Speaker 1: Hey everyone, it's Robert and Joe here. Today we've got
Speaker 1: something a little bit different to share with you. It
Speaker 1: is a new edition of the Smart Talks podcast series,
Speaker 1: which is produced in partnership with IBM. This season of
Speaker 1: Smart Talks with IBM is all about new creators, the developers,
Speaker 1: data scientists, c t o s, and other visionaries creatively
Speaker 1: applying technology and business to drive change. They use their
Speaker 1: knowledge and creativity to develop better ways of working, no
Speaker 1: matter the industry. Join hosts from your favorite Pushkin Industries
Speaker 1: podcast as they use their expertise to deepen these conversations.
Speaker 1: Malcolm Gladwell will guide you through this season as your
Speaker 1: host to provide his thoughts and analysis along the way.
Speaker 1: Look out for new episodes of Smart Talks with IBM
Speaker 1: every month on the I Heart Radio app, Apple Podcasts,
Speaker 1: or wherever you get your podcasts. And learn more at
Speaker 1: IBM dot com slash smart Talks. Hello, Hello, Welcome to
Speaker 1: Smart Talks with IBM, a podcast from Bushkin Industries, I
Speaker 1: Heart Radio and IBM. I'm Malcolm Globwell. This season we're
Speaker 1: talking to new creators, the developers, data scientists, ct o s,
Speaker 1: and other visionaries who are creatively applying technology and business
Speaker 1: to drive change. Channeling their knowledge and expertise, they're developing
Speaker 1: more creative and effective solutions no matter the industry. Our
Speaker 1: guest today is Stephanie Snow Cruthers. Snow is a hacker alias,
Speaker 1: and it's how we'll refer to Stephanie for the rest
Speaker 1: of this episode. Snow is the chief people hacker for
Speaker 1: x Force at IBM. She gets paid to hack into
Speaker 1: her client's businesses before criminal hackers do in order to
Speaker 1: test her client's information security. In today's show, you'll hear
Speaker 1: some of the more creative ways Snow has persuaded people
Speaker 1: into sharing con udential information. She also talks about the
Speaker 1: state of cybersecurity and what businesses need to do to
Speaker 1: keep their data protected. Snow spoke with economics journalist Tim Harford,
Speaker 1: host of the Pushkin podcast Cautionary Tales and a longtime
Speaker 1: columnist at the Financial Times, where he writes The Undercover
Speaker 1: Economist in addition to publishing several books on the topic.
Speaker 1: Tim is also a BBC broadcaster with his show More
Speaker 1: or Less. Okay, let's now get to the interview with
Speaker 1: Tim and Chief people hacker Snow. Before you tell me
Speaker 1: what achieve people. Hacker is what is hacking to you?
Speaker 1: I think if you ask the average person to close
Speaker 1: their eyes and envision a hacker, they are going to
Speaker 1: think of someone in a dark room with a black
Speaker 1: hoodieon and all the screen text behind them. Right. Um,
Speaker 1: But to me, a hacker doesn't even have to be technical.
Speaker 1: It's someone who finds creative solutions or just different ways
Speaker 1: to break apart something to make it work in a
Speaker 1: unique way that maybe it wasn't intended to do. Whether
Speaker 1: that's computers, people devices, it could be a number of things. Right.
Speaker 1: We see food hackers, we see life hackers. That's absolutely
Speaker 1: a type of hacker. Yeah. And my my mother, I think,
Speaker 1: would have described herself as a hacker before she died.
Speaker 1: She loved to take apart computer. She had loved to
Speaker 1: take apart software. She just wanted to know how everything worked,
Speaker 1: and when she put it back together again, it sometimes
Speaker 1: worked how she wanted it to work, rather than her
Speaker 1: it was originally designed. But how was it that you
Speaker 1: originally became interested in in this strange craft of hacking.
Speaker 1: I actually got involved and figured out I want to
Speaker 1: do this a little bit late in life. I was
Speaker 1: in my mid twenties and I went to the world's
Speaker 1: largest hacking conference, which takes place every year in Las Vegas,
Speaker 1: and went with a group of friends in my husband
Speaker 1: and I had honestly no interest at all. I wanted
Speaker 1: to go to Vegas and sip drinks by the pool.
Speaker 1: But they got me a pass to attend this really
Speaker 1: cool conference and we sat in on the first talk
Speaker 1: and it was extremely technical. They were going through step
Speaker 1: by step about how to reverse malware, and I fell asleep.
Speaker 1: I completely just zoned out. It didn't make sense to me.
Speaker 1: So I got up and I started wandering around this
Speaker 1: huge conference and I found what was called the lock
Speaker 1: picking Village. I was very confused by that, like why
Speaker 1: do people want to pick locks? I mean, there was
Speaker 1: a there was an obvious answer to that question, but okay,
Speaker 1: that's very true. So in that point in my life,
Speaker 1: it did not like click at all. And so I'm
Speaker 1: walking and someone's like, hey, do you want to learn
Speaker 1: how to pick a lock? I said sure, and so
Speaker 1: they sat me down and taught me everything. And there's
Speaker 1: something magical that happens when someone picks a lock for
Speaker 1: the first time, like you can see it in their
Speaker 1: face where it's like, Wow, that was really cool and easy,
Speaker 1: and then that oh shit, I just picked a lock.
Speaker 1: And they're envisioning everything in their life that's protected by locks, right,
Speaker 1: file cabinets, their door, things that protect their children, like
Speaker 1: all these things that you have locks to protect and
Speaker 1: you just picked it in seconds. Um. So that was
Speaker 1: the most eye opening moment for me, that really launched
Speaker 1: me into this career and thinking that I could do
Speaker 1: it for a living. Well, there's I mean, it feels
Speaker 1: like a long gap between that, or big gap at least,
Speaker 1: maybe not a long one between that initial spark of wow,
Speaker 1: I can pick a lock. This is this matters to
Speaker 1: realizing there's a career in this and I might actually
Speaker 1: be good at this career. So how did you figure
Speaker 1: out there's a there's a job being a hacker, and
Speaker 1: how did you figure out that you actually might be
Speaker 1: good at doing that job? So once I was at
Speaker 1: that conference, I had met so many different people who
Speaker 1: explained what they do for a living, and again, at
Speaker 1: that point in my life, it felt like that shouldn't
Speaker 1: be possible. Right, people are getting paid money to break
Speaker 1: into clients networks, into their computers and all these things
Speaker 1: and it's still it didn't add up. But what for
Speaker 1: me really stood out was another village at the same conference,
Speaker 1: staf Con, called the Social Engineering Village, And when I
Speaker 1: walked in, they were actually placing live phone calls to
Speaker 1: people to try to elicit information. And so I'm sitting
Speaker 1: there in the audience listening to how these people were
Speaker 1: doing it. I'm like, wow, Like, I'm a people person,
Speaker 1: I've done cells, I could absolutely do this. Um. So
Speaker 1: from there, I talked to a bunch of people that
Speaker 1: I just met, like my goal is just to meet
Speaker 1: people and ask questions at that point, and found every
Speaker 1: book I could on the subject matter, went home and
Speaker 1: practiced and taught myself, and actually went back and competed
Speaker 1: in that same competition three years in a row, and
Speaker 1: I went on my third year, which was huge, but
Speaker 1: that really was able to propel me into this career.
Speaker 1: And We're a company actually saw me placing these calls
Speaker 1: and asked me like, hey, do you want a job?
Speaker 1: And that's that was my first job. It was super exciting.
Speaker 1: In three years, Snow went from amateur hacking enthusiasts to
Speaker 1: hacking professional Companies started to pay her real money to
Speaker 1: test their information security. But remember Snow's line of work
Speaker 1: isn't just limited to email servers and data networks. She's
Speaker 1: a people hacker. Instead of trying to bypass a firewall
Speaker 1: or cracking a password, she uses what's called social engineering
Speaker 1: to trick users into letting her into systems where she
Speaker 1: doesn't belong. In her work on what's called a red team,
Speaker 1: Snow explains how hacking, the technical and the human come together.
Speaker 1: So a red team is a group of offensive security
Speaker 1: or hackers. So IBM on our x fource team, we
Speaker 1: have a whole team dedicated to our we call adversary simulation,
Speaker 1: but our red team and how it works. As a
Speaker 1: client comes in and says, these are our crown jewels,
Speaker 1: we want to make sure you cannot access them. We
Speaker 1: spend months trying to access them, and along the way
Speaker 1: we have tons of meetings with our clients and giving
Speaker 1: them status updates and where we are. Um but it's
Speaker 1: it's a very long engagement to try to get access
Speaker 1: to the most sensitive things that our clients have. So
Speaker 1: how do they brief you, I mean, and how do
Speaker 1: they brief you in such a way as to not
Speaker 1: give away the stuff that they're trying to not give aways,
Speaker 1: if that makes any sense. Yeah, So, so they stay
Speaker 1: as high level as possible. They might say, um, let's
Speaker 1: let's use I P for example. Right, they have this
Speaker 1: their secret sauce that if their competitors get or anyone
Speaker 1: else gets, they can pretty much copy their business. And
Speaker 1: so that information probably lives on something that's very secure
Speaker 1: in a couple of documents that hopefully limited people have
Speaker 1: access to. So a certain a certain soft drinks secret
Speaker 1: recipe for example, mentioning no particular brand names. Yes, exactly.
Speaker 1: So they might say, okay, we have this secret recipe
Speaker 1: and we want to see if you can get it.
Speaker 1: They won't give us any details to where it's stored
Speaker 1: or any other information, but they'll just say go. They
Speaker 1: might have a couple of things that are off limits,
Speaker 1: but in general it's can we get this by any
Speaker 1: means possible. So a lot of social engineering is used,
Speaker 1: whether it's phone calls or emails, sometimes on site, and
Speaker 1: a good amount of technical hacking. Right, if we get
Speaker 1: into one person's computer, can we move into another's? And
Speaker 1: then can we move into a server? And it's a
Speaker 1: lot of moving around and digging, But um, at the end,
Speaker 1: of the day. We're pretty successful with these types of engagements.
Speaker 1: And you mentioned certain things being off limits because really
Speaker 1: the hackers that the bad hackers don't care what's off
Speaker 1: limits and what is not. So what are the kinds
Speaker 1: of things that people are the clients are saying, no,
Speaker 1: you're not allowed to do that, that's cheating. Yeah, So
Speaker 1: so we will see a good handful times is do
Speaker 1: not mess with our executives, like don't send our CEO
Speaker 1: and email, which again, bad guys do not have limits,
Speaker 1: and they will absolutely continue to do that. Um, but
Speaker 1: we have to expect those unfortunately. But we will every
Speaker 1: once in a while run into a good handful things
Speaker 1: or maybe they have another system that I don't know
Speaker 1: runs something sensitive, right, maybe it's a medical device company.
Speaker 1: They're like, okay, do not access this system because you know,
Speaker 1: people's lives could be on the line. So we won't
Speaker 1: even touch those types of systems. It really depends on
Speaker 1: the end of the day. What what they don't want
Speaker 1: us to have access to your people hackness, you're doing
Speaker 1: it with people, So so I mean, what does that
Speaker 1: what does that look like? I mean, is it is
Speaker 1: it literally phoning people up and persuading them to give
Speaker 1: you passwords or is it a bit more complicated than
Speaker 1: that these days? So I break down social engineering in
Speaker 1: two ways. You either have remote or on site. When
Speaker 1: you look at the remote, you're looking at a couple
Speaker 1: of different things. So the first one is what we
Speaker 1: call OS and T, which stands for open source intelligence,
Speaker 1: and that's actually not actively hacking a person, but it's
Speaker 1: looking at their online accounts. Are they revealing information that
Speaker 1: they shouldn't be that an attacker could leverage. So that's
Speaker 1: that's one type of assessment. We have the fishing or
Speaker 1: voice fishing, so that's placing those phone calls to get
Speaker 1: information or maybe get them to do a task over
Speaker 1: the phone. And then fishing and that's by far the
Speaker 1: most common social engineering type of assessment. That's the malicious
Speaker 1: email with a link or an attachment or even a conversation.
Speaker 1: And then we move into the on site stuff, and
Speaker 1: this is my favorite. It's the most tangible, but it's
Speaker 1: actually breaking and entering, so it's trying to get access
Speaker 1: to clients, sensitive locations, and sensitive data. So those are
Speaker 1: the two um types of social engineering. Give me a
Speaker 1: little bit of advice, then if if if you're trying
Speaker 1: to find a weakness. If you're trying to persuade somebody
Speaker 1: to do something they shouldn't be doing. What are the
Speaker 1: kind of things that you're doing. So let's just take
Speaker 1: the physical part for an example. Is tailgating? Right? That
Speaker 1: sounds so easy and so obvious, but it's the number
Speaker 1: one way that we break into buildings. It's just following
Speaker 1: someone who badges in, who unlocks the door, who has
Speaker 1: that access. We just follow them and people are trained
Speaker 1: all the time, don't let anyone fall, you, check the
Speaker 1: badge behind you, make sure people badge in. All of
Speaker 1: these policies, but when it comes down to it, people
Speaker 1: are a little bit scared to ask to see the badger,
Speaker 1: to question them. It's rude for somebody. Yes, it's human
Speaker 1: nature to want to help, so that goes against everything
Speaker 1: that people are used to doing. So that's by far
Speaker 1: the number one way that that we get into buildings. Now,
Speaker 1: I understand that before you got into this game, you
Speaker 1: were a makeup artist for independent films. Is there a
Speaker 1: connection between It seems like a stretch, but between being
Speaker 1: a makeup artist and being a people hecker, Yeah, you
Speaker 1: would think those those things absolutely don't go together at all. However,
Speaker 1: I've been pretty lucky where I've been able to leverage
Speaker 1: a little bit of the makeup, art and special effects
Speaker 1: to when we do the physical security assessments. So maybe
Speaker 1: we get caught on the first day, or maybe someone suspicious,
Speaker 1: so we don't want to go back and blow our cover,
Speaker 1: so we'll change our appearance as much as possible when
Speaker 1: we go back the next day. So absolutely something that
Speaker 1: I leverage all the time. And it's it's a lot
Speaker 1: of fun too. It just adds a little bit more
Speaker 1: to the job. It sounds like it's more creative than
Speaker 1: I would have expected a cybersecurity job to be. Oh. Absolutely.
Speaker 1: When you think of cyber secuity, you just think of
Speaker 1: someone sitting at a computer typing all day. That is
Speaker 1: not my job at all. Um. It's it's pretty amazing
Speaker 1: how much I could leverage creativity in what I do
Speaker 1: day to day. Can you give me an example, so
Speaker 1: I actually have a story, um, if you're ready for
Speaker 1: a breaking story. It's one of the ones that slowly
Speaker 1: went wrong. Our client was based out of the US
Speaker 1: and they had just opened their European branch, their headquarters
Speaker 1: in Amsterdam, and so They wanted us to test the
Speaker 1: building's physical security to see if it's protecting their people
Speaker 1: and their data, and so some of the goals were
Speaker 1: to see if we can get insight past all the
Speaker 1: badged areas where we shouldn't have access and see if
Speaker 1: we see anything that's out of place or or maybe
Speaker 1: red flags or something that they should fix. So we
Speaker 1: always start with with our osen, our open source intelligence,
Speaker 1: where we're going online investigating the location. We're looking at
Speaker 1: Google Maps as much as we can. However, this building
Speaker 1: was so new that they weren't even on Google Maps yet,
Speaker 1: so we had a really hard time finding all of
Speaker 1: this information. We decided we just had to show up
Speaker 1: on site to to see what we can do. So
Speaker 1: I walk, I walk into the building and walk into
Speaker 1: the lobby. The second I walk in, the lady pretty
Speaker 1: much kicked me out. I didn't even get to open
Speaker 1: my mouth or explain why I was there, right out
Speaker 1: of the gate, just get out. And so for doing
Speaker 1: this type of an assessment, that was horrible. This client
Speaker 1: paid all this money to get me out there to
Speaker 1: test her physical security and here I am getting kicked
Speaker 1: out within the first five minutes. So that was awful.
Speaker 1: Physical security is pretty good. Yeah, yeah, no there their
Speaker 1: Their receptionist was on her game. UM. So I went
Speaker 1: back to my hotel room and like was binging my
Speaker 1: head against the wall, like how do I get in?
Speaker 1: I can't find information online. They're kicking me out before
Speaker 1: I'm even trying, Like I was just wanting to go
Speaker 1: in and see what it looked like because I had
Speaker 1: no idea what I was walking into. So I went
Speaker 1: back online, like, okay, I have to I have to
Speaker 1: figure this out. And finally, out of nowhere, it popped
Speaker 1: into my head. Okay, it has to be someone that's
Speaker 1: not local because I'm not from Amsterdam, and I have
Speaker 1: to leverage some type of position of authority, some reason
Speaker 1: why I'm supposed to be there. And so I thought,
Speaker 1: investor relations. I am going to pretend to be an
Speaker 1: investor relations manager from the US and I'm going to
Speaker 1: their new site meeting with some potential investors. And so
Speaker 1: I called the receptionist. I spoofed my number, so I
Speaker 1: made it look like I was calling from the US location,
Speaker 1: and UM, changed my voice a little bit and said
Speaker 1: that we have someone that's going to be coming on
Speaker 1: site tomorrow. Please give them whatever they need. They're going
Speaker 1: to be meeting with all these high end clients potentially, um,
Speaker 1: so just make sure they're comfortable. The next day, I
Speaker 1: walk in and again I had to change my parents
Speaker 1: a bit because she saw me and she didn't that,
Speaker 1: and I she welcomed me, She got me coffee, She
Speaker 1: sent me up in an office where they had my
Speaker 1: name on the on the front door, and I was like,
Speaker 1: how can we help? So from there I was able
Speaker 1: to go through and complete my objectives. But it's it's
Speaker 1: kind of amazing how much you have to leverage creativity
Speaker 1: and even kind of the on the spot improv sometimes too.
Speaker 1: Who actually complete these objectives? Yeah, improv was the word
Speaker 1: that springs to mind hearing that story. I would imagine
Speaker 1: that there must be some playbook that there's a bunch
Speaker 1: of things you try, but and then you have to
Speaker 1: improvise if the playbook isn't working. Is that playbook always changing?
Speaker 1: Is it? Is it this constant arms race? Constantly? It
Speaker 1: also depends on who my target is. Right, I will
Speaker 1: change the way I ask questions, the way I set
Speaker 1: things up, just completely everything depending on if I'm talking
Speaker 1: to someone younger or older, or male, or female. Like,
Speaker 1: there's a lot of things that absolutely adapt to whoever
Speaker 1: I'm speaking to at the end of the day, because
Speaker 1: people are different and I want to try to make
Speaker 1: sure whoever I'm talking to is comfortable and I can
Speaker 1: get them to trust me. And is there a collaborative
Speaker 1: process this kind of ethical hacking or is it very
Speaker 1: much a lone wolf. It's really both. It just depends
Speaker 1: on what the type of assessment is. And there's a
Speaker 1: lot of variables. I prefer a team right, working with
Speaker 1: as many people as possible, because I might be looking
Speaker 1: at a problem from, you know, my perspective, but if
Speaker 1: I have two or three other people with completely different
Speaker 1: backgrounds and sets of experience, they're thinking about from another perspective.
Speaker 1: So the more we collaborate and work together, typically the
Speaker 1: more successful we can be as well. I'm curious about
Speaker 1: a day in the life of Snow. I mean, on
Speaker 1: a completely typical day, what is it that you're doing.
Speaker 1: So that's what I love about my job is I
Speaker 1: don't have a typical day. I could be one day
Speaker 1: waking up in Manhattan breaking into the building, and the
Speaker 1: next day I could be in my home office writing
Speaker 1: a report like it's all over the place, and that's
Speaker 1: what makes it super exciting that it's not mundane. It's
Speaker 1: constantly change and I love that. It's like, yeah, one
Speaker 1: day I'm writing a report, the other day, I'm breaking
Speaker 1: into a building in Manhattan. It's perfectly One description I've
Speaker 1: seen is that you're like a secret shopper, except instead
Speaker 1: of being a secret shopper for a restaurateur or a
Speaker 1: chain store, you're a secret shopper for breaking in and
Speaker 1: stealing passwords. It is that accurate that I would I
Speaker 1: would say that's accurate. And if people are hiring you
Speaker 1: to probe their security and to find the weaknesses, have
Speaker 1: you ever come back and said, no, it's perfect. I
Speaker 1: got nothing couldn't get in. So I have broken into
Speaker 1: over a hundred and thirty unique buildings. I've only had
Speaker 1: one of those buildings I was not able to break into,
Speaker 1: and that is because it was a small company in
Speaker 1: the middle of nowhere where everyone knew each other. It's
Speaker 1: not because necessarily because they had all these you know,
Speaker 1: expensive security control that they had place. It was just
Speaker 1: I stuck out like a sore thumb, and no matter
Speaker 1: what I said, they knew I wasn't supposed to be there.
Speaker 1: But it's kind of scary some of the very large
Speaker 1: organizations in these famous skyscrapers that I've broken into, where
Speaker 1: they've invested hundreds of thousands, if not millions of dollars
Speaker 1: into their physical security, but I'm able to get in right.
Speaker 1: That's kind of terrifying if you think about it. Whether
Speaker 1: it's brick and mortar hacking or using something much more
Speaker 1: high tech, it's all founded on the same principle, using
Speaker 1: deception to get what you want. To round out their conversation,
Speaker 1: Tim and Snow talk about the state of the global
Speaker 1: cybersecurity industry, where the art of the corn is headed,
Speaker 1: and how prepared companies are for any of it. Let's
Speaker 1: zoom back a bit now and and take in what
Speaker 1: you know the state of the global hacking industry if
Speaker 1: that's a phrase, or the global security industry, and what
Speaker 1: has changed in security and cybersecurity over the last few years.
Speaker 1: What are the new trends? So what's changed? I would
Speaker 1: say more of our lives are online, and and that's
Speaker 1: kind of scary. Everything from your IoT lightbulb to your
Speaker 1: oven to IoT being the the Internet of things. So
Speaker 1: I just Basically every everything has a web a dress
Speaker 1: now exactly, and so there's so much more of that now.
Speaker 1: It's just it surrounds us are are just our lives
Speaker 1: are online, and with that much being online, that's just
Speaker 1: more that we have to protect or more that we
Speaker 1: have to worry about. Unfortunately, that clearly raises the stakes.
Speaker 1: I would have hoped there's also more awareness. People don't
Speaker 1: fall for the most obvious scams and tricks anymore. And
Speaker 1: do you think companies put enough emphasis on security? Is
Speaker 1: it a high enough priority at the c suite level?
Speaker 1: I wish I could say yes. However, it's all over
Speaker 1: the board. I've I've worked with clients who they put
Speaker 1: everything they have into stopping attackers, into securing their environment.
Speaker 1: I've seen some clients in the past to just want
Speaker 1: to get the check in the box that they did
Speaker 1: their assessments and they want to move on to something else. So, unfortunately,
Speaker 1: it's a pretty big range of types of people who
Speaker 1: really have that security mindset. And I'm always reading stories
Speaker 1: in the news about breaches and they these security breaches,
Speaker 1: and they sometimes they sound very sensational. Sometimes they sound
Speaker 1: incredibly banal, like, oh yeah, somebody just stuck all the
Speaker 1: passwords online in plain text books. I mean, is there
Speaker 1: a standard procedure for the bad actors? Is there a
Speaker 1: way that breaches happen like this? Not these days, just
Speaker 1: because there's so many different ways they get in. I mean,
Speaker 1: most of them are financially motivated. So at the end
Speaker 1: of the day, once they get in there going for
Speaker 1: they're going to see if they can get money somehow,
Speaker 1: whether it's ransom where or they're looking for credentials to
Speaker 1: high end executives. Right, it kind of depends on their angle,
Speaker 1: but really it's it's how they're getting in is It's
Speaker 1: pretty tricky again. Social engineering is one of the number
Speaker 1: one ways to get in, typically through fishing, um sending
Speaker 1: some type of malicious payload and if their target does
Speaker 1: open it, that gets them into their environment and then
Speaker 1: they kind of pivot from there and see what they
Speaker 1: could get access to and how much does it cost
Speaker 1: when security has breached? So ibmed at a report the
Speaker 1: one from one the cost of an average data breach
Speaker 1: was over four million dollars, which is insane to think about.
Speaker 1: It kind of makes you wonder why they don't put
Speaker 1: more emphasis on their security and security awareness. Training and
Speaker 1: updating their machines and things like that. When when you
Speaker 1: think about how big that number is, why, there's tons
Speaker 1: of reasons they could have finds that they have to
Speaker 1: pay out depending on what industry they're in, they have
Speaker 1: to pay out for things like credit monitoring for whoever
Speaker 1: is effective, UM, legal fees like there's there's tons and
Speaker 1: tons of things that are involved. When when a company
Speaker 1: actually gets breached, there's a couple of things they could
Speaker 1: do to try to prevent them UM. And the first
Speaker 1: one is higher folks like myself to come in and
Speaker 1: test their environments to see where those vulnerabilities are so
Speaker 1: they can patch them. UM, to do ongoing training for
Speaker 1: their internal team to make sure they're up to date
Speaker 1: they know how to stop these type of attacks, and
Speaker 1: really just care about security in general goes a long way. No,
Speaker 1: I mean, in some ways what you're describing is is
Speaker 1: tremendously varied, lots of creativity, lots of improvisation, lots of variety.
Speaker 1: In other ways, it's it seems kind of simple. You're
Speaker 1: trying to break into places, So what's the state of
Speaker 1: the art and how do you advance the state of
Speaker 1: the art? In people hacking. Unfortunately, social engineering is is
Speaker 1: kind of stagnant. I mean, if you if you go
Speaker 1: it feels it feels kind of like it might be
Speaker 1: good news for me. It's unfortunate. Okay, I'm looking from
Speaker 1: the attack or point of view, So that's very correct. Um,
Speaker 1: but if you go back to the Middle Ages, there
Speaker 1: were cons that people were doing back then. Um, there's
Speaker 1: tons of cons from the early nineteen hundreds and still
Speaker 1: we're taking some of those kinds of cons and just
Speaker 1: adapting it to today's digital world, which there's there's improvements there,
Speaker 1: but in general social engineering there's there's not much that's
Speaker 1: that's changing. So that's actually one of the things that
Speaker 1: I have put a lot of emphasis on the last year,
Speaker 1: especially with my team, is once we go in and
Speaker 1: we complete an assessment, we spend the last trying something new,
Speaker 1: trying something novel. Can this technique work? Maybe it's walking
Speaker 1: into a building saying, hey, I shouldn't be here, will
Speaker 1: someone stop us? Right? Any little thing like that. What
Speaker 1: can we actually get away with? And that's that's something
Speaker 1: that I've enjoyed doing and pushing my team to see
Speaker 1: what we can learn and where those boundaries are. Can
Speaker 1: you give me an example of a medieval con very curious. Yes, okay,
Speaker 1: So in the Middle Ages there is have you ever
Speaker 1: heard the term pig and a poke? Uh? Yeah, I've
Speaker 1: heard the term. I always wanted where it came from. Yeah,
Speaker 1: So pig and a poke came from vendors at the times,
Speaker 1: or people who worked on the street and sold different
Speaker 1: various goods and foods. They would put a suckling pig
Speaker 1: inside of what they called a poke, which is a
Speaker 1: burlack sack, and so did it shut, and that's what
Speaker 1: they would sell on people by then eat that for dinner. However,
Speaker 1: at the time, there were no shortage of small dogs
Speaker 1: and cats, So what some creative folks would do is
Speaker 1: put those types of animals inside of the sack and
Speaker 1: so it shut, and make a lot of money and
Speaker 1: then move on to the next city and continue that
Speaker 1: con So again, cons have been around four are the
Speaker 1: longest time. I suppose the fact that cons themselves haven't
Speaker 1: changed that much. In a way, it seems to make
Speaker 1: life easy, right then nothing nothing changes. But in another way,
Speaker 1: that just goes to show that we are just all
Speaker 1: have the same vulnerabilities over and over again, and people
Speaker 1: have been exploiting them for centuries. Exactly if it's not broke,
Speaker 1: why fix it? Yes, or if it's broken away that
Speaker 1: will enable you to take it. Really enjoyed this conversation.
Speaker 1: Thank you so much and goodbye. Absolutely, thank you so
Speaker 1: much for having me. Snow mentioned something that's really hard
Speaker 1: to forget. She's tried to break into over a hundred
Speaker 1: and thirty unique buildings, and out of those, she's had
Speaker 1: only one one that she wasn't able to break into.
Speaker 1: That's bananas. What Snow start us is that we have
Speaker 1: to think of information security in a much more holistic way.
Speaker 1: It has to involve networks and computers, but also employees
Speaker 1: and office buildings. Of course, no defense is ever perfect,
Speaker 1: and that's why it's important for companies to have people
Speaker 1: like Snow on their side, because in a world where
Speaker 1: business is bound to be hacked, the real question is
Speaker 1: is there a good hacker hacking for you. On the
Speaker 1: next episode of Smart Talks with IBM the Mayflower Autonomous Ship,
Speaker 1: how IBM's artificial intelligence is powering the world's very first
Speaker 1: autonomous vessel. We talked with Brett Fanoff and Don Scott
Speaker 1: about how they're using IBM tech to revolutionize oceanography. Smart
Speaker 1: Talks as IBM is produced by Molly Sosha, David jaw,
Speaker 1: Royston Reserve and Edith Russelo with Jacob Goldstein were edited
Speaker 1: by Jan Guerra. Our engineers are Jason Gambrel, Sarah Brugare
Speaker 1: and Ben Tolliday. Theme song by Gramoscope. Special thanks to
Speaker 1: Carlie Megliori, Andy Kelly, the Callaghan and the Eight Bar
Speaker 1: and IBM teams, as well as the Pushkin marketing team.
Speaker 1: Smart Talks with IBM is a production of Pushkin Industries
Speaker 1: and I Heart Media. To find more Pushkin podcasts, listen
Speaker 1: on the I Heart Radio app, Apple Podcasts, or wherever
Speaker 1: you listen to podcasts. Hi'm Malcolm Gladwell. This is a
Speaker 1: paid advertisement from IBM.