Episode 24
Thinking Like A Hacker
Using compelling stories and metaphors, Ted Harrington, author of Hackable: How To Do Application Security Right, and Executive Partner at Independent Security Evaluators, explains the process of hacking and the importance of being able to think like a hacker. He encourages leaders to get excited about information security investments and look for ways of gaining a competitive edge from those investments.
Time Stamps
01:59 -- So let's talk about hacking. For the benefit of the listeners, provide an overview of hacking like hacking 101, what is it? What are the many consequences?
04:30 -- Shed some light on why hackers might be interested in breaching the systems of certain types of organizations over others. And related to that, are any organization types more vulnerable than others?
08:18 -- We hear the phrase 'thinking like a hacker' a lot. The ability to think like a hacker is considered a best practice in cybersecurity governance. I'd like to probe a little deeper into it. Can you shed some light on that?
11:32 -- What are your thoughts and perspectives on the other group, the folks who are not very security savvy and generally get compromised. You would not recommend or expect them to think like a hacker. What advice do you have for them?
15:55 -- Maybe we need the media to help popularize thinking like a hacker, so literally everyone on the street has some sense of what these guys are up to, how they are thinking, how they try to attack. Not to suggest that this exposure would make everyone an expert. But at least it whets the appetite, it gives them a basic understanding. And that would help mobilize organization-wide support. Thoughts, reactions?
22:09 -- Let's talk about security assessments. It's reasonable to assume that most organizations are engaging in security assessments. But the more nuanced question is, are they engaging in the right kinds of security assessments, with methodologies that best align with their desired outcomes? What are your thoughts?
32:40 -- What are you seeing out there in terms of top management commitment to information security?
37:37 -- What is so difficult or challenging about patch management, vulnerability management?
42:10 -- What lessons do organizations refuse to learn?
Memorable Ted Harrington Quotes
"The term hacker is neutral. It's neither good nor bad.
"A hacker is someone who is a problem solver. They're creative. They're someone who looks at the way a system works and says, you know, can it behave differently than what it was intended to do?"
"To defend against an attacker, we need to think like an attacker."
"Most people think about security as avoiding a bad thing. Let's not get hacked. That is a good way to think about security, but it's incomplete. We need to think about not just how do we avoid a bad thing, but also how do we get a good thing? Not just how we do not get hacked, but how can we gain an advantage?"
Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast
Please subscribe to the podcast so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.
Connect with Dr. Chatterjee on these platforms:
LinkedIn: https://www.linkedin.com/in/dchatte/
Website: https://dchatte.com/
Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338
Transcript
Welcome to the Cybersecurity Readiness Podcast
Introducer:Series with Dr. Dave Chatterjee. Dr. Chatterjee is the author of
Cybersecurity Readiness:A Holistic and High-Performance
Cybersecurity Readiness:Approach. He has been studying cybersecurity for over a decade,
Cybersecurity Readiness:authored and edited scholarly papers, delivered talks,
Cybersecurity Readiness:conducted webinars, consulted with companies, and served on a
Cybersecurity Readiness:cybersecurity SWAT team with Chief Information Security
Cybersecurity Readiness:Officers. Dr. Chatterjee is an Associate Professor of
Cybersecurity Readiness:Management Information Systems at the Terry College of
Cybersecurity Readiness:Business, the University of Georgia, and Visiting Professor
Cybersecurity Readiness:at Duke University's Pratt School of Engineering.
Dr. Dave Chatterjee:Hello, everyone, I'm delighted to
Dr. Dave Chatterjee:welcome you to this episode of the Cybersecurity Readiness
Dr. Dave Chatterjee:Podcast Series. Today, I have the pleasure of talking with Ted
Dr. Dave Chatterjee:Harrington, Executive Partner at Independent Security Evaluators
Dr. Dave Chatterjee:and he's also the author of Hackable: How To Do Application
Dr. Dave Chatterjee:Security Right. His company, made up of ethical hackers was
Dr. Dave Chatterjee:born out of the Ph. D. Program at the Johns Hopkins University.
Dr. Dave Chatterjee:They have been doing security assessments and security
Dr. Dave Chatterjee:consulting for a long time for both large enterprises and
Dr. Dave Chatterjee:funded startups and everyone in between. Since 2005, they have
Dr. Dave Chatterjee:been hired by hundreds of companies, and they have helped
Dr. Dave Chatterjee:discover 10s of 1000s of security vulnerabilities. Their
Dr. Dave Chatterjee:work has appeared in The New York Times, Wall Street Journal,
Dr. Dave Chatterjee:Washington Post, USA Today, Financial Times, Wired, and CBS
Dr. Dave Chatterjee:News on Assignment. Hey, Ted, welcome.
Ted Harrington:Thanks for having me. Excited to be here.
Dr. Dave Chatterjee:So let's talk about hacking. For the
Dr. Dave Chatterjee:benefit of the listeners, provide an overview of hacking
Dr. Dave Chatterjee:like hacking 101, what is it? What are the many consequences?
Ted Harrington:Sure, so I like this question a lot, because the
Ted Harrington:concept of hacking and the concept of hackers is pretty
Ted Harrington:misunderstood. So maybe we start there, like what is what is
Ted Harrington:hacking? What is a hacker and a lot of times people talk about
Ted Harrington:this idea, you know, hackers as if they're bad, right? That the
Ted Harrington:hackers are malicious, or associated with wrongdoing or
Ted Harrington:evil or whatever. And that's only partly true, because that's
Ted Harrington:a certain that is certainly a type of hacker. But hackers, the
Ted Harrington:term hacker is neutral. It's neither good nor bad. It's a
Ted Harrington:hacker is someone who is a problem solver. They're
Ted Harrington:creative. They're someone who looks at the way a system works
Ted Harrington:and says, you know, can it behave differently than what was
Ted Harrington:intended to do? Can I create something. So that's really what
Ted Harrington:hackers are, and then the fork in the road comes to motivation,
Ted Harrington:right? So if someone is doing this, because they want to
Ted Harrington:obtain some sort of personal gain, they want to harm others.
Ted Harrington:That's what attackers would be certainly. But the other forks
Ted Harrington:of the road are ethical hackers, people who do the same things
Ted Harrington:use the same tools, the same techniques, still want to find
Ted Harrington:those issues with how a system works. But they do it because
Ted Harrington:they want to fix the system, they want to make it better,
Ted Harrington:they want to improve it. And that's the corner of the world
Ted Harrington:that I come from, that our people all come from. And both
Ted Harrington:are hackers. So really fundamentally, that's what
Ted Harrington:hacking is hacking is looking at something and saying, you know,
Ted Harrington:can it be differently, and there's this classic TV series
Ted Harrington:called MacGyver that, you know, maybe younger generations might
Ted Harrington:not be familiar with. I've never even actually really seen
Ted Harrington:MacGyver myself. But I'm very familiar with the concept of
Ted Harrington:MacGyver. And he's, you know, this dude, who would just he
Ted Harrington:create things out of, he'd take things that were supposed to do
Ted Harrington:one thing and make it do something else. Like if there
Ted Harrington:was one episode where he, I think he needed to start a car
Ted Harrington:or something and he took a paperclip, which the purpose of
Ted Harrington:a paperclip is to clip together paper. And he used this to like
Ted Harrington:somehow, you know, ignite the engine in a vehicle. That's a
Ted Harrington:hacker that's someone who says, you know, things supposed to
Ted Harrington:work in a certain way, can I make it behave differently, and
Ted Harrington:then motivation determines whether that's a good thing or a
Ted Harrington:bad thing.
Dr. Dave Chatterjee:That's interesting. That's an
Dr. Dave Chatterjee:interesting way of looking at hacking. I never thought about
Dr. Dave Chatterjee:it as hackers as problem solvers. But I see from where
Dr. Dave Chatterjee:you're coming. With the growing expansion of attack surfaces and
Dr. Dave Chatterjee:evolution of attack vectors. It's hard for organizations to
Dr. Dave Chatterjee:keep up with the latest hacking methods and techniques. And
Dr. Dave Chatterjee:that's why companies often hire organizations that are made up
Dr. Dave Chatterjee:of ethical hackers to help them stay on top of information
Dr. Dave Chatterjee:security management to the extent possible. So shed some
Dr. Dave Chatterjee:light on why hackers might be interested in breaching systems
Dr. Dave Chatterjee:of certain types of organizations over others, if
Dr. Dave Chatterjee:that's the case, that may not be the case. And related to that,
Dr. Dave Chatterjee:are any organization types more vulnerable than others? Yeah,
Ted Harrington:let's tackle those separately, because they
Ted Harrington:let's
Ted Harrington:are two slightly different questions. But that can be
Ted Harrington:conflated. So why would an attacker attack a specific
Ted Harrington:organization? I think this is a wonderful question. And it goes
Ted Harrington:to the heart of one of the very common misunderstandings that
Ted Harrington:people have about attackers. Most people think that this idea
Ted Harrington:of we've already broken down that there's, you know, hackers
Ted Harrington:can be good, or hackers can be bad. But even amongst the bad
Ted Harrington:hackers, they're not all the same thing. But we often talk
Ted Harrington:about them as if they're all the same thing. And that's actually
Ted Harrington:not true. So different attacker groups, they're motivated to
Ted Harrington:achieve different outcomes. So the most common one, almost
Ted Harrington:everybody talks about hackers as being profit motivated. And that
Ted Harrington:is indeed a very compelling motivation for many types of
Ted Harrington:attackers. I mean, basically, anyone who engages in ransomware
Ted Harrington:profit is the motive. Almost everyone, there's, there's cases
Ted Harrington:where maybe you use that to hide your other motive, but so
Ted Harrington:someone who wants to make money that's like organized crime as
Ted Harrington:an example, they are attacking because they want to make money.
Ted Harrington:But then you've got groups that are more interested in
Ted Harrington:notoriety, right. So maybe it's someone who just they want to
Ted Harrington:prove they can do it, or they want to go to brag about it, or
Ted Harrington:they want to, yeah, they just want the notoriety associated
Ted Harrington:with it. That's a different motivation from someone who may
Ted Harrington:be like anonymous, the hacker collective that fits in the
Ted Harrington:group of what are called hacktivists, which they attack
Ted Harrington:organizations in order to make a statement. And then there's
Ted Harrington:nation states that attack organizations in order to pursue
Ted Harrington:their geopolitical objectives. And so when we think about
Ted Harrington:different attackers having different motivations that comes
Ted Harrington:into play, in terms of how we now think about how we defend,
Ted Harrington:because we think about, well, what are we trying to protect,
Ted Harrington:and is what we have something that an attacker could pursue
Ted Harrington:their specific motivation for. So they want to feel like a lot
Ted Harrington:of companies, they'll say, Well, I don't have anything valuable,
Ted Harrington:I don't protect any valuable data. So no one's going to
Ted Harrington:attack me because I don't have valuable data and no one's gonna
Ted Harrington:make money off of attacking me. And hopefully, what I just
Ted Harrington:illustrated makes it clear that that's actually not the case.
Ted Harrington:You know, you might not have valuable data, but maybe you
Ted Harrington:have, maybe your organization can be swept up in a botnet.
Ted Harrington:Your computational power can be used in a broader DDoS type
Ted Harrington:attack. Maybe your organization has some sort of influential
Ted Harrington:information on maybe population trends or things that are
Ted Harrington:happening on a national level that another nation might want
Ted Harrington:to understand. So we have to understand the attacker, why
Ted Harrington:they're motivated in order to help ourselves think about what
Ted Harrington:do we need? Why would someone attack us?
Dr. Dave Chatterjee:Very true, very true. We hear this phrase
Dr. Dave Chatterjee:'thinking like a hacker' a lot. The ability to think like a
Dr. Dave Chatterjee:hacker is considered a best practice in cybersecurity
Dr. Dave Chatterjee:governance. I'd like to probe a little deeper into it. Can you
Dr. Dave Chatterjee:shed some light on that?
Ted Harrington:Yeah, I'm, I'm definitely one of those people
Ted Harrington:who's out there banging this drum. I say this to anyone who
Ted Harrington:will listen that Yeah, to defend against an attacker, we need to
Ted Harrington:think like an attacker. Um, and this this idea of more
Ted Harrington:generally, you know, think like a hacker, whether that's a you
Ted Harrington:know, good type of hacker or a bad type Agere. This is
Ted Harrington:absolutely mission critical for organizations to be able to
Ted Harrington:secure their what it is, whatever it is, they're trying
Ted Harrington:to protect the most, they really need to think like, someone who
Ted Harrington:would attack a system. And that's not very easy actually to
Ted Harrington:do. And most people aren't wired that way. I often think of this,
Ted Harrington:like the movie, The Matrix. Maybe this is a little bit of a
Ted Harrington:spoiler, but the movie has been out for, like 25 years. So if
Ted Harrington:you haven't seen it yet, that's on you. And then I'm spoiling
Ted Harrington:it. You know, you find out partway through this movie, that
Ted Harrington:you know, everyone who's living normal life, like we live normal
Ted Harrington:life, you know, here on Earth, all of a sudden, you're actually
Ted Harrington:in a simulation. And when you unplug from the matrix, you
Ted Harrington:realize you're, you're now living reality, but the reality
Ted Harrington:is really ugly. You're in this like post apocalyptic world and
Ted Harrington:it's like everything cold your food is basically like eating
Ted Harrington:dust. It's, it's a terrible life, but you have freedom. And
Ted Harrington:I often think of that's what it's like, once you can think
Ted Harrington:like a hacker is like once you unplug from the matrix, and you
Ted Harrington:see kind of all the darkness in the world. Hold, there's no
Ted Harrington:going back. And so it's not for everybody, not everybody should
Ted Harrington:not think that everybody doesn't have the capability to see the
Ted Harrington:world that way. And most people probably don't want to see the
Ted Harrington:world that way. But those of us who are engaged in this as a
Ted Harrington:profession, or even as a hobby, this is the way that we see it.
Ted Harrington:And the reason that this is important is, I guess, think of
Ted Harrington:it like, what's any metaphor, I don't know, think of a sports
Ted Harrington:metaphor, right? If you're, if you're playing against an
Ted Harrington:opponent coming up this weekend, how are they going to think
Ted Harrington:about their plan to try to win the game against you, right, you
Ted Harrington:have to put yourself in the shoes of your opponent, in order
Ted Harrington:to be able to understand how will you like what's, what's the
Ted Harrington:lens through which they see you, and how will you be attacked.
Ted Harrington:And that's why this idea of thinking like a hacker is
Ted Harrington:really, really important. Because, again, to use a sports
Ted Harrington:metaphor, like when when we think as defenders, that sort of
Ted Harrington:like someone who's, you know, playing basketball, and they're,
Ted Harrington:they're playing defense on their heels, right. And so anyone
Ted Harrington:who's played really any ball sports, any team sports knows
Ted Harrington:that if your weight is on your heels, it's really, really hard
Ted Harrington:to react to the ball coming at you. And so the advice is, you
Ted Harrington:always have to be on your toes, you have to be leaning forward,
Ted Harrington:not leaning backwards. And so when we think like defenders,
Ted Harrington:we're leaning backwards, we're sort of like waiting for the
Ted Harrington:world to come to us. But that makes it really hard to react.
Ted Harrington:Instead, we should be leaning forward, we should be on our
Ted Harrington:toes. And we should be thinking like, Hey, we're actually on the
Ted Harrington:offense, not on the defense. And that's what think like a hacker
Ted Harrington:helps you do.
Dr. Dave Chatterjee:And so, you know, as you said, that you
Dr. Dave Chatterjee:don't expect everyone to think like a hacker. Now, maybe the
Dr. Dave Chatterjee:cybersecurity professionals in the organization, who are paid
Dr. Dave Chatterjee:to, you know, be proactive, make recommendations on how to secure
Dr. Dave Chatterjee:the organization, from new attack types, maybe they are the
Dr. Dave Chatterjee:ones who should be thinking like a hacker. But I'm just curious
Dr. Dave Chatterjee:to know, your thoughts and perspectives on the other group,
Dr. Dave Chatterjee:the folks who generally get compromised, they are not very
Dr. Dave Chatterjee:security savvy, they learn as best they can, what they're told
Dr. Dave Chatterjee:by the organization. For those folks, obviously, they are not
Dr. Dave Chatterjee:the type that you'd recommend, think like a hacker. But what
Dr. Dave Chatterjee:advice do you have for them?
Ted Harrington:Yeah, so as you can, as you're gonna see,
Ted Harrington:throughout the crowd, I'm big on metaphors. So let's, let's use
Ted Harrington:the metaphor of someone who builds skyscrapers, right? So
Ted Harrington:that particular type of contractor that takes a specific
Ted Harrington:skill set, developed over a long period of time, you know, how to
Ted Harrington:build a skyscraper. Now, if someone comes to you and says,
Ted Harrington:Hey, we've got this other skyscraper over here, and we
Ted Harrington:need to demo it, we need to demolish it. You know how these
Ted Harrington:things, you build these things all day? Can you demolish this
Ted Harrington:one? They'd be like, maybe like, I guess I know the fundamentals
Ted Harrington:of how it's built. But like, that's not what I do. That's not
Ted Harrington:my profession. That's not my chosen craft. So what do they
Ted Harrington:do? They say, Well, why don't we get a demo expert in here to do
Ted Harrington:the demo, and I'll work with them. And I'll say, you know,
Ted Harrington:we'll, we'll talk through the mechanics of this building. And,
Ted Harrington:and that's how we'll have a successful demolition. But
Ted Harrington:they're two completely different crafts. So the first piece of
Ted Harrington:advice is, you need to work with somebody, like you're the
Ted Harrington:builder, you need to work with a breaker, right? So companies who
Ted Harrington:are out there building, whatever system that you're building, you
Ted Harrington:definitely want to work with ethical hackers, because they
Ted Harrington:help you because they bring that expertise, that, as you
Ted Harrington:correctly noted, isn't necessarily the core part of
Ted Harrington:what it is that you're doing. It's similar to like any
Ted Harrington:expertise that you would partner with externally, so companies
Ted Harrington:all the time will partner with, you know, outside counsel,
Ted Harrington:outside accountants outside, you know, pick your expertise,
Ted Harrington:they'll, they'll say, Hey, you're gonna come and sort of be
Ted Harrington:the surgical strike that does this specific thing that we
Ted Harrington:don't actually fully staffing out. So that's the first thing
Ted Harrington:is, you know, work with outside organizations. Second thing is
Ted Harrington:to, even though that that's what has to happen is you have to
Ted Harrington:work with outside organizations who specialize in this thing.
Ted Harrington:You want to also make sure that you understand the principles.
Ted Harrington:So if we use that, the skyscraper metaphor, the guy who
Ted Harrington:or the guy or the gal who builds a skyscraper should also know
Ted Harrington:where the weaknesses are and know and know how it might
Ted Harrington:crumble if it's not built correctly. Now, that doesn't
Ted Harrington:mean they're gonna go out and do demo, but they're going to know
Ted Harrington:like, Hey, this is a, you know, this type of joint stresses in a
Ted Harrington:in a bad way, we should make sure we don't use that type of
Ted Harrington:joint. And I'm way oversimplifying the practice of
Ted Harrington:building a skyscraper for sure. But you know, it's for
Ted Harrington:illustrative purposes. And so that's the second piece of
Ted Harrington:advice is make sure you understand the principles so
Ted Harrington:your work with someone else, but still, you have to make sure
Ted Harrington:that they understand the principles yourself. And then
Ted Harrington:the third is this. It's abstract, but it's keep asking
Ted Harrington:these questions, right? It's your whatever it is that you do
Ted Harrington:in any profession, your core expertise, you're going to, you
Ted Harrington:know, that's where the focus of your develop effort developing
Ted Harrington:yourself is going to be. But there's always going to be these
Ted Harrington:things on the periphery that like, oh, I should probably know
Ted Harrington:about that. But maybe I'm not the expert in that. But by
Ted Harrington:asking the questions of what do I need to know about x? So the
Ted Harrington:person who's listening to this right now, who builds systems
Ted Harrington:and says, What do I need to know about security? That question is
Ted Harrington:so important, it's so powerful, because just by asking it, it
Ted Harrington:leads you to the type of growth that is necessary, in order to
Ted Harrington:make sure you understand the principles even though the, the
Ted Harrington:entity or the person who's going to be responsible for this is
Ted Harrington:going to be someone else, you can't completely delegate it to
Ted Harrington:someone else.
Dr. Dave Chatterjee:I agree. I wholeheartedly agree. In fact,
Dr. Dave Chatterjee:as you were talking, a thought came to mind. I wish you know,
Dr. Dave Chatterjee:that. There are more demonstrations, visual
Dr. Dave Chatterjee:demonstrations, graphical illustrations, and various forms
Dr. Dave Chatterjee:of presentations made available to the masses, where people get
Dr. Dave Chatterjee:to see how hackers think, how hackers act. And I realized that
Dr. Dave Chatterjee:can get very technical, but that's where the skill lies. Can
Dr. Dave Chatterjee:we present the technical stuff in a non technical way you, you
Dr. Dave Chatterjee:use metaphors and you, you know, kind of talked about several
Dr. Dave Chatterjee:movies. So maybe we need more media help here to popularize
Dr. Dave Chatterjee:thinking like a hacker. So everyone on the street literally
Dr. Dave Chatterjee:has some sense of what these guys are up to how they are
Dr. Dave Chatterjee:thinking how they try to attack, not to suggest that this would
Dr. Dave Chatterjee:make everyone an expert, but at least it whets the appetite, it
Dr. Dave Chatterjee:gives them a basic understanding. And that would
Dr. Dave Chatterjee:help the organization to mobilize support from from all
Dr. Dave Chatterjee:parts of the organization. Thoughts, reactions?
Ted Harrington:Yeah, well, let me try to illustrate with maybe
Ted Harrington:a metaphor that most people can relate to. Most people don't
Ted Harrington:like waiting in line. Right? I think that's just, even though
Ted Harrington:everyone does wait in line, like people literally spend money and
Ted Harrington:vacation time to go to places like Disneyland, because they
Ted Harrington:want to wait in line all day. So they can, you know, wait in line
Ted Harrington:for an hour to take a three minute ride. Not for me, but
Ted Harrington:hey, you know, whatever floats your boat, but I think but, but
Ted Harrington:most people, even though they wait in those lines, they pay to
Ted Harrington:wait in those lines, they take time off their job to wait in
Ted Harrington:those lines, people would still say they don't like waiting in
Ted Harrington:the line. I think that's sort of a universal human condition. No
Ted Harrington:one, no one is enjoying the line. So let me tell you about a
Ted Harrington:story that I had involving a line and this is this story
Ted Harrington:actually is a form of social engineering. But the components
Ted Harrington:to it describe exactly the process that an attacker would
Ted Harrington:go through. So if we can imagine a bar, and the bar is going to
Ted Harrington:be you know, a bar, like a nightclub. This bar represents
Ted Harrington:our, it represents a, a system that someone is building. So I
Ted Harrington:this was a few years ago, I wound up going to this, this
Ted Harrington:bar, and I was meeting up with some friends. And I can't
Ted Harrington:remember why I needed to go to this specific bar. But I mean,
Ted Harrington:it was like someone's birthday, but I had to go to this. It
Ted Harrington:wasn't like, we'll just go to another bar, and there was this
Ted Harrington:huge line. And then when you you get through this whole long line
Ted Harrington:takes a half an hour or whatever, then you pay a cover
Ted Harrington:charge to get in. And I didn't want anything to do with either
Ted Harrington:of those. I was like I don't want to wait in line and then
Ted Harrington:pay you know, whatever. 20 bucks just just for the right to now
Ted Harrington:go in and I'll spend more money. So I did what you know, really
Ted Harrington:any hacker minded person does the first thing I did was I
Ted Harrington:assessed the system I looked at how does the system work? Okay,
Ted Harrington:well, there's a line that gets you in and, and then you pay a
Ted Harrington:cover when you're in and that grants you access. But I noticed
Ted Harrington:there's also this other area for a VIP entrance. And that VIP
Ted Harrington:entrance, you can only there's no line, there's no cover, but
Ted Harrington:you can only go in if you're on the list. So that's the second
Ted Harrington:thing I did was I said alright, well, how could the challenge
Ted Harrington:question was how can I make them believe I'm on the list? I'm not
Ted Harrington:on the list, but how can I make them believe it? So that's the
Ted Harrington:second thing that attackers will do, though. They'll essentially
Ted Harrington:set out a challenge statement for themselves. Like what's the
Ted Harrington:goal? What am I trying to do? And in this case, I was trying
Ted Harrington:to get the privileges of someone on the VIP list when I didn't
Ted Harrington:have those privileges. That's called privilege escalation. So
Ted Harrington:then the next thing I did was what any attacker Do I, I probed
Ted Harrington:some I established some assumptions about how the system
Ted Harrington:worked. And my assumption was, if I can produce the name of
Ted Harrington:someone on that list, they will assume I'm on the list. So that
Ted Harrington:was my goal, I needed to produce a name on the list. I did not
Ted Harrington:know any names. So here's what I did. So I walk right up to the
Ted Harrington:VIP hostess, and I say, Hi, I'm on the list. Now, again, I just
Ted Harrington:told you I'm not I'm not listed. She doesn't know this, but I'm
Ted Harrington:not on the list. So I said, Hi, I'm on the list. So when she
Ted Harrington:asks me, What My name is telling her my name wasn't going to
Ted Harrington:help, because I'm not on the list. And guessing is like,
Ted Harrington:what's the chances? I guess somebody's name, right? Like,
Ted Harrington:it's so like, why even bother? So I'm not gonna guess. So
Ted Harrington:instead, I issue what's called a specially crafted input. Now,
Ted Harrington:this is when an attacker is probing a system to see how it's
Ted Harrington:going to react. And in this case, a specially crafted input
Ted Harrington:was I said, Well, I'm with the group, I made an assumption that
Ted Harrington:the there was going to be a group, and the group would be on
Ted Harrington:the VIP list. And so when she said which group again, I
Ted Harrington:didn't, you know, same problems, I didn't know the names of any
Ted Harrington:group guessing wasn't going to help. So again, I asked, I
Ted Harrington:issued another specially crafted input, and I said, I'm with the
Ted Harrington:big group. And I was making an assumption that that would be
Ted Harrington:something that would be on the list, there would be one group
Ted Harrington:larger than others. And with that, she looks down at her
Ted Harrington:clipboard, she flips a couple pages, and she says, Oh, the
Ted Harrington:Smith party. And I said, Yes, I am with the Smith party. And
Ted Harrington:with that, I had achieved the goal, I associated myself with a
Ted Harrington:name on the list, she opens the velvet rope escorts, we passed
Ted Harrington:the law and pass the cover charge. And, you know, I went
Ted Harrington:into the bar, I should say, as a sidebar, I am an ethical hacker.
Ted Harrington:So even though I did not pay the cover charge, I'm more than made
Ted Harrington:up for it with over tipping my bar staff, everyone, the only
Ted Harrington:person who lost money that night was probably me, like everyone
Ted Harrington:made out. But I didn't have to wait in line, which is what I
Ted Harrington:didn't want to do. But the point of that story, whether you like
Ted Harrington:going to bars or not, or you've never even been to a bar, we've
Ted Harrington:all been in situations we don't like waiting in line. And that
Ted Harrington:story can illustrate in a way that I think everyone can relate
Ted Harrington:to the process that attackers go through.
Dr. Dave Chatterjee:Excellent. That's a very, very interesting
Dr. Dave Chatterjee:and telling story. In fact, that reminds me, this is not so much
Dr. Dave Chatterjee:about how hackers hack, but how to be on your guard to be on
Dr. Dave Chatterjee:your defense. And I wasn't that night, where I went to a
Dr. Dave Chatterjee:restaurant at great city, I won't name it here. And it was a
Dr. Dave Chatterjee:Halloween, I think, and it was a haunted restaurant. So we were
Dr. Dave Chatterjee:having dinner there. And the lights were very dim. And you
Dr. Dave Chatterjee:know, they were trying to create that atmosphere I was in my
Dr. Dave Chatterjee:family. So we had dinner. And then when the waitress came up
Dr. Dave Chatterjee:asking for the credit card, I gave it to her without thinking
Dr. Dave Chatterjee:twice that I should be scanning the card right there. And then I
Dr. Dave Chatterjee:shouldn't be giving it to somebody. And next moment. Well,
Dr. Dave Chatterjee:you know, that night, everything went off. Well, we checked out
Dr. Dave Chatterjee:and we had a good night's rest. Next morning, I was driving my
Dr. Dave Chatterjee:son for his tennis match. And then I got a call. I was not
Dr. Dave Chatterjee:planning to take the call. It was an 800 number call. But then
Dr. Dave Chatterjee:I did. I'm glad I did. It was a Bank of America representatives
Dr. Dave Chatterjee:asking where I was the previous night. And then he was able to
Dr. Dave Chatterjee:share some data and facts that told me that my card got hacked.
Dr. Dave Chatterjee:And it was already being used in the state of California. And I
Dr. Dave Chatterjee:was on the eastern part of the country. So I knew that somebody
Dr. Dave Chatterjee:had gotten access to it. So this is an example where even those
Dr. Dave Chatterjee:of us who are conscious about this phenomenon will play a
Dr. Dave Chatterjee:role. Even they can get caught napping and they can get
Dr. Dave Chatterjee:compromised, and which has happened to me not once but
Dr. Dave Chatterjee:several times. And that's all the more I believe the need for
Dr. Dave Chatterjee:reiterating reinforcing some fundamental principles, some
Dr. Dave Chatterjee:guidelines and recommendations. Because I believe that the very
Dr. Dave Chatterjee:best of people have been, can be or will be breached in the
Dr. Dave Chatterjee:future. So that is great. Good discussion on that topic.
Dr. Dave Chatterjee:Switching gears a little bit. Let's talk about security
Dr. Dave Chatterjee:assessments. It's reasonable to assume that most organizations
Dr. Dave Chatterjee:are engaging in security assessments. But the more
Dr. Dave Chatterjee:nuanced question is, are they engaging in the right kinds of
Dr. Dave Chatterjee:security assessments with methodologies that best align
Dr. Dave Chatterjee:with their desired outcomes? What are your thoughts?
Ted Harrington:You are preaching to the choir right
Ted Harrington:now? That is that is the question in that matter that
Ted Harrington:absolutely is the question that matters. Wow. So the way you
Ted Harrington:actually framed the question first was, you know, we're
Ted Harrington:assuming that most organizations are getting security
Ted Harrington:assessments. I hope that is true. I guess it should be
Ted Harrington:stated that that's assuming an organization is something worth
Ted Harrington:protecting, that is actually an important item to note. So if
Ted Harrington:you don't have something worth protecting, then like, why would
Ted Harrington:you invest in protecting it doesn't matter. But assuming you
Ted Harrington:do, I mean, someone who's listening to a show like this,
Ted Harrington:you probably do. Right? You wouldn't be investing your time,
Ted Harrington:in listening to Ted ramble until random metaphors, if you didn't
Ted Harrington:have something to protect, so we're assuming have something to
Ted Harrington:protect, you're getting these security assessments done. And
Ted Harrington:the real problem that I see, I mean, one of the motivations to
Ted Harrington:want to write a book was because I saw this rampant problem all
Ted Harrington:over the place, which is that the way that we talk about
Ted Harrington:security testing, and we I'm talking about collectively, the
Ted Harrington:security community, but also those who engage with security
Ted Harrington:community who hire security professionals to do security
Ted Harrington:testing, we talk about it in very imprecise ways. And it
Ted Harrington:winds up leading to some really bad outcomes. So what most
Ted Harrington:people want when they're hiring, security testing? Well, there
Ted Harrington:are different motivations for why someone would go hire one.
Ted Harrington:But they're usually something like, well, I need to prove it
Ted Harrington:to someone else. And I need to actually secure the thing. So
Ted Harrington:those are, sometimes hopefully, it's both sometimes it's just
Ted Harrington:one, like, I need to prove this, I don't care what it is, I need
Ted Harrington:to prove it to someone else that I did a security test. But In
Ted Harrington:but in the case of, you know, the more progressive companies
Ted Harrington:definitely, they're actually trying to improve the security
Ted Harrington:of the system. They're not just going through the motions. But
Ted Harrington:the problem is, the way we talk about security testing is we use
Ted Harrington:terms incorrectly all the time. So people often will ask for
Ted Harrington:penetration testing. That's sort of the term that's become the
Ted Harrington:catch all. But penetration testing is a very specific type
Ted Harrington:of thing. But complicating that problem, they're asking for
Ted Harrington:penetration testing, they're usually sold something else.
Ted Harrington:Like if you Google that term, right now, almost all the
Ted Harrington:results you're gonna get, not all of them, but at least three
Ted Harrington:quarters of them are something else, they're going to be
Ted Harrington:vulnerability scanning, they're not penetration testing. But
Ted Harrington:then what makes it even more complicated is that what people
Ted Harrington:actually need usually isn't actually penetration testing at
Ted Harrington:all. What they usually need is what's called vulnerability
Ted Harrington:assessments. And I can definitely I've, of course, I've
Ted Harrington:metaphors, I can explain the difference between these these
Ted Harrington:three types. But the point that I want to leave on answering
Ted Harrington:your question here is that those are three really different
Ted Harrington:things. They entail different investments of time, and money
Ted Harrington:and person power, and they deliver different things. So
Ted Harrington:when people are asking for something, they're getting
Ted Harrington:something else, and yet they actually needed a third thing
Ted Harrington:altogether, have we actually achieved the mission? Right?
Ted Harrington:Have we actually accomplished what we set out to accomplish,
Ted Harrington:and that is a really big problem.
Dr. Dave Chatterjee:There are a few things that you've mentioned
Dr. Dave Chatterjee:more than once now, and I believe it, it's worth
Dr. Dave Chatterjee:reiterating, re emphasizing, and that is, an organization needs
Dr. Dave Chatterjee:to know, or needs to have a good understanding of what it wants
Dr. Dave Chatterjee:to secure. And what are the tools, the methodologies, the
Dr. Dave Chatterjee:techniques that are out there? Now, one is not expecting an
Dr. Dave Chatterjee:organization, especially smaller organizations resource
Dr. Dave Chatterjee:constrained to have the kinds of expertise to make those calls,
Dr. Dave Chatterjee:but they need to reach out and get help. Again, you know,
Dr. Dave Chatterjee:trying to follow your example of using a metaphor. It's like,
Dr. Dave Chatterjee:when you go to a doctor, and or you're, you're thinking of going
Dr. Dave Chatterjee:to a doctor, because you feel there is an issue. And so you're
Dr. Dave Chatterjee:doing your best due diligence possible, doing your searches,
Dr. Dave Chatterjee:you know, talking to people getting advice. So you have a
Dr. Dave Chatterjee:planning process in place. And it's important, why is it
Dr. Dave Chatterjee:important because it's your health. And I like to use the
Dr. Dave Chatterjee:health metaphor, because when it comes to security, that's the
Dr. Dave Chatterjee:security is the health of the organization. It is I believe
Dr. Dave Chatterjee:that there is not far where we'll be ranking organizations
Dr. Dave Chatterjee:on their security health rating. So therefore, developing an
Dr. Dave Chatterjee:understanding of what the security needs are, and who is
Dr. Dave Chatterjee:the right person who can provide the help or who are the right
Dr. Dave Chatterjee:people who can deliver the goods is absolutely mission critical.
Dr. Dave Chatterjee:So therefore, your points are very well made that to recognize
Dr. Dave Chatterjee:what kind of help you need from a security standpoint. And that
Dr. Dave Chatterjee:will immediately help align what you get by way of security
Dr. Dave Chatterjee:mechanisms, along with your overall organizational goals and
Dr. Dave Chatterjee:strategies. So I just wanted to re emphasize there anything else
Dr. Dave Chatterjee:you'd like to add to that?
Ted Harrington:Well, just that the doctor patient metaphor for
Ted Harrington:security is so good. And there's so many aspects of that
Ted Harrington:relationship that we can, you know, tie back to security, and
Ted Harrington:I'm just deciding whether or not to go down all those different
Ted Harrington:rabbit holes right now. But I'll definitely tie back to one or
Ted Harrington:more of them as as we go. But, um, if we want to use the doctor
Ted Harrington:metaphor, and the context of the question that you're asking
Ted Harrington:about, like, how do we make sure we're getting the right thing? I
Ted Harrington:think it's, that's actually, maybe that's a good metaphor for
Ted Harrington:us to use, because it's like when people go into the doctor's
Ted Harrington:office, and they're like, Oh, I checked on WebMD, my, you know,
Ted Harrington:my symptoms or whatever. And so they, they've self diagnosed, so
Ted Harrington:they go into the doctor, and they're like, I need a, I don't
Ted Harrington:know, insert jargon, technical term right now. And the doctor
Ted Harrington:is like, we'll get to that limit. Let me instead, evaluate
Ted Harrington:your symptoms, see where we're at. And I'll tell you, then, you
Ted Harrington:know, what we need. But the problem that happens in security
Ted Harrington:would be like, so doctors, I guess I don't know what I'm
Ted Harrington:about to say for 100% Certain, because I am not a doctor. But
Ted Harrington:my understanding is that in medicine, a procedure has a
Ted Harrington:name. And that's a universally understood procedure. The
Ted Harrington:problem with what's happening with security. So let's say I
Ted Harrington:don't know what the technical term would be, let's just say
Ted Harrington:it's called knee replacement. You know, someone goes in, and
Ted Harrington:they're like, I think I might, you know, my knees bother me, I
Ted Harrington:need some help with my knee. And then a doctor is like, you need
Ted Harrington:a knee replacement. The problem, insecurity would be like, when
Ted Harrington:one doctor says knee replacement, he means I'm going
Ted Harrington:to replace your knee, another doctor means I'm going to give
Ted Harrington:you orange juice. And a third doctor means I'm going to give
Ted Harrington:you a physical, and you're like, these are all using the same
Ted Harrington:term to describe really, really different things. And the
Ted Harrington:patient doesn't know any better to like, because the patient's
Ted Harrington:going to the expert. That's why this is a real problem. Like if
Ted Harrington:you went to the doctor, and three different doctors said the
Ted Harrington:same term, but they meant three different things. You probably
Ted Harrington:wouldn't go to the doctor anymore. And that's why is such
Ted Harrington:a significant problem.
Dr. Dave Chatterjee:Yep, very cool. You know, I, I authored a
Dr. Dave Chatterjee:book, which, which was published by SAGE last year on
Cybersecurity Readiness:A Holistic and High-Performance
Cybersecurity Readiness:Approach. In that book, I, I presented a framework, it's
Cybersecurity Readiness:called the Commitment, Preparedness and Discipline
Cybersecurity Readiness:framework that is associated with 17 cybersecurity readiness
Cybersecurity Readiness:success factors. And I'm not going to go down that list, but
Cybersecurity Readiness:I wanted your thoughts on some of them, which I have found to
Cybersecurity Readiness:be very important for an organization to secure
Cybersecurity Readiness:themselves or get the resources they need to secure themselves.
Cybersecurity Readiness:And one of those success factors happens to be hands-on top
Cybersecurity Readiness:management. And it's a challenge out there. In terms of how to
Cybersecurity Readiness:get top management attention, how to get top management
Cybersecurity Readiness:actively engaged in cybersecurity planning,
Cybersecurity Readiness:execution, monitoring. Just curious because you're in the
Cybersecurity Readiness:field, and you are you and your company are engaging in engaging
Cybersecurity Readiness:with numerous organizations. What are you seeing out there,
Cybersecurity Readiness:in terms of top management commitment to information
Cybersecurity Readiness:security?
Ted Harrington:Well, it's it's definitely becoming more and
Ted Harrington:more of a priority for executive leadership. I think you probably
Ted Harrington:could have any number of security professionals on here
Ted Harrington:to answer that question that would probably all say, some
Ted Harrington:version of the same thing, right, which is like, security
Ted Harrington:is a business problem, not a technical problem. We need to
Ted Harrington:speak in the language of leaders, which is, you know, in
Ted Harrington:terms of numbers and outcomes, and all that stuff. And we need
Ted Harrington:to make sure that we, you know, don't make it technical and all
Ted Harrington:that. So I would say all those things, too. But instead, what I
Ted Harrington:want to share is something that I see the most progressive
Ted Harrington:organizations doing that are the ones who are getting it right.
Ted Harrington:And they're currently in the minority. They're on if we think
Ted Harrington:about, you know, a bell curve. They're on the early early
Ted Harrington:adopter side. And my hope is that eventually we're going to
Ted Harrington:get the whole world thinking this way. And the way is this
Ted Harrington:one Most people think about security as avoid a bad thing,
Ted Harrington:right, let's not get hacked. That is, in fact, a good way to
Ted Harrington:think about security. But it's incomplete. We also need to
Ted Harrington:think about not just how do we avoid a bad thing? But how do we
Ted Harrington:get a good thing? So not just how do we not get hacked? But
Ted Harrington:how do we gain an advantage. And one of the things that is very,
Ted Harrington:very obvious to me, as I look at the companies really across
Ted Harrington:industries across sectors, the ones who do two things, first,
Ted Harrington:actually secure their systems. And then secondly, in an
Ted Harrington:authentic and credible way, prove it, they gain this
Ted Harrington:incredible competitive advantage over their competitors. So if
Ted Harrington:that's a company, they're competing the way a company
Ted Harrington:will, you know, for customers and market share. But there's
Ted Harrington:other ways you can compete, too, whether that's maybe you're a
Ted Harrington:nonprofit, and you need donors, maybe you're a government, and
Ted Harrington:you need your political influence, or whatever. people
Ted Harrington:and companies and organizations, they want to do business with
Ted Harrington:organizations that are secure, they want trust is the
Ted Harrington:foundation of so they trust someone, they're going to want
Ted Harrington:to work with them, or at least if they don't trust them,
Ted Harrington:they're going to be hesitant to work with them. And so this is
Ted Harrington:one of the things that I see executives at the more
Ted Harrington:progressive organizations capturing, they see it, they
Ted Harrington:look at it, and they're like, if we only think of security as a
Ted Harrington:bad avoid a bad thing, what we're going to do is we're going
Ted Harrington:to make some risk based decisions about, look, this is
Ted Harrington:just a tax on the business. How do we reduce the tax to the
Ted Harrington:right amount that's not so low that we expose ourselves to huge
Ted Harrington:risk, but we're not overspending? That's the way
Ted Harrington:that's the way most people actually think about security,
Ted Harrington:when it's the idea of avoid a bad thing. But now when you
Ted Harrington:change the frame, and you say, Well, how do we get a good
Ted Harrington:thing? How do we get this competitive advantage? Now
Ted Harrington:you're looking at it as an investment. And you're saying
Ted Harrington:it's no longer a cost center to reduce? It's an advantage to
Ted Harrington:optimize? How do we spend in a way that helps us beat the
Ted Harrington:competition? How do we move faster? How do we get more
Ted Harrington:enterprises using us than someone else? And I found that
Ted Harrington:to be the thing that really gets leaders excited, because it's no
Ted Harrington:longer this, like, this is annoying, I don't want to talk
Ted Harrington:about this, make make this problem go away. That's the way
Ted Harrington:most people think about security. Now it is, oh, wait a
Ted Harrington:minute, there is an untapped opportunity to gain a
Ted Harrington:competitive edge. No one else is doing it or not enough people
Ted Harrington:are doing it. Talk to me about that. That's what progressive
Ted Harrington:organizations are doing right now.
Dr. Dave Chatterjee:brilliant, absolutely brilliant. I love the
Dr. Dave Chatterjee:way you put it. One has to look at information security
Dr. Dave Chatterjee:capability as a distinctive competency. And focusing on
Dr. Dave Chatterjee:developing the competency, using that competency or leveraging
Dr. Dave Chatterjee:that competency to achieve a competitive edge is the way to
Dr. Dave Chatterjee:go. The moment you are thinking of security ah that's one more
Dr. Dave Chatterjee:thing we have to do, we don't have a choice, that really
Dr. Dave Chatterjee:doesn't cut it. Rather, taking a very optimistic approach, and
Dr. Dave Chatterjee:saying -- yes, there is this is a problem. This is a constant
Dr. Dave Chatterjee:issue that we have to deal with. So let's see, we can convert the
Dr. Dave Chatterjee:so called problem into an opportunity and be the best we
Dr. Dave Chatterjee:can be in managing this risk. I love that kind of a mindset,
Dr. Dave Chatterjee:that kind of approach. And I'm sure people who are listening
Dr. Dave Chatterjee:are making note of it. I'm sure many, many organizations, many
Dr. Dave Chatterjee:senior executives approach it that way. So, Ted, a couple of
Dr. Dave Chatterjee:months ago, probably in a podcast session, a renowned
Dr. Dave Chatterjee:cybersecurity expert lamented that companies keep making the
Dr. Dave Chatterjee:same mistakes over and over again. So I asked him, I said,
Dr. Dave Chatterjee:What kind of mistakes are they making over and over again? And
Dr. Dave Chatterjee:he talked about vulnerability management, patch management.
Dr. Dave Chatterjee:And, you know, you being in the business, leading a team of
Dr. Dave Chatterjee:ethical hackers, I'm sure you see that a lot. What are your
Dr. Dave Chatterjee:thoughts about what is so difficult or challenging about
Dr. Dave Chatterjee:patch management, vulnerability management, that to use his
Dr. Dave Chatterjee:words again, that companies keep making the same mistakes?
Ted Harrington:Well, I definitely agree with the
Ted Harrington:problem that companies continue making the same mistakes over
Ted Harrington:and over again, I would not limit it just to this particular
Ted Harrington:issue of patch management. I'm a little befuddled myself as to
Ted Harrington:why patch management continues to be such an issue. And that's
Ted Harrington:not to diminish how hard it is. It's hard. Patch management is
Ted Harrington:difficult. What I, for me personally, like if my job was
Ted Harrington:to be In charge of patch management, I'd be terrible at
Ted Harrington:it. Because what it requires for patch management are the kinds
Ted Harrington:of things that like the your brain is wired in a certain way
Ted Harrington:to excel at that I think the kind of person who's really good
Ted Harrington:at like, maybe accounting, the kind of person who wants to make
Ted Harrington:sure that the numbers perfectly zero out and everything's like
Ted Harrington:exactly an order the way that should be. Patch management is
Ted Harrington:kinda like that to like you have that absolute overriding drive
Ted Harrington:for the perfection. But you can take that you combine it with
Ted Harrington:the fact that patches, sometimes break systems and braking
Ted Harrington:systems gets in the way of operational uptime, and
Ted Harrington:operational uptime, and a lot of situations is non negotiable, or
Ted Harrington:operational downtime is not allowable. So there's all these
Ted Harrington:complexities to it. But really, I think that what's happening if
Ted Harrington:we go broader than just patch management, and we say, well,
Ted Harrington:why do we keep making the same problem, like making the same
Ted Harrington:mistakes over and over and over again? And I think it's because
Ted Harrington:we don't necessarily truly understand the problem. And we
Ted Harrington:don't truly understand the solution. And the we I'm
Ted Harrington:describing here is the people who have the problem, and
Ted Harrington:certain corners of the security community who are willing to
Ted Harrington:present the incorrect solution. We talked about penetration
Ted Harrington:testing before. And that's a great example of where, you
Ted Harrington:know, there are people willing to sell companies a penetration
Ted Harrington:test, that isn't a penetration test, they're willing to do
Ted Harrington:that. Now, maybe they don't know that there's a difference.
Ted Harrington:That's negative, that's negligent. Or they do know
Ted Harrington:there's a difference, and they're misrepresenting it
Ted Harrington:anyway. That's irresponsible. So whichever it is, is not good.
Ted Harrington:But the problem is, that's a two sided problem, right? That
Ted Harrington:companies were building things like we talked about before,
Ted Harrington:it's not there every moment of every day working on how do you
Ted Harrington:break things, they're looking to their expert partners to help
Ted Harrington:them and the expert partner isn't actually presenting the
Ted Harrington:appropriate solution, those two issues combined become this
Ted Harrington:like, kind of catastrophic problem.
Dr. Dave Chatterjee:Yep. True. So here comes my final two
Dr. Dave Chatterjee:questions. First one is, What lessons do organizations refuse
Dr. Dave Chatterjee:to learn? Have you come across anything like that? Do you have
Dr. Dave Chatterjee:any thoughts on that? And I don't mean to stump you. So feel
Dr. Dave Chatterjee:free to say what's the next one? And I'm happy to throw out the
Dr. Dave Chatterjee:next one.
Ted Harrington:No, I like that question. Actually, a lot. I
Ted Harrington:would the way I would answer that, though, is I don't think
Ted Harrington:you could say there's a universal, there's not like one
Ted Harrington:lesson that everybody refuses to learn. But within every
Ted Harrington:organization, there is at least one lesson that everybody that
Ted Harrington:that organization refuses to learn. The one that as an
Ted Harrington:example, that it saddens me actually, I was gonna say it
Ted Harrington:irritates me or angers me. I was like, what's the right word for
Ted Harrington:this? But I think it saddens me is the way that sometimes
Ted Harrington:politics work in large enterprises. I've seen it happen
Ted Harrington:time and time again, where, you know, one executive will build a
Ted Harrington:program in a certain way. And that program is succeeding in
Ted Harrington:some way. And then the next, you know, that executive either gets
Ted Harrington:promoted or gets poached go somewhere else. And then the
Ted Harrington:next executive comes in, and the way that exec, that new
Ted Harrington:executive is going to quote unquote, create their own thing,
Ted Harrington:right, is going to create their opportunity to get promoted, or
Ted Harrington:get poached to go somewhere else. They need to do something
Ted Harrington:unique. They can't just do what's already been done. And so
Ted Harrington:that, what do they have to do? They have to look at the this
Ted Harrington:program that's already been built, and say, we're gonna do
Ted Harrington:it totally differently, because I know a better way. But if it's
Ted Harrington:already working, why are you tearing it down? And that is
Ted Harrington:actually a pretty significant problem in corporate America
Ted Harrington:today, that that sort of political need, which I
Ted Harrington:actually, I have no problem with someone needing to say, I need
Ted Harrington:to make my mark on this organization so that I can make
Ted Harrington:more money and provide more for my family. And like, what's
Ted Harrington:wrong with that? That's amazing. But unfortunately, the way that
Ted Harrington:it typically has to play out is by dismantling some other thing
Ted Harrington:that already worked. And so now you have in these, it's kind of
Ted Harrington:amazing when you see large enterprises, how inefficient
Ted Harrington:they can be. Because every few years as there's this turnover,
Ted Harrington:and you know, executive positions. You You've, you're
Ted Harrington:kind of starting things all over again. And I mean, how many
Ted Harrington:people listening right now work in a large enterprise and go
Ted Harrington:through a reorganization? Like every three or four years,
Ted Harrington:you're like, I'll just wait this out, because by the time it
Ted Harrington:actually is implemented, there's going to be a reorg you know.
Dr. Dave Chatterjee:Yep. So let me give you my answer to the
Dr. Dave Chatterjee:question I posed to you. So, you know, two things happen, as your
Dr. Dave Chatterjee:probably aware, it is the medium sized organizations that
Dr. Dave Chatterjee:generally capitulate after a major cyber attack, they go out
Dr. Dave Chatterjee:of business, there is data to support that. 60 to 70%, of
Dr. Dave Chatterjee:small and medium sized enterprises cease to exist,
Dr. Dave Chatterjee:which is a very rough consequence, probably the most
Dr. Dave Chatterjee:severe consequence. But then there are large organizations.
Dr. Dave Chatterjee:And again, I won't take any names here, who, for lack of a
Dr. Dave Chatterjee:better word, made some very reckless mistakes, that
Dr. Dave Chatterjee:borderlines gross negligence, and breach has happened. There
Dr. Dave Chatterjee:were severe consequences. But they get bailed out for a
Dr. Dave Chatterjee:variety of reasons. And that's where my concern lies. Not that
Dr. Dave Chatterjee:we're going to solve this problem here, and neither am I
Dr. Dave Chatterjee:trying for you to suggest what the solution should be. But
Dr. Dave Chatterjee:that's where my concern is that when these organizations get
Dr. Dave Chatterjee:bailed out, do they learn the lessons and they or are they do
Dr. Dave Chatterjee:they make the necessary changes. And these are not symbolic
Dr. Dave Chatterjee:things that you put out there to impress the media and impress
Dr. Dave Chatterjee:your investors. But it goes deeper into their processes into
Dr. Dave Chatterjee:how security is approached by the organization, whether
Dr. Dave Chatterjee:security is built into their organizational culture. In my
Dr. Dave Chatterjee:book, I talk about creating and sustaining a high-performance
Dr. Dave Chatterjee:information security culture, it's hard to do. But it is
Dr. Dave Chatterjee:definitely something that organizations should, should
Dr. Dave Chatterjee:strive towards. So that's from where I was coming, when I asked
Dr. Dave Chatterjee:you that question.
Ted Harrington:It's hard to say without being on the inside of
Ted Harrington:every organization, right, whether they've learned their
Ted Harrington:lesson or not, but you see plenty of cool success stories,
Ted Harrington:you know, I'm in the aftermath of major breaches, including the
Ted Harrington:industry around whoever the victim was, you know, the movie
Ted Harrington:business is a great example. Sony, you know, went through
Ted Harrington:that really very public. You know, that was a real bummer
Ted Harrington:that that breach for everyone who not just the people at Sony,
Ted Harrington:but the people who work with Sony in the movie business is a
Ted Harrington:it's kind of a small world, everyone kind of knows everyone.
Ted Harrington:And, you know, there was a lot of a lot of hearts went out for
Ted Harrington:that. That was a really tough time for a lot of people. But
Ted Harrington:it's really cool to see in the aftermath, how the security
Ted Harrington:programs at different studios, got more funding got more
Ted Harrington:people, they got more sophisticated. And that's a cool
Ted Harrington:aftermath. I mean, yeah, you don't want a company to go
Ted Harrington:through what Sony went through. That's, that's terrible. But if
Ted Harrington:it has to happen, then let's make sure that some really
Ted Harrington:positive result. And that's, that's definitely what's been
Ted Harrington:happening. So that was pretty cool. That was pretty cool to
Ted Harrington:see that.
Dr. Dave Chatterjee:That's great to hear. I'm glad you
Dr. Dave Chatterjee:shared that with us. There are I'm sure many, many positive
Dr. Dave Chatterjee:stories of recovery, and, you know, coming back revitalized
Dr. Dave Chatterjee:and in ways that has made the organization better. So that's
Dr. Dave Chatterjee:good to hear. Hey, as much as I would like to keep talking with
Dr. Dave Chatterjee:you, I've been enjoying this, you know, we are getting to the
Dr. Dave Chatterjee:end of our time here. So let's try to wrap things up with you
Dr. Dave Chatterjee:sharing any final takeaways for the audience. Any final thoughts
Dr. Dave Chatterjee:for the audience?
Ted Harrington:Yeah, I mean, I definitely always like to end on
Ted Harrington:a high note. And I feel like the story I just told was, was a
Ted Harrington:high note. So there we go, you already have your high note. You
Ted Harrington:know, we're seeing industries react really well in the
Ted Harrington:aftermath of, of breaches. But I think that I would just leave
Ted Harrington:people with this fact that the security community is a
Ted Harrington:passionate one that really is trying to improve things every
Ted Harrington:day. Ethical hackers included amongst that, and that, to me is
Ted Harrington:really exciting to live in it and to see it and to those of
Ted Harrington:you who maybe are wanting to join security, or maybe you are
Ted Harrington:not in security, but you work with security companies, just
Ted Harrington:know that there's a really passionate group, let's move
Ted Harrington:forward. And yeah, I mean, that just we can end on that note,
Ted Harrington:and if anyone wants to know anything more about, you know,
Ted Harrington:if any of the ideas we talked about you wanted to ask me
Ted Harrington:about, personally, you want to follow me on social media, you
Ted Harrington:want to know more about my book, you you want help with your
Ted Harrington:security testing program. Just hit me up, I'm easy to find at
Ted Harrington:Ted harrington.com. And everything you could need to
Ted Harrington:know is right there.
Dr. Dave Chatterjee:Fantastic Ted, thank you again for your
Dr. Dave Chatterjee:time. It's been a pleasure.
Ted Harrington:Thank you for having me.
Dr. Dave Chatterjee:A special thanks to Ted Harrington for his
Dr. Dave Chatterjee:time and insights. If you like what you heard, please leave the
Dr. Dave Chatterjee:podcast a rating and share it with your network. Also,
Dr. Dave Chatterjee:subscribe to the show, so you don't miss any new episodes.
Dr. Dave Chatterjee:Thank you for listening, and I'll see you in the next
Dr. Dave Chatterjee:episode.
Introducer:The information contained in this podcast is for
Introducer:general guidance only. The discussants assume no
Introducer:responsibility or liability for any errors or omissions in the
Introducer:content of this podcast. The information contained in this
Introducer:podcast is provided on an as-is basis with no guarantee of
Introducer:completeness, accuracy, usefulness, or timeliness. The
Introducer:opinions and recommendations expressed in this podcast are
Introducer:those of the discussants and not of any organization.
