Security Confidential S14 E5 Tom Eston

Manoj: Hello everyone, this is your host Manoj Tandon with another episode of Dark Rhino Security’s Security Confidential. Today we have someone who is very well known in cybersecurity joining us: Mr. Tom Eston. Tom’s got a fantastic background with over 17 years in cybersecurity. He’s been a frequent speaker at many different user groups and international cybersecurity conferences. You might have seen him at Black Hat, DEF CON, DerbyCon, or SANS InfoSec World. He has really put his knowledge out there. He’s done a lot of penetration testing and red teaming. He’s a huge security and privacy advocate. We’re honored to have him on the show.

Tom, thank you for doing this. Thanks for coming and giving us a little bit of your afternoon.

Tom Eston: Wow, I’m truly honored, so thank you for having me on your show. This is great. I’m really looking forward to the conversation today.

Manoj: I have to ask you, since you yourself are a podcaster, how does it feel to be on the other side of this mic right now and not be asking the questions?

Tom Eston: I love it. I like being in the hot seat. This is kind of fun, right? People asking me questions kind of flips the script a bit. This is a great time. I love talking to other podcasters because we all share the same challenges when we’re doing the podcast. It’s a lot of work, isn’t it?

Manoj: Oh, it is a huge amount of work. People don’t realize it. I think there’s a whole group of people out there that think we just get on and make it happen, and it’s not the case. The amount of research that goes into each guest—I’m grateful for having an awesome producer who does so much in terms of outreach and research—but there’s a lot of research that goes into each guest so that the conversation can be framed and they’re comfortable being on the show.

Tom Eston: Agreed. Then all the post-production after that is a whole another topic. There’s a lot of post-production that’s involved with it.

Manoj: Especially since we’ve had almost 150 guests on Security Confidential. All kinds of people, from one of the guys leading Google’s cybersecurity efforts to an Oracle Cloud security expert to, I should say, white hats like yourself, CIA analysts, a Navy targeter, a laughter yoga coach, and some New York Times bestselling authors. You name it, the who’s who of cybersecurity has been on. Unless you understand that guest’s context, it’s really hard to do a good interview.

Tom Eston: It really is. Well, congratulations. That is an extraordinary amount of guests that you’ve had from varied industries and personalities. That’s just really awesome, so congrats on that.

Manoj: Thank you, Tom. This is a passion for us, so we enjoy it. Speaking of passions, obviously cybersecurity is a passion for you, and I’m sure it wasn’t always the case. Who is Tom? We’d love to get your origin story. How did you get sucked into the black hole of cybersecurity?

Tom Eston: It was quite the journey for sure. I grew up as an 80s kid, dabbling in video games and early computers. I should say I was social engineering my parents to get me a computer. My first computer was an Apple IIe. I started out as a very young Apple fanboy. I convinced them that I needed a second phone line so I could start this thing called a BBS—a bulletin board system. For those of you that may be a little younger than us, you may not remember that technology. I think you had the touch-tone phone that you picked up, called, and put it onto the modem when it went screech. 2400 baud, baby. We were screaming fast back then. Getting up to that 56K was like lightning speed at the time.

This was even before America Online and all the big ISPs came out. I started my own BBS, and that was my first foray into this underground world of hacking. There were people trying to essentially break into my bulletin board system. Only one person at a time could connect through my phone line, but still, I had interesting people connecting to my BBS trying to do things that I thought were a little shady.

This was also the time when people were trading wares—cracked software and those types of things—very early computer games, those text-based games. I think I remember Hitchhiker’s Guide to the Galaxy was one of the popular ones out there. People were trading this information, and I got interested in what was going on and why people were doing these things. I learned about phreaking—phone phreaking—going way back to the old days.

Manoj: Explain that to the audience; that’s a term that a lot of people won’t understand, but go ahead.

Tom Eston: Phone phreaking is where you could basically bypass the tolls that you’d be charged on a payphone or regular phone to make long-distance phone calls. You would play a series of tones with essentially a box that would trick the phone system into bypassing those restrictions. This was very early stuff. People don’t remember; most of the audience probably has never paid for a long-distance phone call.

Manoj: No, they don’t do that anymore.

Tom Eston: That was my childhood, and I was always the type that liked electronics. I liked taking things apart, fixing things. I was really into building my own computers and things like that. I spent some time in the military. I was in the Marine Corps for four years, and then when I got out, I went to college.

I started learning more about the fundamentals of information technology. Computer security really wasn’t even a thing yet; that wasn’t until years later. I remember seeing WarGames and thinking, wow, that is the basics of what we consider hacking today. That really inspired me. When I got out of the military, I decided I’m going to go to school and learn everything I can about computer technology and networking. Security wasn’t a thing yet, even though it was a great interest of mine.

I always knew if I’m building something like a network, I’d think about how I can break it. How can I make it not work anymore? I was pretty good at that—pulling this cable out or doing this or that. Then you think about how someone with malicious intent is going to break this network. That’s where you start thinking, okay, well, what are the vulnerabilities?

I ended up getting a job at a real estate company in Cleveland. I had to hire an individual to do a penetration test. I had no idea what a penetration test was, except I heard about people who were really good at hacking who would go to this conference in Las Vegas every year called DEF CON. I wondered what it meant that these hackers get together and learn about breaking things. Isn’t that illegal? How is that even legal?

We hired this company, and I remember having that conversation with the pentester about DEF CON and the whole hacker culture. I was so enamored by this guy who was just sitting next to me. I’m watching him use these tools, and literally, he had compromised the entire company’s network in about five minutes. I asked how the heck he did that, and it was amazing. I just said, tell me about the tools, tell me about the techniques. I was learning from this guy and he’s showing me how he’s doing it.

At the time, I was the person patching all of our server infrastructure. I was the Active Directory administrator. I was doing all that kind of work, so I understood the basics: this is how you build a system; this is how you defend a system from attackers by patching the system and configuring it correctly. But then I saw him break all the things that I implemented. I thought, wow, this is even more interesting than being the guy patching the server. How do I get into this business?

That set me in a direction where I wanted to go to DEF CON, learn more, and start networking with people in this industry. I wondered how I could become a penetration tester. After that, I started looking for another role focused on pen testing. I worked for a bank on their vulnerability management team. That was exciting because I got experience on an enterprise level: how does a big financial institution do security?

I had some opportunities to be an apprentice to some of the more senior people on the team. I was able to ride along on some of the pen tests they were doing. Before you know it, after about a year, they asked, you’ve got some talent, you’re doing some cool stuff. Do you want to be on the team? I became part of that security assessment team for the bank. I spent almost five years there learning about different technologies and breaking them. I got to do some cool stuff with ATMs—really exciting things that gave me a lot of experience.

After spending time in the bank, I decided I wanted to learn things outside of just this one environment, so I made the decision to go into consulting. As you know, in consulting, you get to see the good, the bad, the really ugly, and everything in between. As a consultant, that’s really where my career went to the next level because I had exposure to different clients’ networks—small companies, big companies, everything.

It was also my first real introduction into management. I wasn’t really doing pen testing anymore, and that was a big change for me. I talk to people all the time: that is the biggest career jump you can make. I’m no longer technical; I’m now in a leadership position. How do I give all of that up? That was a really hard thing to give up, but I did it.

Now, after Veracode, I went to Bishop Fox. I’m currently at Bishop Fox, where I’m the VP of Consulting and our Cosmos Attack Surface Management products. I run all of the operations for both those sides of the business. While I’m not technical anymore, I love the leadership and management aspect of my job. Leading people has even more challenges than the technical side, but it’s much more rewarding because I really enjoy seeing the people that work for me do amazing things with their careers. My job is to make them better at doing their job. I think it’s the most rewarding time in my career.

Manoj: You’ve had quite a journey. It’s interesting that you say your primary responsibility is to help other people do better at what they’re doing. That is the hallmark of a really good leader or manager. It’s really easy to criticize people, to berate them or fire them, but that’s not leadership. Leadership is trying to help them find their full potential.

Tom Eston: I’ve had my share of bad managers and leaders—I think we all have. You take a lot of those lessons from bad experiences and say, I never want to be that way; how can I be better than that? I’ve also had amazing leaders as well. Being in this industry as long as I have, you really see those different sides. That’s how I’ve become who I am today—from both the good and bad experiences.

Manoj: Given you’ve been in this game so long, you’re probably immensely familiar with TCP/IP, its packet structure, and how it was developed originally at DARPA. Security was not at the top of mind when that was developed, right? It was about resilience in the event of total carnage. Correct me if I’m wrong, but that’s what I understand it to be: our commands would always go to the right places irrespective of anything.

Manoj: Hindsight being 20/20, would you have done something differently with that protocol that might have made this a safer world? I know that’s a loaded question. I’m just curious, especially since you’re a kid of the 80s.

Tom Eston: That’s a good one. Would I redesign the internet? I don’t know if we would know any better. Like you said, going back to DARPA, the reason the internet was created was military—about nuclear war. Communication in case everything went to hell. How would we run the government? How would we run all those things? I don’t know if anyone thought of what we see the internet as today and how embedded it is in our lives. I don’t know if anyone could have predicted that. You’d have to be a fortune teller, and even fortune tellers probably got that wrong. Can you imagine AI, where we’re at today? I don’t know if it was even fathomable back in the 80s.

Manoj: I was at a conference this morning, Tom. It was a banking conference, and an economist was telling us that he thinks there will be a contraction in the future job market because of AI. It’s going to replace a lot of people. I’m with you—I don’t think we have even lit the candle of imagination on what a transformation this is going to be. To me, it’s similar to the early 1900s: the boilermakers’ union was one of the largest in the country. Could those people imagine that that profession would not even exist anymore? I think it’s a similar thing. This is not going to be a gradual change; it’s going to be a transformation, and we don’t know what that’s going to look like.

Tom Eston: Every industrial revolution—go all the way back in history—people had that same mindset: why would this change? We’re always going to do it this way. We really don’t know the future. I think we’re in that stage right now with AI. We have our best guess of what might happen, but we really don’t know. We all agree that we don’t want Skynet from the Terminator movies, but honestly, we don’t know. No one can predict that. Going back to whether we would change how the internet was designed, I don’t think so. I think that was just the natural evolution of things.

Manoj: I would agree. Thank you for that answer. It was a little bit off to the side, but I’m always curious. I grew up in the 80s in Cleveland.

Tom Eston: Really? I didn’t know that. Very cool.

Manoj: Willoughby, Ohio.

Tom Eston: You’re on the east side. I’m on the west side, in Avon. I grew up there. I’m not there anymore, but I remember that era quite well.

Manoj: When you look at WarGames, that movie was probably one of the first that talked about hacking and what the potential liabilities could be. Fast forward to today: have the methods really changed that much from what was depicted back then?

Tom Eston: No, the short answer is no.

Manoj: That’s what I thought.

Tom Eston: It’s fascinating. We obviously have more tools and techniques, and there’s a lot more information being shared. This is the golden age of training. I’ve never seen so much training available, not just paid but for free. Go on YouTube, and there’s so many people giving training about how to be a hacker or a pentester. We never had that growing up in the industry. It’s fascinating that when you take all of that away, it still gets down to the basics: how do you find a vulnerability? How do you exploit it? What do you do with it after? How do you gain access to data and exfiltrate it? That’s it. That is the same stuff they’ve been doing since the 80s and even before computers. It’s the basis of any kind of theft.

Manoj: I’m so glad you said that. To generalize it further, it’s about looking at a process you want to compromise and then meticulously testing every facet until you find a vulnerability. To me, that is where the genius lies.

Tom Eston: I agree. Analyzing that process to find what can be manipulated or broken is where critical thinking comes into play. It’s not just about running a tool and finding something. It’s taking a step back and understanding how that vulnerability got there. How is the system configured? Always work backwards. Think about the overarching environment. This is why I tell people it’s very important to have that defensive mindset. Some of the best pentesters I’ve worked with actually started off as blue teamers, developers, or builders. They can think about how the system was built, which makes you a better offensive security professional.

Manoj: Tom, it brings up something you just stated. Why is it—and I’d like your opinion—why is it that after the fact, so when a software is put to the market or a piece of hardware is launched into the market, the hacking community ends up doing a much better job of QA testing that piece of technology than the OEM themselves? Is there something broken in our hardware and software development cycle that is letting a lot of things creep in in the first place?

Tom Eston: Yeah, I mean the short answer of it is security is hard. Security—good security—costs money, time, and effort and people. If you don’t have a good balance of all of those things, it’s very hard to ship something. I hate saying completely secure because there’s nothing that is completely secure. Everything is vulnerable and everything is hackable. You just need time, money, and people. Ask any nation-state and they’ll tell you. Of course.

But I think it really—it’s so interesting because companies struggle with this. It’s not like they’re not making an effort. You could have the best security team in the world, the most talented, and throw tons of money at it, and then some guy doing bug bounty is going to find some critical vulnerability that just gets missed. And it’s nobody’s fault. It just gets missed. So everything comes down to risk for a company, right? They’re doing a risk assessment. They’re doing the best they can. The business is there to make money, so they’ve got to ship it and they’ve got to get it out the door.

But that’s why you can’t rely 100% on just your internal team or whatever you’re doing for compliance and so on. You have to rely on other individuals like bug bounty and third-party testing and other things to supplement the stuff that you’re doing internally in a company. It can’t all be you. This is definitely a team effort, and that’s what I tell people, because this is hard. Security is very hard, even in the best-run security teams and programs. It is absolutely very hard.

Manoj: I concur wholeheartedly. It’s not for the faint of heart, and the adversary is not your run-of-the-mill thief. Even though they might be using the age-old process of theft, these are people that are very technical. They’re extremely intelligent.

Tom Eston: Yes. Yes.

Manoj: And often they’re funded by organized crime and large governments, and they have unlimited capabilities often that we don’t as white hat security people working for companies. So let me—what are your thoughts? Most companies that are investing heavily into cybersecurity, their primary business is not cybersecurity. They do whatever widget they make or service they provide.

Manoj: Do you think cybersecurity adds value to their market offering, or have they ever thought of how to use cybersecurity to create value in their market offering to where it is not a cost center and bound by, well, this is your budget, this is all we can do, but it’s actually looked at as a potential source of revenue? Have you seen anything on that?

Tom Eston: Yeah, you know, that’s interesting. I think we’re going to start seeing more of that with some of the recent things I’ve seen. If you heard about the new Biden cybersecurity initiative around labeling of IoT devices—right now it’s voluntary, and I know that all this is just starting to get kicked off—but that alone, allowing companies to opt in and say, hey, I tested, I’ve used this third party or whatever the program says I’m using to test the security of this device and product that you the consumer are using, I think it’s going to go a long way to validate that, hey, the money we’re spending on security is actually helping us sell more products because now this is endorsed by the government, just like we do with nutrition labeling of food. It’s going to be very similar in some ways.

And the more that companies can kind of advertise, look, we are doing good security—a great example of that is two-factor authentication. Every company should be using two-factor authentication for their customers, right? It’s a—you have to these days, right?

Manoj: Should be, but how many actually are?

Tom Eston: I know. But they should be proactive and say to their customers, hey, we want you to enable two-factor authentication, or we’re going to enable this for your protection because we know hackers go after your credentials. Instead of the conversation like 23andMe just had where they blamed the victims, saying, well, it’s your fault because you used a weak password. We have to stop doing that as an industry. We can’t blame the users anymore. Companies are just as much at fault for not helping customers select and choose good passwords and enable good controls like two-factor authentication.

So to answer your question, I think yes. I think it’s going to start to change with things like the government kind of initiatives that are helping push this, and that’s a real positive—to actually see the government do something positive for a change. So we’ll see where that goes, but I’m optimistic.

Manoj: Which initiatives in particular do you think?

Tom Eston: I think a lot of the things that we’re seeing from CISA that are coming out recently. Like I said, the labeling program is one. I think it’s called the trust mark, I think what it’s called.

Manoj: Okay.

Tom Eston: That’s the one where IoT devices can now opt in, so manufacturers can opt in to have these labels if they go through a security testing program, which is still yet to be defined. But I know there are groups—I’ve been involved with a group called The ioXt—which has set standards around product security for consumer devices, so wireless devices, Fitbits, Apple Watches, all those types of things. So I would suspect groups like that are going to be assisting the government with those programs. But I’ve really been impressed with a lot of the things that CISA’s been doing, a lot of the awareness campaigns and other things that they’re working with companies.

I’m also a big fan of InfraGard, where companies can partner with the FBI to trade information and techniques and intel and things like that, which are also very valuable. So I hope to see a lot more positive things like that with the government in the future.

Manoj: That’s really good. What about the hack back program? What do you think about that, the proposal that the Biden administration had?

Tom Eston: Yeah, that’s an interesting one. It has its challenges for sure, but I look at it too like when the government started getting into bug bounty, right? Like all the initiatives that—if you know Katie Moussouris, when she was at Microsoft and she pioneered all of what bug bounty is today—it was so interesting to see how the government had changed their views. Like, we’re not going to let anybody hack the Pentagon—that’s crazy talk. And coming from the 80s, right, that is like nope, you’re going to jail, you’re going to be just like Kevin Mitnick, right, in jail. And nowadays the Pentagon has their own bug bounty program. They will let you hack the Pentagon legally. That’s just amazing to hear about that now.

It’s not a bad idea. The State of Ohio, the Secretary of State’s office, actually puts that on their homepage.

Manoj: Yeah, yeah.

Tom Eston: As long as you share the vulnerabilities that you found, there’s no charges that they’re pressing. Now, I’ve never tested it, so I don’t know if that’s—do you first go in handcuffs and then you get a get out of jail free card? I mean, what exactly is the process for this? I don’t know.

But the bug bounty program—here’s the thing—if you don’t disclose it, you could get paid more money, right? So if you find a vulnerability in iOS or Windows that’s exploitable, heck, it may be one of our own three-letter agencies that might pay you a little more money than the bug bounty program does.

Manoj: Absolutely.

Tom Eston: Absolutely. And that’s what I said: today, like this day and age, is much more friendly to hacking, penetration testing. It’s not so, you know, you do this, you go to jail, it’s against the law. I mean yes, of course there are still federal laws and you can still go to jail, and we’ve still had all kinds of interesting cases over the last several years.

I think there was one—there was a consulting firm, if you remember this—where they did a physical pentest of a federal courthouse, and I don’t remember—

Manoj: The one, yeah.

Tom Eston: The one pentester was arrested by the police and he was actually in jail for like a couple days. The judge actually wanted to charge this person with a felony, even though he had full permission from the court, full permission from everybody to do this. The judge was just so adamant that this should be illegal, hiring a penetration tester to break into a facility, that he should just go to jail. They had to go to court, they had to get lawyers, they had to go through all of this.

And you’ll still have people with that mindset of, listen, this is actually a career, this is what people do, and we’re actually doing it to make your security better. But there are some people that just have that mindset.

Manoj: And what does that judge say to a foreign actor who is slipping him the bird saying, yeah, go ahead, you want to arrest me, try it?

Tom Eston: Right. It’s just a very short-sighted view of the world, frankly. Who would you rather have? Somebody who’s friendly, who is telling you what’s broken, or would you rather that all your data and all your secrets be out on the web by some third party that you have no control over?

Manoj: Exactly, yeah. Pick one.

Tom Eston: Pick one. I mean, that kind of thinking just seems crazy. So it’s the same thing with bug bounty. I think they should up the bounty.

Manoj: You know.

Tom Eston: If someone is willing to pay you a million dollars for a vulnerability that you find, then the bug bounty guys should come to the table with a million simoleons and say, hey, look, tell us what it is.

Manoj: But it’s a double-edged sword because the agencies of every nation also want access to those vulnerabilities because they’re using them.

Tom Eston: Yes.

Manoj: On a regular basis. For whatever—some people may consider it nefarious intent; others may consider it, well, it’s just spying. It’s the age-old craft.

Tom Eston: Yeah. Cyber war—you know, we’ve been in a cyber war, I think, ever since computers really came into existence, especially with networking and telecommunications advancements and modems and all the things that we’ve seen evolve over the years. And it’s only going to get worse, right? Nation-states are always going to be spying on each other, and it’s going to be interesting to see what happens in the next five to ten years. I think they are going to be more interesting.

Manoj: So Tom, what have you seen as some misconceptions from people about offensive security, the capability of hackers, and you know, I’m never going to get hacked, or that really can’t happen? Do you have some real examples of things that you’ve seen out there, your favorite ones that are just great misconceptions about the offensive world of penetration?

Tom Eston: Yeah, I think oftentimes pentesters get a bad rap sometimes. When I was a pentester myself, I have accidentally taken down systems that either were out of scope or I didn’t know that they should have been out of scope, or the client didn’t tell me that they should be out of scope. I remember taking down a mainframe at a small bank for a couple minutes, and a couple minutes can cost a bank a lot of money. So that was an interesting conversation with a client. It was something that I, of course, didn’t intentionally do. It just happened over the course of the work that I was doing, and through an Nmap scan—basically a port scan—I took down an old mainframe.

Which honestly is a vulnerability in itself because a simple scan shouldn’t necessarily take down a bank’s mainframe, which I made that argument. But again, you know, it is my fault. It was my fault. You apologize, you move on. But I think a lot of times it’s interesting when a pentester is on the network, they’re doing an authorized assessment, and then any little thing that goes wrong in the company that day or that week, they’re like, oh, it’s the pentester. It’s got to be the pentester’s fault. It can’t be anything else. It can’t be another outage. It can’t be anything. It’s the pentester’s fault.

So sometimes we take a lot of heat for the work we do because it’s inherently dangerous, right? Maybe systems do go down. We don’t plan for that. We try, we do our best not to cause a disruption, but it does happen. I’ve seen kind of every aspect of what can happen. And when money is involved, people get a little upset when a company can’t make money because of something that you did. So that’s why I tell people: be very careful with your scope of work, with the tools, the techniques that you’re using, because they could cause something inadvertently to happen.

Manoj: And you just pointed out something with money here. There’s a reason why a lot of companies—why vulnerability management is absolutely a lose-lose situation for any provider.

Tom Eston: Yeah.

Manoj: You lose on all fronts if you patch a system and it shuts down the revenue stream because none of us really know how a company makes money. You know, we don’t know how their economic engine is working. You shut down something that makes them money and now you’re on the hook for that. They’re like, well, we were supposed to patch these.

Tom Eston: Well, you didn’t tell us we couldn’t patch it.

Manoj: So yeah, it’s one of the legal reasons why you don’t see a lot of companies offering patch management.

Tom Eston: Right.

Manoj: Right?

Tom Eston: Yeah, that gets into legacy systems too. There are systems in a large company that remain unpatched, untouched, because they are so critical to how that business makes money that they’re just going to leave it alone, and it’s running like Windows NT4.

Manoj: Yeah. How do you secure that environment, Tom? I mean, there’s still, like you mentioned, a bank. There’s a lot of banks that still have mainframes.

Tom Eston: Oh, absolutely.

Manoj: Right? How do you secure an environment—and let’s not pick on a bank. Why don’t we pick on a manufacturer with a robot, and that robot is a Windows 95, runs off a Windows 95 machine, and it doesn’t take any updates. And I’m not making this story up.

Tom Eston: Oh, I believe it.

Manoj: Right? But it’s on the network. It hasn’t had a security update in 25 years, God knows how long, whenever Windows 95 was out. And they don’t want to upgrade the robot because that’s a multimillion-dollar capital cost, which is logical. It’s like, you want me to update my robot, which makes the widgets that I make money off of, and it does a good job of it, so you’re asking me to fix what’s not broken. How do you secure that environment? What do you do?

Tom Eston: Well, I’d make the argument that a lot of people, a lot of attackers, may not even know what to do if they saw a Windows 95 system to attack because it’s so old. But regardless, you’re right. I mean, I think it is—you know, we talk about getting back to basics a lot in security, right? Like network segmentation. I can’t tell you how many times we still run into clients that don’t have their network segmented. We run into a flat network in this day and age. It still happens.

And so we have to get back to the basics of cybersecurity, the CIA triad from our CISSP training—like literally, network segmentation for your legacy systems, whether that’s virtual, physical, however you want to do it. Now with the cloud, there are so many different ways to properly segment a network and do it easily. It is all available to people to do, but again it’s that mindset of, well, I haven’t thought about that because why would I want to segment a network? Who’s going to attack my robot that makes my widgets? No one has told them how vulnerable they are. No one has told them, here’s the threats against your business. And they just don’t understand that, so why would they spend money to upgrade their robot?

That’s where it gets into conversations with the board. How seriously does the company want to take security? That’s the great thing about red teaming, about pen testing, is that’s what we provide. We provide that shock and awe of what could happen if you don’t take security seriously.

Especially red teaming. I mean, that is what a red team is meant to do—test your defenses. This is why I tell people all the time, most organizations are not ready for a red team. You have to have a very mature security program to be ready for a red team. And I get annoyed when I hear a lot of people calling everything a red team. Oh, that app pentest, that’s a red team. This is a red team. That is a red team. No, it’s not. A red team is a very specific threat emulation exercise targeting an organization that has the controls in place and the maturity to understand what that red team engagement is going to provide to them.

I honestly think it’s a lot just a lack of education of why companies don’t do the basics.

Manoj: Yes, lack of awareness, and then having the personnel on board that can competently guide you through that exercise. That’s hard, and that has nothing to do with tech. The exercise you’re talking about is sitting around a table.

Tom Eston: And one of the things I’ve seen a lot more success with is tabletop exercises. I find these extremely valuable to an organization because there is no testing involved. There’s no pentester sitting there attacking your network, but they are conversations with the key people in your organization about how you’re going to respond to an attack. How are you going to handle a ransomware incident? Do you have the right people, the policies, the procedures all in place? You should really be having that conversation before you even touch the network, before you even have a pentester on site or anything like that. Those exercises are extremely valuable.

The other thing I mentioned too is purple team type of engagements where you’re methodically testing controls, working with your blue team, seeing if they see things in the logs, going back and forth with the testers, learning, adjusting systems. That has so much more value than just saying, yeah, I want you guys to send your best red team at me, throw the kitchen sink at me, break into my buildings, do all these things. That’s great and everything, but at the end of the day, if you haven’t even had the conversations of how you’re going to secure your entire organization and how you’re going to respond to an attack, it makes the red team kind of just worthless at that point.

Manoj: What do you think about automated pen testing tools? What’s your opinion on that?

Tom: I have a lot of opinions on automated pen testing. To ask question—yeah, I think a lot of it is kind of vendor FUD, to be honest. A lot of marketing. Vendors really like to capitalize on the marketing aspect, especially now with AI. Everything is AI powered. Everything is AI enabled, automated. I haven’t seen any true automated pentest solution that actually works the way they say it works without having a human behind the scenes or behind the curtain kind of pulling the strings.

I’m not going to call out any vendors in particular, but there’s a whole bunch in the marketplace.

Manoj: There’s a lot. There’s a lot.

Tom Eston: And I’m not discounting the tech. I’m not discounting the hard work that a lot of these engineers and people are developing with this tech. I mean, it’s amazing. I will agree with them on that. But it is not yet going to replace the human aspect that is so needed in penetration testing. Not anytime soon, even with all the AI that we have. I’m a big proponent of AI. I think AI has a lot of benefits for not just our industry but the world as well. But I think it is a way for—it’s an assistant, right? It’s to help do our jobs better.

I don’t necessarily agree with it’s going to just replace you as a human being and we’re all going to be like, remember the movie WALL-E, where we’re just sitting around and just drinking Coke and scooting around on a chair all day? I don’t think that’s the future of the human. But I do think that the future of our industry too will be augmented with automation, but I don’t think it’s going to replace us.

Manoj: No, I think everything of the knowledge curve just shifts further to the right.

Tom Eston: You know, that’s so—there’ll be jobs that, you know, I could see a day when you don’t need a lot of coding. You could get AI to write you, hey, write me Space Invaders.

Manoj: People probably don’t know what that is.

Tom Eston: Here’s a game. And it could probably get you 90% of the way there, but you’ll still need people to do oversight. You’re going to need people to do architecture.

Manoj: Yes. That’s something I think anywhere conscious thought is required, I think that’s where AI does fall off the bus. And there’s a big difference between AI, which is pattern behavior—

Tom Eston: Yeah.

Manoj: Right? Yes. And repeating what’s already been done versus conscious cognitive function to create something unique that is specific for a situation.

Tom Eston Right. I think that’s where a lot of these vendors kind of fall off, is there a lot of them are saying our solution is going to fix all of your problems in an organization. Based on my experience and the experience of others in the industry, everybody’s security program is different. There’s unique aspects about every single program. One size does not fit all. You can’t just say, yep, we have everything you need and it will fix all your problems. That is not the reality at all.

Manoj: I’m glad you said it. You’re now maybe the hundredth guest to say something along those lines, so it’s almost like we’re onto something.

Tom Eston: Maybe. Maybe people might get a clue now.

Manoj: Hey Tom, we’re at the hour. I want to make sure we give you some time to plug anything you’d like to plug and tell our audience about anything you want to talk about, so the floor is yours for that.

Tom Eston: Well, thanks. Yeah, the only plug I’d have is if you’re looking for another security podcast to check out, you can check out my podcast, Shared Security. So that’s sharedsecurity.net. You can find us wherever you like to listen to podcasts, and we’re also on YouTube as well, so you can just look up Shared Security there. So both have the audio and the video version of the podcast. We’ve been podcasting for 14 years, so every week. It’s awesome. It’s been fun. It’s a labor of love, but yeah, come check us out. We talk about the news, we talk about just different things going on in the industry, and hopefully you can leave with a couple tips and tricks too.

Manoj: That’s great. Send us a link. We can put links in the show notes if you like that. Not a problem. It’s a small community.

Tom Eston: It is. It is. And we’re all trying to do some very similar things.

Manoj: That’s great. Are you making any appearances? Are you talking anywhere?

Tom Eston: I’ll be at the RSA conference, but not speaking at RSA. I will be there in attendance, so if anybody wants to meet up, I will be there the week of RSA.

Manoj: What’s the best way to get ahold of you if they want to?

Tom Eston: Best way is either on Twitter—or X now, X/Twitter, same thing, right? Agent0x0 is my handle. Also on LinkedIn, you can hit me up there. Or from my website through the podcast, sharedsecurity.net.

Manoj: That’s fantastic. Well, Tom, it’s been a real pleasure having you on the show. Thank you so much. We look forward to at some point having you back and going into different areas. We barely touched any of the questions, just like we discussed.

Tom Eston: That’s right. Thank you so much.

Manoj: Awesome.

Tom Eston: Thank you for having me.