Speaker 1: Hello, Hello, Welcome to Smart Talks with IBM, a podcast
Speaker 1: from Bushkin Industries, iHeartRadio and IBM. I'm Malcolm Glabwell. This season,
Speaker 1: we're talking to new creators, the developers, data scientists, CTOs
Speaker 1: and other visionaries who are creatively applying technology and business
Speaker 1: to drive change. Channeling their knowledge and expertise, they're developing
Speaker 1: more creative and effective solutions no matter the industry. Our
Speaker 1: guest today is Stephanie Snow Cruthers. Snow is a hacker alias,
Speaker 1: and it's how we'll refer to Stephanie for the rest
Speaker 1: of this episode. Snow is the chief people hacker for
Speaker 1: x Force at IBM. She gets paid to hack into
Speaker 1: her client's businesses before criminal hackers do in order to
Speaker 1: test her client's information security. In today's show, you'll hear
Speaker 1: some of the more creative ways Snow has persuaded people
Speaker 1: into sharing confidential information. She also talks about the state
Speaker 1: of cybersecurity and what businesses need to do to keep
Speaker 1: their data protected. Snow spoke with economics journalist Tim Harford,
Speaker 1: host of the Pushkin podcast Cautionary Tales, and a longtime
Speaker 1: columnist at The Financial Times, where he writes the undercover economist.
Speaker 1: In addition to publishing several books on the topic, Tim
Speaker 1: is also a BBC broadcaster with his show More or Less. Okay,
Speaker 1: let's now get to the interview with Tim and Chief
Speaker 1: People Hacker. Snow, before you tell me what a chief
Speaker 1: people hacker is, what is hacking to you? I think
Speaker 1: if you ask the average person to close their eyes
Speaker 1: and envision a hacker, they are going to think of
Speaker 1: someone in a dark room with a black hoodieon and
Speaker 1: all the screen text behind them. Right. But to me,
Speaker 1: a hacker doesn't even have to be technical. It's someone
Speaker 1: who finds creative solutions or just different ways to break
Speaker 1: apart something to make it work in a unique way
Speaker 1: that maybe it wasn't intended to do. Whether that's computers,
Speaker 1: people devices, it could be a number of things. Right.
Speaker 1: We see food hackers, we see life hackers. That's absolutely
Speaker 1: a type of hacker. Yeah. My mother, I think would
Speaker 1: have described herself as a hacker before she died. She
Speaker 1: loved to take apart computer, She had loved to take
Speaker 1: apart software. She just wanted to know how everything worked,
Speaker 1: and when she put it back together again, it sometimes
Speaker 1: worked how she wanted it to work. Rather than her
Speaker 1: it was originally designed. But how was it that you
Speaker 1: originally became interested in this strange craft of hacking. I
Speaker 1: actually got involved and figured out I want to do
Speaker 1: this all a bit late in life. I was in
Speaker 1: my mid twenties and I went to the world's largest
Speaker 1: hacking conference, which takes place every year in Las Vegas,
Speaker 1: and went with a group of friends and my husband
Speaker 1: and I had honestly no interest at all. I wanted
Speaker 1: to go to Vegas and sip drinks by the pool.
Speaker 1: But they got me a pass to attend this really
Speaker 1: cool conference and we sat in on the first talk
Speaker 1: and it was extremely technical. They were going through step
Speaker 1: by step about how to reverse malware, and I fell asleep.
Speaker 1: I completely just zoned out. It didn't make sense to me.
Speaker 1: So I got up and I started wandering around this
Speaker 1: huge conference and I found what was called the lock
Speaker 1: picking Village. I was very confused by that, like why
Speaker 1: do people want to pick locks? I mean, there was
Speaker 1: a there was an obvious answer to that question, but okay,
Speaker 1: that's very true. So in that point in my life,
Speaker 1: it did not like click at all. And so walking
Speaker 1: and someone's like, hey, do you want to learn how
Speaker 1: to pick a lock. I said sure, and so they
Speaker 1: sat me down and taught me everything. And there's something
Speaker 1: magical that happens when someone picks a lock for the
Speaker 1: first time, Like you can see it in their face
Speaker 1: where like, wow, that was really cool and easy, and
Speaker 1: then that oh shit, I just picked a lock. And
Speaker 1: they're envisioning everything in their life that's protected by locks, right,
Speaker 1: file cabinets, their door, things that protect their children, like
Speaker 1: all these things that you have locks to protect and
Speaker 1: you just picked it in seconds. So that was the
Speaker 1: most eye opening moment for me that really launched me
Speaker 1: into this career in thinking that I could do it
Speaker 1: for a living. Well, there's I mean, it feels like
Speaker 1: a long gap between that, or a big gap at
Speaker 1: least maybe not a long run between that initial spark
Speaker 1: of wow, I can pick a lock. Is this matters
Speaker 1: to realizing there's a career in this and I might
Speaker 1: actually be good at this career. So how did you
Speaker 1: figure out there's a job being a hacker and how
Speaker 1: did you figure out that you actually might be good
Speaker 1: at doing that job? So once I was at that conference,
Speaker 1: I had met so many different people who explained what
Speaker 1: they do for a living, and again at that point
Speaker 1: in my life, it felt like that shouldn't be possible, right,
Speaker 1: people are getting paid money to break into clients networks,
Speaker 1: into their computers and all these things, and it's still
Speaker 1: it didn't add up. But what for me really stood
Speaker 1: out was another village at the same conference, staff con
Speaker 1: called the Social Engineering Village, and when I walked in,
Speaker 1: they were actually placing live phone calls to people to
Speaker 1: try to elicit information. And so I'm sitting there in
Speaker 1: the audience listening to how these people were doing it.
Speaker 1: I'm like, wow, Like, I'm a people person, I've done cells.
Speaker 1: I could absolutely do this. So from there, I talked
Speaker 1: to a bunch of people that I just met, like
Speaker 1: my goals just to meet people and ask questions at
Speaker 1: that point, and found every book I could on the
Speaker 1: subject matter, went home and practiced and taught myself, and
Speaker 1: I actually went back and competed in that same competition
Speaker 1: three years in a row, and I won on my
Speaker 1: third year, which was huge. But that really was able
Speaker 1: to propel me into this career and where a company
Speaker 1: actually saw me placing these calls and asked me like, hey,
Speaker 1: do you want a job, And that was my first job,
Speaker 1: it was super exciting. In three years, Snow went from
Speaker 1: amateur hacking enthusiasts to hacking professional. Companies started to pay
Speaker 1: her real money to test their information security. But remember
Speaker 1: Snow's line of work isn't just limited to email servers
Speaker 1: and data networks. She's a people hacker. Instead of trying
Speaker 1: to bypass a firewall or cracking a password, she uses
Speaker 1: what's called social engineering to trick users into letting her
Speaker 1: into systems where she doesn't belong. In her work on
Speaker 1: what's called a red team, Snow explains how hacking, the
Speaker 1: technical and the human come together. So a red team
Speaker 1: is a group of offensive security or hackers. So IBM
Speaker 1: on our x Force team, we have a whole team
Speaker 1: dedicated to or we call adversary simulation. But our red
Speaker 1: team and how it works. As a client comes in
Speaker 1: and says these are our crown jewels. We want to
Speaker 1: make sure you cannot access them. We spend months trying
Speaker 1: to access them, and along the way we have tons
Speaker 1: of meetings with our clients and giving them status updates
Speaker 1: and where we are. But it's it's a very long
Speaker 1: engagement to try to get access to the most sensitive
Speaker 1: things that our clients have. So how do they brief you,
Speaker 1: I mean, and how do they brief you in such
Speaker 1: a way as to not give away the stuff that
Speaker 1: they're trying to not give aways? If that makes any sense. Yeah, So,
Speaker 1: so they stay as high level as possible. They might say,
Speaker 1: let's let's use IP for example. Right, they have this
Speaker 1: their secret sauce that if their competitors get or anyone
Speaker 1: else gets, they can pretty much copy their business. And
Speaker 1: so that information probably lives on something that's very secure
Speaker 1: in a couple of documents that hopefully limited people have
Speaker 1: access to. Yeah, so a certain soft drinks secret recipe
Speaker 1: for example, mentioning no particular brand names. Yes, exactly. So
Speaker 1: they might say, okay, we have this secret recipe and
Speaker 1: we want to see if you can get it. They
Speaker 1: won't give us any details to where it's stored or
Speaker 1: any other information, but they'll just say go. They might
Speaker 1: have a couple things that are off limits, but in general,
Speaker 1: it's can we get this by any means possible. So
Speaker 1: a lot of social engineering is used, whether it's phone
Speaker 1: calls or emails, sometimes on site, and a good amount
Speaker 1: of technical hacking. Right, if we get into one person's
Speaker 1: computer can we move into another's and then can we
Speaker 1: move into a server? And it's a lot of moving
Speaker 1: around and digging, but at the end of the day,
Speaker 1: we're pretty successful with these types of engagements. And you
Speaker 1: mentioned certain things being off limits because really the hackers
Speaker 1: that the bad hackers don't care what's off limits and
Speaker 1: what is not. So what are the kinds of things
Speaker 1: that people are clients are saying, now, you're not allowed
Speaker 1: to do that, that's cheating. Yeah, well, we will see
Speaker 1: a good handful times is do not mess with our executives,
Speaker 1: like don't send our CEO an email, which again, bad
Speaker 1: guys do not have limits, and they will absolutely continue
Speaker 1: to do that, but we have to respect those unfortunately,
Speaker 1: but we will every once in a while run into
Speaker 1: a good handful of things. Or maybe they have another
Speaker 1: system that I don't know runs something sensitive, right, maybe
Speaker 1: it's a medical device company. They're like, okay, do not
Speaker 1: access this system because you know, people's lives could be
Speaker 1: on the line. So we won't even touch those types
Speaker 1: of systems. It really depends on the end of the
Speaker 1: day what they don't want us to have access to. Well,
Speaker 1: you're a people hackness, so you're doing it with people.
Speaker 1: So so I mean, what does what does that look like?
Speaker 1: I mean, is it literally phoning people up and persuading
Speaker 1: them to give you passwords or is it a bit
Speaker 1: more complicated than that these days? So I break down
Speaker 1: social engineering in two ways. You either have remote or
Speaker 1: on site. When you look at the remote, you're looking
Speaker 1: at a couple of different things. So the first one
Speaker 1: is what we call OSANT, which stands for open Source intelligence,
Speaker 1: and that's actually not actively hacking a person, but it's
Speaker 1: looking at their online accounts. Are they revealing information that
Speaker 1: they shouldn't be that an attacker could leverage. So that's
Speaker 1: one type of assessment. We have the fishing or voice fishing,
Speaker 1: so that's placing those phone calls to get information or
Speaker 1: maybe get them to do a task over the phone.
Speaker 1: And then phishing, and that's by far the most common
Speaker 1: social engineering type of assessment. That's the malicious email with
Speaker 1: a link or an attachment or even a conversation. And
Speaker 1: then we move into the on site stuff, and this
Speaker 1: is my favorite. It's the most tangible, but it's actually
Speaker 1: breaking and entering, so it's trying to get access to clients,
Speaker 1: sensitive locations, and sensitive data. So those are the two
Speaker 1: types of social engineering. Give me a little bit of advice. Then,
Speaker 1: if you're trying to find a weakness, if you're trying
Speaker 1: to persuade somebody to do something they shouldn't be doing,
Speaker 1: what are the kind of things that you're doing. So
Speaker 1: let's just take the physical part for an example. Is tailgating? Right?
Speaker 1: That sounds so easy and so obvious, but it's the
Speaker 1: number one way that we break into buildings. It's just
Speaker 1: following someone who badges in, who unlocks the door, who
Speaker 1: has that access. We just follow them and people are
Speaker 1: trained all the time, don't let anyone fall you, check
Speaker 1: the badge behind you, make sure people badge in all
Speaker 1: of these policies. But when it comes down to it,
Speaker 1: people are a little bit scared to ask to see
Speaker 1: the badge or to question them. It's rude again for somebody. Yes,
Speaker 1: it's human nature to want to help, so that goes
Speaker 1: against everything that people are used to doing. So that's
Speaker 1: by far the number one way that we get into buildings.
Speaker 1: Now I understand that before you got into this game,
Speaker 1: you were a makeup artist for independent films. Is there
Speaker 1: a connection between It seems like a stretch, but between
Speaker 1: being a makeup artist being a people hecker. Yeah, you
Speaker 1: would think those things absolutely don't go together at all. However,
Speaker 1: I've been pretty lucky where I've been able to leverage
Speaker 1: a little bit of the makeup art and special effects too.
Speaker 1: When we do the physical security assessments. So maybe we
Speaker 1: get caught on the first day, or maybe someone suspicious,
Speaker 1: so we don't want to go back and blow our cover,
Speaker 1: so we'll change our appearance as much as possible when
Speaker 1: we go back the next day. So absolutely something that
Speaker 1: I leverage all the time. And it's a lot of
Speaker 1: fun too. It just adds a little bit more to
Speaker 1: the job. It sounds like it's more creative than I
Speaker 1: would have expected a cybersecurity job to be. Oh. Absolutely.
Speaker 1: When you think of cybersecurity, you just think of someone
Speaker 1: sitting at a computer typing all day. That is not
Speaker 1: my job at all. It's pretty amazing how much I
Speaker 1: could leverage creativity in what I do day to day.
Speaker 1: Can you give me an example, so I actually have
Speaker 1: a story if you're ready for a break in story.
Speaker 1: It's one of the ones that absolutely went wrong. Our
Speaker 1: client was based out of the US and they had
Speaker 1: just opened their European branch, so their headquarters in Amsterdam,
Speaker 1: and so they wanted us to test the building's physical
Speaker 1: security to see if it's protecting their people and their data.
Speaker 1: And so some of the goals were to see if
Speaker 1: we can get insight past all the badged areas where
Speaker 1: we shouldn't have access and see if we see anything
Speaker 1: that's out of place or maybe red flags or something
Speaker 1: that they should fix. So we always start with our
Speaker 1: osen or open source intelligence, where we're going online investigating
Speaker 1: the location. We're looking at Google Maps as much as
Speaker 1: we can. However, this building was so new that they
Speaker 1: weren't even on Google Maps yet, so we had a
Speaker 1: really hard time finding all of this information. We decided
Speaker 1: we just had to show up on site to see
Speaker 1: what we can do. So I walk into the building
Speaker 1: and walk into the lobby. The second I walk in,
Speaker 1: the lady pretty much kicked me out. I didn't even
Speaker 1: get to open my mouth or explain why I was there,
Speaker 1: right out of the gate, just get out. And so
Speaker 1: for doing this type of an assessment, that was horrible.
Speaker 1: This client paid all this money to get me out
Speaker 1: there to test or physical security and here I am
Speaker 1: getting kicked out within the first five minutes. So that
Speaker 1: was awful. Physical security is pretty good. Yeah, yeah, no,
Speaker 1: their their receptionist was on her game. So I went
Speaker 1: back to my hotel room and was banging my head
Speaker 1: against the wall, like how do I get in? I
Speaker 1: can't find information online. They're kicking me out before I'm
Speaker 1: even trying, Like I was just wanting to go in
Speaker 1: and see what it looked like because I had no
Speaker 1: idea what I was walking into. So I went back
Speaker 1: online like, okay, I have to I have to figure
Speaker 1: this out. And finally, out of nowhere, it popped into
Speaker 1: my head. Okay, it has to be someone that's not local,
Speaker 1: because I'm not from Amsterdam, and I have to leverage
Speaker 1: some type of position of authority, some reason why I'm
Speaker 1: supposed to be there. And so I thought, investor relations.
Speaker 1: I am going to pretend to be an investor relations
Speaker 1: manager from the US and I'm going to their new
Speaker 1: site meeting with some potential investors. And so I called
Speaker 1: the receptionist. I spoofed my number, so I made it
Speaker 1: look like I was calling from the US location and
Speaker 1: changed my voice a little bit and said that we
Speaker 1: have someone that's going to be coming on site tomorrow.
Speaker 1: Please give them whatever they need. They're going to be
Speaker 1: meeting with all these high end clients potentially, so just
Speaker 1: make sure they're comfortable. The next day, I walk in
Speaker 1: and again I had to change my parents a bit
Speaker 1: because she saw me and she didn't bat and I.
Speaker 1: She welcomed me, She got me coffee, She sent me
Speaker 1: up in an office where they had my name on
Speaker 1: the front door, and I was like, how can we help?
Speaker 1: So from there I was able to go through and
Speaker 1: complete my objectives. But it's it's kind of amazing how
Speaker 1: much you have to leverage creativity and even kind of
Speaker 1: the on the spot improv sometimes to actually these objectives. Yeah,
Speaker 1: improv was the word that springs to mind hearing that story.
Speaker 1: I would imagine that there must be some playbook that
Speaker 1: there's a bunch of things you try, but then you
Speaker 1: have to improvise if the playbook isn't working. Is that
Speaker 1: playbook always changing? Is it this constant arms race? Constantly?
Speaker 1: It also depends on who my target is, right, I
Speaker 1: will change the way I ask questions, the way I
Speaker 1: set things up, just completely everything depending on if I'm
Speaker 1: talking to someone younger or older, or male or female. Like,
Speaker 1: there's a lot of things that absolutely adapt to whoever
Speaker 1: I'm speaking to at the end of the day, because
Speaker 1: people are different and I want to try to make
Speaker 1: sure whoever I'm talking to is comfortable and I can
Speaker 1: get them to trust me. And is a collaborative process
Speaker 1: this kind of ethical hacking or is it very much
Speaker 1: a lone wolf It's really both. It just depends on
Speaker 1: what the type of assessment is and there's a lot
Speaker 1: of variables. I prefer a team right, working with as
Speaker 1: many people as possible, because I might be looking at
Speaker 1: a problem from, you know, my perspective, but if I
Speaker 1: have two or three other people with completely different backgrounds
Speaker 1: and sets of experience, they're thinking of it from another perspective.
Speaker 1: So the more we collaborate and work together, typically the
Speaker 1: more successful we can be as well. I'm curious about
Speaker 1: a day in the life of Snow on a completely
Speaker 1: typical day, what is it that you're doing. So that's
Speaker 1: what I love about my job is I don't have
Speaker 1: a typical day. I could be one day waking up
Speaker 1: in Manhattan breaking into the building, and the next day
Speaker 1: I could be in my home office writing a report.
Speaker 1: Like it's all over the place, And that's what makes
Speaker 1: it super exciting that it's not mundane, it's constantly changed.
Speaker 1: I love that. It's like, yeah, one day I'm writing
Speaker 1: a report, the other day I'm breaking into a building.
Speaker 1: Him on the happen it's perfectly One description I've seen
Speaker 1: is that you are like a secret shopper, except instead
Speaker 1: of being a secret shopper for a restaurantur or a
Speaker 1: chain store, you're a secret shopper for breaking in and
Speaker 1: stealing passwords. Is that accurate? That would I would say
Speaker 1: that's accurate. And if people are hiring you to probe
Speaker 1: their security and to find the weaknesses, have you ever
Speaker 1: come back and said, no, it's perfect. I got nothing,
Speaker 1: couldn't get in. So I have broken into over one
Speaker 1: hundred and thirty unique buildings. I've only had one of
Speaker 1: those buildings I was not able to break into, and
Speaker 1: that is because it was a small company in the
Speaker 1: middle of nowhere where everyone knew each other. It's not
Speaker 1: because necessarily because they had all these you know, expensive
Speaker 1: security controls that they had place. It was just I
Speaker 1: stuck out like a sore thumb, and no matter what
Speaker 1: I said, they knew I wasn't supposed to be there.
Speaker 1: But it's kind of scary some of the very large
Speaker 1: organizations in these famous skyscrapers that I've broken into, where
Speaker 1: they've invested hundreds of thousands, if not millions of dollars
Speaker 1: into their physical security, but I'm able to get in right.
Speaker 1: That's kind of terrifying if you think about it. Whether
Speaker 1: it's brick and mortar hacking or using something much more
Speaker 1: high tech, it's all founded on the same principle, using
Speaker 1: deception to get what you want. To round out their conversation,
Speaker 1: Tim and Snow talk about the state of the global
Speaker 1: cybersecurity industry, where the art of the corn is headed,
Speaker 1: and how prepared companies are for any of it. Let's
Speaker 1: zoom back a bit now and take in what the
Speaker 1: state of the global hacking industry that's a phrase, or
Speaker 1: the global security industry, and what has changed in security
Speaker 1: and cybersecurity over the last few years. What are the
Speaker 1: new trends? So what's changed? I would say more of
Speaker 1: our lives are online, and that's kind of scary. Everything
Speaker 1: from your IoT light bulb to your oven to IoT
Speaker 1: being the Internet of things right just basically everything has
Speaker 1: a web address now exactly, and so there's so much
Speaker 1: more of that now, it's just it surrounds us are
Speaker 1: our lives are online, and with that much being online,
Speaker 1: that's just more that we have to protect or more
Speaker 1: that we have to worry about. Unfortunately, so that clearly
Speaker 1: raises the stakes. I would have hoped there's also more awareness.
Speaker 1: People don't fall for the most obvious scams and tricks anymore.
Speaker 1: And do you think companies put enough emphasis on security?
Speaker 1: Is it a high enough priority at the c suite level?
Speaker 1: I wish I could say yes. However, it's all over
Speaker 1: the board. I've worked with clients who they put everything
Speaker 1: they have into stopping attackers, into securing their environment. I've
Speaker 1: seen some clients in the past too, just want to
Speaker 1: get the check in the box that they did their
Speaker 1: assessments and they want to move on to something else. So, unfortunately,
Speaker 1: it's a pretty big range of types of people who
Speaker 1: really have that security mindset. And I'm always reading stories
Speaker 1: in the news about breaches, and they these security breaches,
Speaker 1: and they sometimes they sound very sensational. Sometimes they sound
Speaker 1: incredibly banal, like, oh, yeah, somebody just stuck all the
Speaker 1: passwords online in plain text. Oops. I mean, is there
Speaker 1: a standard procedure for the bad actors. Is there a
Speaker 1: way that breaches happen like this? Not these days, just
Speaker 1: because there's so many different ways they get in. I mean,
Speaker 1: most of them are financially motivated, So at the end
Speaker 1: of the day, once they get in, they're going for
Speaker 1: They're going to see if they can get money somehow,
Speaker 1: whether it's ransomware or they're looking for credentials to high
Speaker 1: end executives. Right, it kind of depends on their end goal,
Speaker 1: but really it's how they're getting in. It's pretty tricky again.
Speaker 1: Social engineering is one of the number one ways to
Speaker 1: get in, typically through fishing, sending some type of malicious
Speaker 1: payload and if their target does open it, that gets
Speaker 1: them into their environment and then they kind of pivot
Speaker 1: from there and see what they could get access to.
Speaker 1: And how much does it cost when security is breached?
Speaker 1: So ibmed at a report, the one from twenty twenty one,
Speaker 1: the cost of an average data breach was over four
Speaker 1: million dollars, which is insane to think about. It kind
Speaker 1: of makes you wonder why they don't put more emphasis
Speaker 1: on their security and security awareness training and updating their
Speaker 1: machines and things like that. When you think about how
Speaker 1: big that number is why is it so big. There's
Speaker 1: tons of reasons. They could have fines that they have
Speaker 1: to pay out depending on what industry they're in, they
Speaker 1: have to pay out for things like credit monitoring for
Speaker 1: whoever is effective, legal fees like there's there's tons and
Speaker 1: tons of things that are involved. When when a company
Speaker 1: actually gets breached, there's a couple of things they could
Speaker 1: do to try to prevent them. And the first one
Speaker 1: as higher folks like myself, to come in and test
Speaker 1: their environments to see where those vulnerabilities are so they
Speaker 1: can patch them. To do ongoing training for their internal
Speaker 1: team to make sure they're up to date they know
Speaker 1: how to stop these type of attacks, and really just
Speaker 1: care about security in general. Goes a long way now.
Speaker 1: I mean, in some ways, what you're describing is is
Speaker 1: tremendously varied, lots of creativity, lots of improvisation, lots of variety.
Speaker 1: In other ways, it's it seems kind of simple. They're
Speaker 1: trying to break into places, So what's the state of
Speaker 1: the art and how do you advance the state of
Speaker 1: the art in people hacking? Unfortunately, social engineering is kind
Speaker 1: of stagnant. I mean, if it feels kind of like
Speaker 1: it might be good news for me, it's unfortunate. Okay,
Speaker 1: I'm looking from the attacker point of view, so that's
Speaker 1: very correct. But if you go back to like the
Speaker 1: Middle Ages, there were cons that people were doing back then. Um,
Speaker 1: there's tons of cons from the early nineteen hundreds and
Speaker 1: still we're taking some of those kinds of cons and
Speaker 1: just adapting it to today's digital world, which there's there's
Speaker 1: improvements there, but in general social engineering there's there's not
Speaker 1: much that's that's changing. So that's actually one of the
Speaker 1: things that I have put a lot of emphasis on
Speaker 1: the last year, especially with my team, is once we
Speaker 1: go in and we complete an assessment, we spend the
Speaker 1: last twenty percent trying something new, trying something novel. Can
Speaker 1: this technique work? Maybe it's walking into a building and saying, hey,
Speaker 1: I shouldn't be here, will someone stop us? Right? Any
Speaker 1: little thing like that. What can we actually get away with?
Speaker 1: And that's that's something that I've enjoyed doing and and
Speaker 1: pushing my team to see what we can learn and
Speaker 1: where those boundaries are. Can you give me an example
Speaker 1: of a medieval con? We're very curious. Yes, Okay, So
Speaker 1: in the Middle Ages, there is Have you ever heard
Speaker 1: the term pig and a poke? Yeah, I've heard the
Speaker 1: term I always wanted mare. It came from. Yeah, So
Speaker 1: pig and a poke came from vendors at the times,
Speaker 1: or people who worked on the street and sold different
Speaker 1: various goods and foods. They would put a suckling pig
Speaker 1: inside of what they called a poke, which is a
Speaker 1: burlack sack, and sewed it shut, and that's what they
Speaker 1: would sell and people would buy then eat that for dinner. However,
Speaker 1: at the time, there were no shortage of small dogs
Speaker 1: and cats, so what some creative folks would do is
Speaker 1: put those types of animals inside of the sack and
Speaker 1: sew it shut and make a lot of money and
Speaker 1: then move on to the next city and continue that
Speaker 1: con So again, cons have been around for the longest time.
Speaker 1: I suppose the fact that cons themselves haven't changed that much.
Speaker 1: In a way, it seems to make life easy, right,
Speaker 1: nothing changes. But in another way, that just goes to
Speaker 1: show that we just all have the same vulnerabilities over
Speaker 1: and over again, and people have been exploiting them for centuries. Exactly,
Speaker 1: if it's not broke, why fix it? Yes, Or if
Speaker 1: it's broken away that will enable you to take it.
Speaker 1: Really enjoyed this conversation. Thank you so much and goodbye. Absolutely,
Speaker 1: thank you so much for having me. Snow mentioned something
Speaker 1: that's really hard to forget. She's tried to break into
Speaker 1: over one hundred and thirty unique buildings, and out of those,
Speaker 1: she's had only one one that she wasn't able to
Speaker 1: break into. That's bananas. What Snow status is that we
Speaker 1: have to think of information security in a much more
Speaker 1: holistic way. It has to involve networks and computers, but
Speaker 1: also employees and office buildings. Of course, no defense is
Speaker 1: ever perfect, and that's why it's important for companies to
Speaker 1: have people like Snow on their side, because in a
Speaker 1: world where business is bound to be hacked, the real
Speaker 1: question is is there a good hacker hacking for you.
Speaker 1: On the next episode of Smart Talks with IBM, the
Speaker 1: Mayflower Autonomous Ship, how IBM's artificial intelligence is powering the
Speaker 1: world's very first autonomous vessel. We talked with Brett Vanoff
Speaker 1: and Don Scott about how they're using IBM tech to
Speaker 1: revolutionize oceanography. Smart Talks with IBM is produced by Molly Sosha,
Speaker 1: David Jaw Royston Reserve and Edith Rousselo with Jacob Goldstein
Speaker 1: were edited by Jan Guerra. Our engineers are Jason Gambrel,
Speaker 1: Sarah Brugere and Ben Tolliday. Theme song by Gramoscope. Special
Speaker 1: thanks to Carley Migliori, Andy Kelly, Kathy Callahan and the
Speaker 1: eight Bar and IBM teams, as well as the Pushkin
Speaker 1: marketing team. Smart Talks with IBM is a production of
Speaker 1: Pushkin Industries and iHeartMedia. To find more Pushkin podcasts, listen
Speaker 1: on the iHeartRadio app, Apple Podcasts, or wherever you listen
Speaker 1: to podcasts. I'm Malcolm Gladwell. This is a paid advertisement
Speaker 1: from IBM.