without you. 1:21:15.260 --> 1:21:15.820 Yep. 1:21:15.900 --> 1:22:32.090 And that most people, when they hear that idea, they're like, well, then, then the company might realize they don't need me and they might fire me. So I have to show them that I'm important. And it's actually kind of the opposite. Like, you need to allow. You need to prepare your team. I mean, that's one of. To be able to have an unlimited vacation policy like we have, it is a requirement that, you know, people have to notify, as in as much advanced notice as they can. Their team, their manager, it's everybody. They have to come up with a plan for like, okay, what's going to happen before I leave while I'm gone? And then right afterwards, who do I have to prepare? What information do I have to give them? That's why a lot of people wind up checking in when they're on vacation, because they don't do that. Right. They're like, oh, like, no one can do this thing because I'm the only one who can do it, or I'm the only one who has access. And that's really, really bad planning. And what we have to do instead is we have to be able to equip the people around us to be able to survive for like a couple weeks without us. And that no matter your level in an organization, from entry level to the CEO, that makes you a better team player. It makes you understand the processes better. It makes the systems run smoother because you understand them well enough to communicate them. You can find, like, why do we do it that way? We don't need that. Let's get rid of that. 1:22:32.410 --> 1:22:32.970 Yep. 1:22:33.210 --> 1:22:44.650 And that can be scary for people to say, like, I'm going to actively do something so that they can live without me. Like, what? But trust me, it makes everyone's lives so much better once you can do it. 1:22:45.700 --> 1:24:22.950 Yeah, Totally, totally agree. Yeah. I mean, it's, it's, it's. I mean, I think especially in leadership, like, for you to build the next layer of leadership, you have to replace yourself. So in that case, it's, it's crystal clear. But then, you know, even as a tech leader or as a. As a technologist, the same is still true. Like, you know, for you to build the next system, someone has to take over the current system, and so it holds true for that as well. Thank you, Ted, so much. This was awesome. I know some folks out there are saying, oh, why didn't we go over SQL Injection? I mean, you can read all of that stuff on the Internet. And as Ted said, if we covered that, a year from now, there'd be something totally different. And we get people who listen to our episodes from 2011 and still today. So what we said here, in my humble opinion, we said here, is timeless. It's always going to be true. It's facets of human nature. And, Ted, you did a great job of explaining what security is, why it's important, and how it breaks down, and what you do when you join an organization to help them out. I really appreciate your time. Fascinating stuff. Definitely check out Ted's book. Number one, bestselling author on ethical hacking. So definitely check out the book. Do you want to kind of give us a rundown of what is your book, your site? How can people read more about this? How can people catch you? 1:24:24.470 --> 1:24:51.910 Yeah, the simplest thing to do would be to go to TedHerrington.com there you'll find anything you could possibly need based on what we covered today. So there's information about my book. It's called Hackable. You can find where to follow me on social media. You can contact me directly if you need advice on security testing. If you want to apply to work at our company, like anything you could need, just go to TedHarrington.com Very cool. 1:24:51.910 --> 1:24:55.230 Thanks again for coming on the show. Super, super interesting. I really appreciate it. 1:24:56.330 --> 1:24:57.690 My pleasure. Thanks for having me. 1:25:11.209 --> 1:25:16.050 Music by Eric Barndaler Programming throwdown is. 1:25:16.050 --> 1:25:30.980 Distributed under a Creative Commons attribution Share alike 2.0 license. You're free to share, copy, distribute, transmit the work, to remix, adapt the work. But you must provide attribution to Patrick and I and share alike in time.