Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
7/6/2017
11:00 AM
Tim Prendergast
Tim Prendergast
Partner Perspectives
Connect Directly
Twitter
LinkedIn
RSS
50%
50%

Security Experts & Hackers: We're Not So Different

Using the similarities among hackers and security programmers can be an advantage.

Many of us who work in cloud security are driven by a common goal: catch bad guys. We're not Harry Bosch putting the screws to some perp in the interrogation room, or laying on a rooftop to pick off an enemy at far range. But we know the damage that can be done by a malicious hacker, and we want to stop it. What's more, we have the ability to stop it ... or at least, we think we do, and this is why we deal in the science and art of technology security.

Interestingly, the mindset of a hacker and a security expert is in many ways quite similar. So is our training. In fact, the daily experience, tactically speaking, is almost indistinguishable. Our world is code, projects, delivery, iteration, many failures, and ultimately (hopefully) the big win. We don't intend to inflict harm as hackers do, but we are all intrigued with the pursuit of complex tasks that require analytical thinking and creative approaches. As perverted as it may seem, I'm sure hackers become overjoyed upon learning they've entered a network or accessed data not meant for them. Yet, in a similar way, the best security professionals experience the same feeling upon delivering a solution that will identify hundreds of misconfigurations across an entire enterprise.

I don't mean to suggest we are kindred spirits in a collegial way. While there are parts of our brains wired in similar fashion, we are most decidedly pitted against one another towards very divergent goals. But having this same type of mindset helps security programmers be more effective at understanding and identifying how to create effective security and compliance solutions to thwart even the best hackers. The feeling of success at having done so is what fuels so much of this work, and it's how the best security products are built.

Security developers and hackers both have a mission. They have training, knowlede, and are dedicated to their pursuits. Consider this when building your security team, and when identifying how to secure your cloud environment. The algebraist Carl Gustav Jacobi advised: "Invert, always invert." In other words, think backwards to figure out a solution. Programmers, irrespective of their proclivity for good or ill, approach their goals in the same way; that mindset will be a huge advantage for the good guys on your team who are pursuing hackers.

No one can truly appreciate security if they aren't participating in it. If you create an environment where security is part of the general mindset, it reminds your experts that you think security, in all its forms, is important. It also creates an alert atmosphere, which is precisely what is needed to reverse-engineer the devious thinking of hackers. There is no morality tale here; those with a good yardstick for right and wrong can see the twistedness of a ransomware attack. They may also appreciate the creativity in how it was engineered. But admiration is followed by a take-down mentality. There is victory in knowing that you didn’t let the bad guy get away with it. You’ve put your abilities to the task and have become the hero in the story.

Detectives and investigators hopefully don’t have experience doing the things they seek to prosecute. HR might have a thing or two to say about the homicide division hiring murderers just because they can put themselves in the suspect’s shoes. But technology is different; perhaps the right analogy is something like Hogwarts. Students are given a foundation in wizardry, the same foundation, but they might choose to use that knowledge for evil rather than good. That damn Lucius Malfoy and his beautiful, flowing locks of white hair.

Hackers get smarter and bolder every day. Correspondingly, so must the people trying to prevent security breaches. Environments that prize tinkering and problem solving will be able to build teams that prevent the pursuits of hackers. In using similar thinking to that used by hackers, you will help create a team that understands how to protect your assets, can identify the right security automation and compliance platforms to use, and will make your organization stronger in its pursuit against the dark hats.

Tim Prendergast co-founded Evident.io to help others avoid the pain he endured when helping Adobe adopt the cloud at a massive level.  After years of building, operating, and securing services in Amazon Web Services, he set out to make security approachable and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-38095
PUBLISHED: 2021-08-05
The REST API in Planview Spigit 4.5.3 allows remote unauthenticated attackers to query sensitive user accounts data, as demonstrated by an api/v1/users/1 request.
CVE-2021-32598
PUBLISHED: 2021-08-05
An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability In FortiManager and FortiAnalyzer GUI 7.0.0, 6.4.6 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below may allow an authenticated and remote attacker to perform an HTTP request splitting...
CVE-2021-32603
PUBLISHED: 2021-08-05
A server-side request forgery (SSRF) (CWE-918) vulnerability in FortiManager and FortiAnalyser GUI 7.0.0, 6.4.5 and below, 6.2.7 and below, 6.0.11 and below, 5.6.11 and below may allow a remote and authenticated attacker to access unauthorized files and services on the system via specifically crafte...
CVE-2021-3539
PUBLISHED: 2021-08-04
EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 6.1.7 of the product.
CVE-2021-36801
PUBLISHED: 2021-08-04
Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, companies[0]. This issue was fixed in version 2.1.13 of the product.