Speaker 1: Welcome to brain Stuff, a production of I Heart Radio.
Speaker 1: Hey brain Stuff Lauren Buble bom Here. Let's begin this
Speaker 1: episode with a true story. Asher Demots walked through the
Speaker 1: front doors of a supermarket. Hanging it aside in place
Speaker 1: of a reusable shopping tote, was a discreet laptop bag.
Speaker 1: Demots wasn't shopping for groceries. This was a break in,
Speaker 1: but neither the avocado inspecting shoppers nor the credit card
Speaker 1: swiping cashiers realized they were under attack. Demons walked through
Speaker 1: the store and found a back room lined with people
Speaker 1: at computers. It was a training session, a perfect place
Speaker 1: to blend in, so he sat down and hijacked a
Speaker 1: machine for the article. This episode is based on how
Speaker 1: Stuff Works. Spoke with Demots. He said, I just went
Speaker 1: in and unplugged the cable from the back of one
Speaker 1: of the machines and plugged it into my laptop. I
Speaker 1: was hacking away for a while and gained access to
Speaker 1: systems and databases pretty quickly from that room. Soon after,
Speaker 1: the trainer approached him. She was polite but unsure about him.
Speaker 1: He told her he was from the head office there
Speaker 1: to install some updates. This appeased her for a few minutes,
Speaker 1: but she decided to loop in her supervisor. That's when
Speaker 1: Demots figured it was time to head out. He said,
Speaker 1: I closed everything and started to leave. I took the
Speaker 1: stairway and unfortunately, as I pushed the door open, the
Speaker 1: alarm went off. The trainer already hot on his tail.
Speaker 1: The chase continued to the soundtrack of blaring security alarms
Speaker 1: and a final screeching crescendo as the trainer shouted across
Speaker 1: the store, that's him, that's the guy. Another supermarket employee
Speaker 1: approached the Moots, but the Mots was prepared. He had
Speaker 1: a Manilla folder with a fabricated work order. He told
Speaker 1: them that he was from corporate and that there had
Speaker 1: been a serious hack in the story system. He said,
Speaker 1: did you know there was a breach on your network
Speaker 1: last night? Millions were stolen and the supervisor said no,
Speaker 1: I had no idea. The pair agreed to get on
Speaker 1: a call later that afternoon to avoid any heads rolling
Speaker 1: due to the sea US cybersecurity in Fraction. Part of
Speaker 1: Demotz's tail to the supermarket manager was true. He was
Speaker 1: hired to be at the supermarket and by the supermarket's leadership. However,
Speaker 1: the only hack that had happened was the one Demots
Speaker 1: did himself, and he didn't steal a dime. He was
Speaker 1: hired to see how far he could hack into the
Speaker 1: supermarket systems, and in this case he got far. Now
Speaker 1: he had helpful information to share with the leadership team
Speaker 1: on how to make their security more effective and safer
Speaker 1: for employees and customers alike. Demotz has more than twenty
Speaker 1: years of experience in this sort of gig called penetration testing.
Speaker 1: He explained, the reason companies have penetration testing is because
Speaker 1: they don't know what they don't know. You could have
Speaker 1: a great internal I T or security team that are
Speaker 1: installing packages and trying to secure systems, but until you
Speaker 1: get a hacker in there who's digging in and doing
Speaker 1: things they shouldn't be able to do. To find those
Speaker 1: risks people have missed, companies don't know what their risks are.
Speaker 1: Demotzsal is to find vulnerabilities before bad guys have a
Speaker 1: chance to an increasing threat for businesses of all sizes.
Speaker 1: According to the cost of data breach studies sponsored by IBM,
Speaker 1: security of small and medium businesses are attacked each year.
Speaker 1: So what's worse is that of those businesses closed their
Speaker 1: doors within six months of the attack. The average global
Speaker 1: cost of a single breach is three point six two
Speaker 1: million dollars, and in the first six months, the number
Speaker 1: of businesses affected by ransomware attacks, those where malicious software
Speaker 1: is installed that block access to networks until a ransom
Speaker 1: is paid more than doubled compared with That's why more
Speaker 1: and more organizations are hiring penetration testers to break into
Speaker 1: their systems on purpose. These experts are also known as
Speaker 1: white hat hackers in a literal hat tip to mid
Speaker 1: twentieth century Western film symbolism. The Mats explained, it's like
Speaker 1: an insurance policy. If companies spend them any now on security,
Speaker 1: it saves them from the ten or a hundred million
Speaker 1: it will cost them if they're breached. If they get
Speaker 1: their ransomware assessed and they inoculate themselves, for example, it
Speaker 1: saves companies months of headaches and lost revenue from not
Speaker 1: being able to do business. The other reason organizations pay
Speaker 1: to get hacked is to make sure they meet stronger
Speaker 1: regulatory standards. Healthcare, financial organizations, and government institutions, among others,
Speaker 1: must meet federal, state, and industry cybersecurity regulations as hacking
Speaker 1: becomes more common and more costly. You may think of
Speaker 1: hacking as a remote activity accessing the network or sensitive data,
Speaker 1: but penetration testers look at both physical and technical aspects
Speaker 1: of an organization security program. DeMott said, we test the
Speaker 1: physical controls. Can we gain access to a building, get
Speaker 1: past security, go through a back door? Can we gain
Speaker 1: access to physical files? Can we get into areas where
Speaker 1: companies print credit cards or gift cards? He offers advice
Speaker 1: to like recommend a SS for employee training programs so
Speaker 1: people like the supervisor he met, know how to verify
Speaker 1: people who are supposed to be in the building or not,
Speaker 1: or what to do if they don't recognize someone, instead
Speaker 1: of initiating a store wide pursuit, even if it does
Speaker 1: make for a good story, He said, we have a
Speaker 1: lot of fun doing this, but we also provide a
Speaker 1: lot of value to the client. Penetration testers must have
Speaker 1: a detailed knowledge of technology, and that comes with experience,
Speaker 1: not just fancy tools. The Mutts said. Penetration testing is
Speaker 1: understanding and interacting with technology, knowing the way that technology
Speaker 1: is supposed to work. It's a methodology and maybe aligning
Speaker 1: a tool toward it, but it's not simply about scripts
Speaker 1: or tools. But once the MutS is inside a system,
Speaker 1: he looks for three things where he can log in,
Speaker 1: what software versions are in use, and whether systems are
Speaker 1: configured correctly. He explained, Can we guess a password, can
Speaker 1: we find some other way to access a log in?
Speaker 1: And maybe the software is out of date and there's
Speaker 1: an exploit, so we try and exploit some randomware coote
Speaker 1: against it to try and gain access to the systems.
Speaker 1: And some things can be found in an audit, but
Speaker 1: we're also finding things the organization hasn't thought of. There's
Speaker 1: an important distinction there and audit asks is the security
Speaker 1: program being followed. Penetration testing asks is the program working.
Speaker 1: The problem may not be as simple as out of
Speaker 1: date software, but an entire security strategy that needs improving.
Speaker 1: From a bird's eye level. White hat hacking is becoming
Speaker 1: more popular with organizations responsible for personal data, like Facebook,
Speaker 1: which is known for incentivizing white hat hackers via their
Speaker 1: bug bounty program to find vulnerabilities in their system. You
Speaker 1: may never see them, never know they're there, but penetration
Speaker 1: testers help keep businesses secure and customers like you safer
Speaker 1: to Today's episode is based on the article Companies pay
Speaker 1: this guide to break into their networks and offices on
Speaker 1: how to Work dot Com, written by Alison Troutner. Green
Speaker 1: Stuff is production by Heart Radio in partnership with how
Speaker 1: Stuffworks dot Com, and it's produced by Tyler. Playing four
Speaker 1: more podcasts my heart Radio, visit the heart Radio app,
Speaker 1: Apple Podcasts, or wherever you listening to your favorite shows.