Full transcript
0:00All right, everyone. Hey, thanks so much for tuning in. Look, I'm super stoked to get together with my good friend Ted. Ted Harrington, how are you, my friend? What's going on in your world? >> I'm great, man. As as I mentioned right before you hit record, just anytime I can see you, hang out with you, it's a
0:15good day. So, pumped to be here. >> Ted has been giving me some grace. He's being too kind. He caught me in like, you know, the in-between one and then the next and then another meeting and then another call and then another presentation. So, I think we're both all just as busy as we can be leading up to
0:30some good IRL events. But, goodness gracious, Ted, you've been doing some incredible things lately. Would you mind just giving me a quick crash course of what you've been up to? What is it? Stage presentations? What is it? Speaking? What is it? New books, right? >> I've been busy myself. Yeah, I think busy is good, you know, it's especially
0:47if we have ideas to share or conversations to start or contribute to. So, for people who are listening who don't know who I am, my name is Ted Harrington and I'm in the very fortunate position that I get to run a company of ethical hackers, a company called ISE, Independent Security Evaluators. And so, as my business partner Steve
1:09says, we get to be good guys doing bad guy stuff. So, it's like it's really fun. Companies ask us to, you know, find their vulnerabilities, help them fix it. Um and then as a byproduct of that, of the research that we do, we do client work, um you know, project work with clients, that has led to a number of
1:25books that I've written. My most recent one called Inner Hacker just came out. And John, you were a a really important uh contributor to helping me narrow in on some of the ideas in that. Uh we run one of the villages at Def Con, IoT Village. And yeah, I just like talking about hackers. >> [laughter] >> No, I think you honestly kind of cracked
1:46the code, though. Like, it's such a good succinct, but clear, you know, concise, but so accurate and precise way to put it. Hey, the inner hacker mindset, the mentality, hackable. Everything that you've been kind of kicking around the ideas for are still really genuinely true to the core of a lot of the things that we do. Hacking and cybersecurity,
2:09ethical hacking, right? But knowing, hey, there are all these different sides into the industry. Offensive, defensive, one way or another, it's still all the right mission. Is that right? >> Yeah, totally. And it was I I really liked what you just said about how I can't remember what the exact words were, but you were basically echoing that these ideas ring true to hackers in
2:30the hacking profession. And that to me was so important as whenever when I get up and deliver a keynote or I write a book or I write a blog or whatever is like I really want to accurately portray what hackers are and how they think because I actually think even today all these years later there's still so much
2:51misconception about what hackers are. I think it's important that we have conversations like this talking about what they are and that it resonates as true and accurate. So, that was really really cool to hear you say that. >> Heck yeah. Do you mind if we actually maybe zoom in or kind of drill down on that if you're cool with it, if you're
3:09comfortable with it? Can we kind of open the can of worms? What are those misconceptions that you've been hearing? Cuz I think I've got a couple. I I I know a couple. I don't know what what folks think the connotation of a hacker is, good, bad, or ugly. But I'd love to ask you, look, what what have you been hearing?
3:26>> Yeah, I think the main misconception is that all hackers are criminals. That's what That's kind of the prevailing conception even today. Hacker equal sign criminal. And some hackers are criminals. But that is a misconception to say that all hackers are criminals. So, the way we need to correct that
3:47thinking is what we need to first understand what a hacker even is, right? So, a hacker is a They're a problem solver. They're a curious, creative, non-conforming thinker. They're someone who looks at something and says it's supposed to do X, can it do Y instead? That's what a hacker is. And then the fork in the road comes to motivation.
4:06So, do they want to apply those skills and that way of thinking in order to make something better? Or do they want to apply that in a way that they're willing to victimize other people? And that really is the the key distinction. And it really is that binary. There's kind of funny Someone posted on LinkedIn today. They
4:27were like, "These are all the types of hackers." And it was it was such nonsensical It didn't make any sense at all. It well, it started making sense. It was like, "There's a black hat hacker, and that's the bad guy. And there's a white hat hacker, and that's a good guy." And I was like, "Okay, this This person sounds like they
4:41know what they're talking about." And then it was like, "And then there's a gray hat hacker." Which is like a little good and a little bad. I'm like, "That doesn't exist. If you're a little bad, you're bad." Like I'm sorry. It's just It's It's that cut and dried. You're not like a little bit of a criminal. You're not a little bit
4:57of a liar. >> broke the law. Sort of, kind of, halfway. >> Just [laughter] a little bit. But then it got non- even more nonsensical. Like green hat and blue hats and all this stuff. I was like, "Okay." So, even people out there trying to educate on these ideas sometimes don't know what they're talking about. But that it really is that distinction.
5:15It's like, are you willing to victimize others? And and that phrasing, I think it's taken me a long time to get to state it like that because I think that is how you capture the malicious intent. So, someone who's like, "I'm going to attack something with the express point of harm." So, there's whole There's attacker There's hackers who think that
5:35way. Then there's hackers who think about like, "I don't necessarily It's not The point isn't to harm someone, but I'm willing to do something that benefits me, and it requires harming someone else. I'm willing to do that." So, that's that's how you capture it all together, the willingness to victimize. And ethical hackers, they look at systems and they are not going to victimize.
5:54They're saying, "How do I make this better? How do I find those same problems, but how do I make it so that it's not exploitable?" And so, that's really the problem. People People often think that hackers are bad. You see it I think the security community, I think we're perpetuating it ourselves in the marketing, the way we talk about things.
6:09It's like, you know, "Go this this tool stops hackers." And it's like, "Well, okay." You're You're saying hackers are bad, but like it's just in the phrasing, which and I get it and like in marketing speak, you have to simplify, you have to make it accessible to everyone. So, I actually do understand why it exists, but that perpetuates this idea
6:28that hackers are bad. And look at you walk around Def Con, like look at how many of the friends and people you interact with, they're largely good. I'm sure there are some that we think are good and might be bad and we just don't know it, but I would say largely, you know, people working in this field,
6:43pursuing this as their hobby, as their passion, as their profession, they're they're largely good. That That ethical hackers are good. >> Yeah, I mean, honestly, it's it's that nuance that I wanted to dance with you a little bit on because I totally know, I completely acknowledge, I am totally guilty. I'm a culprit of saying hacker
7:04to indicate cyber crime, to indicate a threat actor, to indicate, okay, actual malicious, ill intent, and bad actors, APT, advanced persistent threat, whatever, blah blah blah. Well, I'm totally cognizant of like, "Hey, I call myself a hacker, but I mean it and I hope and I have many friends that are hackers that are good, well-intentioned, generous, kind people
7:26that do security testing for all the right reasons, to make things better." And I know I absolutely conflate those two sort of almost different kind of perceptions and connotations if just because yeah, the the media and the world has sort of stigmatized the word hacker to mean the bad. The okay, dark
7:47hoodie, underground basement, projector pointed face kind of thing. And I've had someone call me out on that before. I've had someone say like straight up hey, given a presentation they're like ah you're using the wrong terminology. And I I felt very very strange kind of you know, on stage an audience member kind of throwing me out in the under the bus
8:06for this thing. But I didn't know how to dance with that. I didn't know how to walk and delicate that the tightrope there is like I understand and I agree with you because I think there really is the true meaning hey, hacker's good. But I started to wonder and I didn't know if I could even justify myself and I I'm
8:22curious if you're hot take like okay John, am I right or am I wrong? If John tries to justify himself in saying I feel like it needs a little bit of audience context as to who you're talking to because the layman needs the education that hackers are good and better. But for the first impressions for hey, your wide appeal,
8:42you almost kind of have to say hackers to mean the bad and the evil. What do you think? >> Yeah, the I the way you described this as context matters, I agree with that because I think if you walked around the hacker community and you said two statements both that included the word hacker and one you were clearly indicating the
9:03types of people that the good ones are defending against, the criminals, etc. And then the second sentence you you you described hackers describing yourself or the people who work at like our company and stuff like that. I think everyone would understand exactly what you mean. Everyone in the community would understand what you mean because we have the context. It's
9:22outside of the community that the context gets lost, but at the same time you know, it's it is a tricky thing because as you st- stated and and I was saying it earlier too like we we kind of do need the shorthand. And unfortunately, the shorthand became hackers, but there needs to be some sort of we're referring to bad people. I
9:40don't know why in news stories and stuff they don't refer to them as cyber criminals or threat actors or attackers or all there's any number of terms that clearly indicate intent, but I honestly I think it boils down to this. Hacker sounds cool. It's lit like there are some security terms people want to put it in a headline. I have the same
10:00problem with in in our profession we there's there's a number of different types of security tests that exist, but the one that everyone talks about is penetration testing. Penetration testing means a very specific thing, but it has become used to mean everything and it actually doesn't mean everything, but it sounds cool. It sounds way cooler than a
10:19vulnerability scan. You know, it's like vulnerability assessment sounds way cooler than that. It just sounds cool. So hacker sounds cool, pen test sounds cool, and so unfortunately these terms that sound cool maybe I have some bias in there. I don't know. Maybe other people don't think it sounds cool, but I think that's why they're used the way that they're used.
10:35>> I man, I feel like I'm falling on my sword cuz I also totally conflate oh pen testing, penetration testing, red teaming just all and I say that to allude to because I know I speak over silly YouTube videos on the internet and I I have to bucket all offensive security in red team on one side of this
10:55coin where there's a dichotomy that is totally realistically a gradient and all these different parts and pieces of it. I've been struggling with that. Can I ask is is is your the book and your narrative here really just look, let's draw a line in the sand. Let's say we just got to get the right messaging out for everybody or what more do you cover?
11:16What more do you dig into there? >> So with my first book Hackable I was I trying to tackle for security professionals and tech leaders and stuff a lot of these issues. Let's make sure not so much it's less about like can you memorize a term? I actually don't care about that. It's more about like are we
11:34talking about the same thing? And the problem with this conflating of terms, so the way you described it, right? Of having to be like, well, you're speaking to a general audience, you've got, you know, millions of followers who, you know, follow you. You kind of have to speak in the broadest way. And so, I think that's I don't think that's
11:50actually super problematic to be like, look, there's this whole area, I'm going to put one term as an umbrella over all of it. For those of you in the field, we are going to different, you know, differentiate them later. I think in that context, that's that's probably fine. And I've also accepted that it's the the horse is out of the barn, so to
12:05speak. Like, pen testing has just become the term used for things that it doesn't describe accurately. But what's more important is that people actually understand what they're getting. So, like one of the issues we always run into is, I mean, this happens on a weekly basis. We'll be talking to a company that we haven't worked with before, and they'll say, we need a pen
12:23test, and we'll say, well, we'll we'll get to that. And so, we start asking about, okay, what are you trying to accomplish? Why are you trying to accomplish it that way? Um, what's driving this? Et cetera, et cetera, et cetera. And then you narrow in on what they actually need, irrespective of the term. And sometimes they need an what is a pen
12:39test, sometimes they need something else. But what's really, I think, the heart of the problem isn't the vocab, it's that then, now put yourself in the position of the the buyer of services, and they're like, well, I don't know, I'm supposed to get a pen test. And they get their three quotes as they should do, and those quotes are like, $2,000,
12:58$20,000, and $100,000. And they're like, I don't know, all three say they're pen tests. I guess I'll do the $2,000 one. And they don't realize that maybe in some cases the $2,000 one is what they need, but when they have described to the other companies what they need, and this other company's like, oh, what you need is
13:16this thing that costs 100 grand, they're obviously buying the wrong thing, and that is the problem, because this is where I really have a problem with it. And this is what motivated me to write a book. Put yourself in the shoes of that person. They're like, I know I have a security challenge. I'm going to go spend money to solve it. I'm going to go
13:31interview some people. I'm going to find the best value. I'm going to make a good business decision. I was told to get a pen test. I got the best price for the pen test." And they bought the wrong thing. And they don't know it. And that that is really probably It's not like the buyer is stupid. It's not
13:47like the buyer is doing something bad or unethical. They're being sold something different than they asked for. And that that is why it's really important that we have kind of clarity on what these misconceptions are. >> That makes complete and total sense. >> [laughter] >> I cannot agree more. Yes. Short answer sentence. Yes.
14:08>> work on my second book, that was less about like, let's correct some misconceptions out in the world. I wanted to write a book for for everyone. I want to write like a general audience book. And I was thinking about what is something that anyone in any field anywhere in the world could
14:29get benefit from from our world. And to me that narrowed in on this idea of the hacker mindset. And I I wound up actually uh giving a TED Talk about this. And that TED Talk led to this book because it was a really great experience. And there were I I remember after I I delivered the talk, to give a TED Talk you it has to be for
14:48a general audience, right? It can't be for security practitioners. And that's how I when I was I peeled back to this idea of like a new way of thinking. That's That's universal. That's cool. And so then after the after I delivered the TED Talk, I realized like, maybe this needs to be more than a talk. Maybe it needs to actually be a book. And so
15:05what I what I did with my second book with Inner Hacker was try to really explain how do hackers think? Cuz I've been saying that like my whole security my whole career in security I've been saying that. Like we got to think like a hacker. And then you start to to like, okay, well, John Hammond knows what that
15:23means. A lot of people at Def Con know what that means. But, do my parents know what that means? Does my brother, do my friends, do all the people that I know who aren't in security, how do they do something with that? And so, that was the whole point of the book was to really first define, what
15:39does it mean to think like a hacker, and then teach you how to do it, and give you exercises and tools and worksheets and all this stuff so that someone who knows nothing about security, nothing about computers, can go adopt this really revolutionary mindset and find a new way of doing things. >> What, if I may ask, is kind of the part
15:58and piece of I don't want to say the persona, right, but the mindset, right? Okay, inner hacker, the ethos, kind of the core, sort of compass and map that you use to navigate the world. I'm not Maybe it sounds silly, right, in in the AI world that we live in, but like what becomes the biggest unlock? What what what is the cool new I don't
16:17know I don't want to say feature or perk of their life of having that How do we even capture? How do we describe that that change in thinking? A new way of thinking, right? >> So, I guess you're asking like, what does someone get if they apply the hacker mindset to their life, right? That's >> I think so. That's probably the Yeah,
16:32that You worded it much better than I did. >> [laughter] >> I didn't say the unlock. That's That's what it is. It's an unlock. What is this unlock for you? And what it unlocks for you is that you then find now these new ways of achieving your goals. These new ways of maybe doing things more efficiently, maybe find some overlooked
16:53shortcuts or loopholes that are there to help you that you didn't realize were there. Because what a hacker does is a hacker looks at something and I alluded to this before, but they look at something and they say, you know, most most people know that you're supposed to go A then B then C. And a hacker's like, what if I just
17:08start with C? What if I don't do any of those and I just go to D? You know, or I do C then B then A. They're constantly having this sort of non-conformist view on something. And what that does is you you find it's not every time, but maybe in like 100 times that you ask that question, what if I do
17:27it a different way, you might find one or two or three ways where it's like, "Oh, no one thought to do it this way." Look at this, there's a bypass right here. And when you find those bypasses, those shortcuts, you find more efficient ways to the goals, you're able to achieve your goals bigger, you're able to achieve them faster, maybe you're
17:46able to achieve goals you otherwise couldn't achieve if you hadn't figured out this bypass. That's amazing. Like if we can teach someone a way of thinking differently, and then of course, you know, existing within ethical norms and not violating others, which that's inherent as I believe in the hacker mindset, we should not be violating others. If we can teach that to other
18:04people, and now they can unlock those things in their life, how amazing is that? How lucky are we that we get to be around people who think like this every day and then teach other people that way of thinking? And then they can go achieve their goals bigger, better, faster, whatever. Like that's incredible. >> Yeah. It's funny. I I I I pigeonhole
18:21myself, right? Cuz I'm a nerd and a geek and all I want to be on keyboard. I'm trying to hack on the keyboard. I want to do the code. I want to I want to be slinging malware, exploits, vulnerabilities, blah, blah, blah. But it is wild to zoom out and think about how much that even just affects my
18:38brain, my circuitry, my own mentality of like, "Oh, how could I solve this problem? How could I brute force to a certain extent? I'm going to get all this work done. I'm going to I'm not going to I'm not going to stop. I'm not going to shut down. I'm going to keep trying to circumvent or go through
18:56something or I guess I never even just zoomed out and thought about it as the Yeah, maybe it's the grit, maybe it's some stubborn determination, maybe any anything that I could like pride myself on. I guess that's a core concept of of being a hacker. Huh.
19:17>> Yeah. I mean, I think the the core hacker attributes, as I discovered through this interview process, I I talked to you, I talked to a number of people in our community, and it was first of all, it's really fascinating because I kept hearing the same themes come up over and over. But, I got to hear these different stories or
19:34perspectives on these same themes. And the themes that I distilled it down to and and of course, I'm trying to I'm now about to define an entire group in one way, which as you said, everything you know, things exist on a spectrum and a gradient. So, take that for what it is that some people might feel slightly
19:50differently about these. But, largely, everyone I talked to, it sort of four main themes fell out of this. What's really interesting about these four themes, none had anything to do with computers. Like, no one no one was saying to me like, well, to be a hacker, you got to be an expert at and then insert tool or insert language or insert
20:07whatever. They said these four things. First, hackers are curious. Hackers are have insatiable thirst for knowledge. They want to understand how things work, why it works that way. Every single person I interviewed, that was the first thing that they said is that hackers are curious. The second is that hackers are non-conforming. And by that, what I mean to say is that
20:26hackers don't go along with the herd just cuz that's where the herd is going. Hackers are willing to say, I know I'm supposed to do it this way, but what if I do it that way? The third is that hackers are committed. So, you alluded to that in what you just said a moment ago, but this idea of
20:42persistence and the willing the willingness to have that tenacity to just like keep trying something. Like, hacking's boring. You try the same thing over and over and over and over until you find something and you're like, now that's exciting. But, that it's not like you waved a magic wand and all of a sudden, you popped it. It was like it
20:59took repetition. It took dedication. You had to keep going. Hackers are committed. They're willing to invest the time, the effort, the money, the resources. And then finally, hackers are creative. So, hackers are in fact amongst the most creative people that I know. Hackers are, you know, they they're innovators. They come up with these elegant solutions to, you know,
21:19new solutions to old problems. And so, you think about those three things or those four things, curiosity, non-conformity, commitment, and creativity, there's no mention of computers in there. And so, that's to say we can take this mindset and we can apply it broadly and and this I think introduces one really important question that uh people in my life outside of the
21:41hacking community have asked, which is and I asked of my I asked this of myself, are you born with this or can you develop this? And that is a really important question because if you must be born with it and you're not born with it, what's the point of writing this book? >> [laughter] >> Right? Like, if it can't be taught,
22:01what's the point? So, I I really grappled with that. And as as I was deciding whether to to move forward with the book project, I was really grappling with that with that question. And then I I had this moment when I I look at my niece, who at the time she was like four, maybe. And I looked at her and I'm like, "Hmm, kids,
22:19children, possess all four of those traits." Kids are curious. They're always poking at things or putting things in their mouth. Kids are non-conforming. They're not going to do what their parents tell them to just cuz their parents told them to do it. Kids are committed. They're going to ask for what they want over and over and over and over again. And kids
22:33are creative. Kids are hilarious. They're always coming up with imaginary friends and all this stuff. And that was the lightbulb moment when I realized, we all were once children and all children possess these traits. It's becoming an adult that makes you think you might not have these traits because we learn somewhere along the way, "Hey, you've got to conform." Like,
22:55formal education teaches you must conform. Like, literally the tests are called standardized tests. Like, is the definition of conformity. Creativity is to some extent encouraged, but conformity is like it is hammered into us from when we are kids into our adults. Follow the law, obey the speed limit, listen to your teacher, sit down, be quiet. And here I am to say, you've
23:16got all these traits in you. It's just a matter of letting them out. And that's ultimately why I titled it Inner Hacker. There is a hacker inside all of us. >> Dang, Ted. Heck yeah. Man, it's just so cool. Like even I know I I like to think of myself as a hacker, but doing that retrospective kind of look
23:34back thinking of oh wow, okay, what are the traits and how have they affected my life? That's just cool and fun for me to think through. But then even for the general public, for the wider world, that has to be this kind of certain kind of really mind-blowing enlightenment thing of like wow, okay, look at this kind of whole new frontier of a new way
23:53of thinking. And I don't mean to say that as oh, the cliche, it's in the name, but like literally, genuinely, that I keep falling back to the word the unlock, right? You could You could do bigger things. You could accomplish more, try certain stuff. That is just sweet, Ted. So, thank you. Thank you for hey, helping remind me just as well. And
24:14if folks wanted to hey, learn a little bit more, fall down the rabbit hole with you on this thing, how could they get their hands on Inner Hacker, A New Way of Thinking? How can folks dive in? >> Yeah, I'd say there's information on both of my books, on my keynotes, on the security services we deliver. All of it
24:30you can find. It's pretty easy, just my name, just tedharrington.com. And uh that's also a way to find me on social media, a way to figure out how to reach out and contact, and love to stay in touch with anyone who found these ideas resonated, but that would be the best way. >> Heck yeah. Well, hey, you're a rockstar,
24:45my friend. You're doing incredible things, and I'm so glad that you are hey, sharing that mission with the whole world, with all of us here, and uh we can all be a part of it, too. Thank you so so much, Ted. We'll leave some of those links in the video description. Make sure folks can tune in, dive in,
24:58and have some fun with it. But Ted, I can't thank you enough. This was awesome. It's great to hang out with you here. >> Yeah, it's great. Thanks for having me. Good hanging out, and uh I'll see you soon. >> Thank you.