Easy Prey17 Mar 2021

Ethical Hacking with Brian Self

Ethical hacking may seem like an oxymoron, but having someone that you trust do a penetration test on your network may shock you. Our guest today has been helping people for 20 years to know when they're vulnerable, and he shares his stories and insights to help you keep your information secure.

Today's guest is Brian Self. Brian is a certified Information Systems Security professional, ethical hacker, and professional speaker. He has the unique ability to take a complicated topic like network security and make it easy for a wide audience to understand. He has been in Information Security for over 15 years and in IT for over 20. He is a professional penetration tester doing offensive security, a compliance subject matter expert, an IT security architect, a security engineer, and a consultant in a variety of security domains.

Show Notes:

[1:10] - Brian shares his background and how he got into the field of IT and security including the story that inspired him to get into ethical hacking.
[3:34] -In 15 minutes, a penetration tester taught Brian more about the system he was using than he ever knew was there. He was hooked from then on.
[4:37] - Brian defines some common hacking terminology in easy-to-understand verbiage.
[6:12] - In Brian's experience, many people tell him that they don't have anything of value that a hacker would want. He clarifies that everyone has something that can make them a target, including things you just don't think of as a vulnerability.
[7:01] - In addition to white hat, gray hat, and black hat hackers, Brian explains the different teams of hackers called blue teams and red teams.
[8:43] - For penetration tests that Brian does, he doesn't necessarily avoid getting caught.
[9:29] - Chris shares his experience with a penetration testing company and the surprise of what they found.
[10:52] - Brian confirms that Chris's experience is very common. There are a lot of old systems in place that may have been secure when created but haven't been updated.
[12:21] - Brian describes one of his very first pen tests and the ease of finding vulnerability.
[13:48] - For pen testers out there who are just starting, here's a rule of thumb, never tell how you got in until you're done. Brian explains why.
[14:58] - If you are approached by someone who claims to have found vulnerability, like a grey hat hacker, Brian advises to be very careful and to get a legal team involved.
[17:02] - Brian is motivated to help people understand security.
[18:38] - Responsible disclosure is when a security researcher gives companies ample time to make changes to their vulnerability. Some security researchers disclose the information on social media.
[20:33] - Brian suggests starting with the basics first before hiring someone to do penetration testing. Are you patching? If not, patch first.
[23:04] - If you're starting from scratch, you can plan for changes in security. Consider who needs access to certain data.
[24:21] - Chris describes the balance that needs to be found between automated systems and human error.
[26:01] - Brian started learning social engineering when he had to convince someone to send him to an event to learn more.
[27:10] - Brian highly recommends the OWASP foundation to continue learning about penetration testing and overall security.
[29:14] - Chris admits that he has been nervous to attend conventions and explains his reasoning.
[31:15] - Chris references a previous episode with Ed Skoudis and an experience he had with the Holiday Hack Challenge.
[32:17] - Brian suggests taking classes, courses, and learning what you can. He says that if you take a course with Ed Skoudis, you are really learning.
[33:09] - In regards to risk, Brian keeps two main points - the likelihood and the impact.
[34:15] - Engage with the pen test team. Don't wait to ask questions. Leverage them while you have their time and attention.
[34:55] - Make sure you have some proof from pen testers so you know how you fixed something without having to track down the pen testers later. You need a detailed report with priorities.
[36:13] - There are some companies that are now specializing in fixing risks. Brian is cautious of this because of an apparent conflict of interest.
[37:34] - It should be negotiated in your contract with a pen test to come back and retest.
[38:38] - Brian describes how he became burnt out with pen testing.
[40:00] - Many companies only hired pen test companies for compliance reasons. There are other companies who actually care about risk management. Brian explains that the types of testing he did varied due to the company's reason.
[42:04] - What are the things that every security professional always tells people? Two-factor authorization is annoying but it is crucial.
[44:01] - Chris and Brian discuss SMS two-factor authorization. Brian explains that for most of us, it is enough. But for some, it isn't.
[45:47] - Brian says that passwords need to be as complex as possible and at least 15 characters long.
[46:22] - Comparing two-factor authorization to a home break-in, Brian illustrates that something is better than nothing.
[48:16] - Do not use the same password on multiple accounts. You need to have extra security for the accounts that are of value.
[49:18] - If you're not going to take the steps for everything, apply it where you really need to, like bank accounts.
[50:08] - Pen tests give companies a lot of assurance, but in a lot of cases it takes away assurance.
[51:04] - A lot of times, security becomes a chore for a lot of companies.
[52:30] - Brian shares a personal story of hackers contacting one of his clients in an attempt to gain access to her network.
[54:07] - One major suggestion that Brian makes to everyone is to block out automatic image loading in emails.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

Links and Resources:

Denne episoden er hentet fra en åpen RSS-feed og er ikke publisert av Podme. Den kan derfor inneholde annonser.

Episoder(329)

Job Recruiter Scams

Job hunting is hard enough without having to stop and ask whether the recruiter in your inbox is even real. My guest today, Jay Jones, ran into that problem firsthand after being laid off in December ...

24 Jun 35min

Bail Bonds Scams

Getting a call that someone you love has been arrested is scary enough. Getting that call from someone who sounds official, knows just enough to seem credible, and says you have to send money right aw...

17 Jun 36min

Confessions of a Fraudster

Technology keeps changing, but many of the most effective scams still come down to something very human: trust. My guest today is Tony Sales, co-founder of We Fight Fincrime and Underworld TV. Tony ha...

10 Jun 54min

Personal Safety

Scams and safety threats don't always announce themselves. Sometimes they start quietly, with a moment of distraction, a strange feeling you ignore, or a situation that shifts just enough to test whet...

3 Jun 43min

Data For Sale

Everyday conveniences ask for tiny pieces of information all the time like a phone number at checkout, a zip code at the register, an email address for a receipt, or a loyalty account for a small disc...

27 Mai 43min

Exploiting Psychology

Scams are often explained as a failure of judgment, but the truth is far more human. People are not fooled because they are foolish. They are manipulated at the exact moment emotion overrides logic, w...

20 Mai 45min

Investment Traps

Investment losses can be confusing because they do not always tell the whole story. Sometimes money is lost because the market has changed. Other times, an investor was sold something they did not und...

13 Mai 47min

Elder Exploitation

Aging parents often rely on the people closest to them for help, but what happens when that help becomes a way to take control? For Charles Wallace, the warning signs started small. His mother's fridg...

6 Mai 39min