Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Hudney Piquant on pentesting, staying ahead of adversaries and a cyber “sixth sense”
Published:
Updated:
Duration:
42 min
Episode summary
Hudney Piquant kicked off his cybersecurity career working for a startup out of a garage in Michigan. He has since uncovered critical vulnerabilities as a Synack Red Team member, joined Synack full time as a solutions architect and been honored with a Most Inspiring Up And Comer award by CyberScoop last fall.
Tune into the latest episode of WE’RE IN! to hear Hudney share his insights into getting started with the Synack Red Team, the importance of mentorship in the cybersecurity community and his “sixth sense” that helps him to find creative workarounds for tough security challenges.
More topics covered in the podcast:
Why we haven’t seen the last of the blockbuster Log4j vulnerability The importance of applying an adversary’s perspective on your networks How to build trust among professionals skeptical of ethical hackers
Make attackers go elsewhere Hudney tells customers that 100% protection is not realistic. The goal is an environment so annoying to attack that adversaries move on.
Bug bounty widens your view Testing many different environments, sometimes in production with permission, exposed him to technologies he would never see inside a single enterprise.
Impact depends on knowing the target A finding matters to executives when you can explain what the affected asset means for the business, which is exactly how ransomware actors pick targets.
Log4j is a long game Java is everywhere and organizations often do not know where it runs, so Hudney expects Log4j to remain exploitable for years, with public proofs of concept appearing quickly.
Start security lessons at home When mentoring, he teaches network segmentation by having people separate smart TVs, refrigerators and other IoT devices on their own home router.
Notable quotes
The goal is to get the adversary to be annoyed by your environment, how hard it is.
So for bug bounty, if you're a very curious person, this is just a gold mine…
…that's the reason why there's so many breaches is you just don't know your territory… But what I like to say is the hacker knows.
But when you start understanding what you have, you'll start understanding what they want and why they want it.
Questions this episode answers
What does a solutions architect at Synack do?
Hudney helps enterprises harden and protect their assets. He frames the goal as making the environment so hard to attack that adversaries get annoyed and go somewhere else. Read this section
How is bug bounty hunting different from traditional pentesting?
Hudney describes traditional pentesting as methodical, following set steps, while bug bounty work lets you follow leads and pivot without knowing where you will end up, which is where his sixth sense for big findings comes in. Read this section
What is it like to be on the Synack Red Team?
Researchers are vetted in, which Hudney says made the community feel special and less crowded than other platforms. There are mentorship programs and shared learning, but personal scripts stay closely guarded and competitive. Read this section
Have we seen the last of Log4j?
No. Hudney says Java is so widespread and assets so hard to track that organizations often do not know where vulnerable instances are, and he thinks Log4j might be around until the internet shuts off. Read this section
What is the reconnaissance phase of an attack?
It is the planning stage where attackers collect data to map a weak entry point, like burglars drawing a house map in a movie. That can include researching people close to a target, such as family members of an executive. Read this section
Attackers scan your systems daily. You just don't get the report. Synack's security testing platform stands out by drawing on a trusted network of global security researchers. From web apps to headless APIs, our platform helps you find and fix gaps in your security posture. Learn more at synack.com. That's synack.com.
Of course. Of course. And I I know, you know, cybersecurity is such a high stakes industry. It's... Can get pretty intense at times down to the wire. I was curious if you have methods for de stressing or how you deal with such a really difficult at times job description.
Yeah, actually, I talk to people, it is a common thing. I literally had somebody ask me the other day, like, how do you deal with managing all these different things and keeping up because it's always ever changing? I know for me, I guess I enjoy it. You know, I really like it. And I think doing it for so long, I feel like it's like it goes slower over time. So even though there's a lot of things, it's like, for example, when you're driving a stick shift, you have to remember a lot of things, but then the more you do it, it just becomes second nature. So with this, it's similar, you know, it becomes second nature where just... You just got... Kinda get used to, oh, I gotta learn something new. Oh, this new thing happened. I gotta keep up with the wild. Oh, something else happened.
I I gotta be completely honest with you. I don't know how to drive a stick shift. I've tried and I've learned multiple times, and there was one time I could get away with it, but now... So I don't know what that says about my cybersecurity skills, but sounds like sounds like you've got the know how. It's a good skill to have. Bella, you do you drive stick if you don't mind me asking?
No. I think I've driven a stick shift vehicle once. So I have more practice with cybersecurity at least. That's I'll say that. I feel more comfortable in the cybersecurity field than I do behind the wheel of a stick shift vehicle.
Well, and I feel like it's such a... It can be a bit of a cliche, but I think it is true that, you know, sort of like traffic cybersecurity, it just moves so fast. There's things are constantly changing, kind of hitting at that, Hudney, with your comments there. And how do you keep up? Like, how do you manage that that constant stress?
One thing I will say is, though, I do wake up early before everybody's up. Okay, this kind of helps me get my day in order. So I don't like kind of rushing to have just enough time to make it to somewhere to do something. I like to have that two extra free hours just to kind of slow myself down, think about my day, what may happen. So it kinda prepares me for when something crazy happens, it's like, okay, you know what, I expected it, it's cool, I'm okay, you know. That's kinda how, that's my best strategy is to have two hours before the day starts where everybody's kinda texting you, calling you, all those kind of things.
Hudney, I feel like having worked with you and been on, like... I think we've been on at least one, like, slightly stressful customer call. I am 0% surprised to hear you say that. Like, I can very much imagine you as the person who, like, gets up early and has a super zen morning and then it's just like, alright. Like, nothing can touch me all day long. I'm totally good. I've had my good to go.
One question I had is what do your days look like after these Zen mornings? You know, what what is a solutions architect? I mean, for the record is a really cool title. I feel like you add architect to something and it just sounds better. Like, I wish I could be called, like, editing architect or podcast architect. That's legit. So what does it mean? What do you do?
Yeah, know, as a solutions architect, you know, there's a lot of different, you know, ways that you can look at it. But the best way to look at it is that, you know, there's organizations, there's these enterprises, and they have, you know, assets. They have assets that need to be protected. And in my space here at Synack, as a solutions architect, my job is to help them harden those assets, protect those assets at all times. But actually the bigger picture even is, obviously we're protecting those assets from adversaries, but I even tell them like, this is not gonna be like a 100%. The goal is to get the adversary to be annoyed by your environment, how hard it is. It's gonna annoy them so much that they're gonna go to somebody else. Now I don't wish I don't wish that, but I just don't want it to be my customers.
So your customers are like coming to you as the security expert, telling them like, here are the areas that you need to focus on in order to, you know, like you said, be so secure that the so secure hackers are not interested. They're going somewhere else. How did you become that security expert? How did you get into cybersecurity and then get to where you are now in this job?
Yeah, how I got to cybersecurity, I actually started in the IT space doing help desk. And honestly, I think that's one of the best ways to start, to start from the bottom and moving up because you have a better understanding of the whole picture, dealing with individuals. Back in the... So from IT help desk, went to networking, did that. And then in 2009 is when I really did cybersecurity, but back in that time, it just wasn't a popular thing. You know, you would go to tell someone that they need to be secure and it's like, well, my networking is good, like why do I need security? Like you don't make me money, I I don't have money to spend on security. So it was really challenging in some sense, know, but I started actually in a garage, literally. Started in a garage. I never forget when I, you know, when I got the job, they said, I just wanna make sure you're okay with working in a garage.
Where was this? Not... Hold on. Garage... Working cyber out of a garage? That's... This isn't a garage band situation. You're protecting people's networks.
Right. No. It it wasn't Michigan. I used to live in Michigan, And this was in Rochester Hills area. And, you know, it was through a company that was able to go through Robert Half, but the startup company was doing a big project with Chrysler. And I just remember them saying that, you know, you know, this this job will be Monday through Friday in a garage. I just wanna make sure before you accept the role, are you okay with that? I'm just like, yeah. I'm I'm okay with that. Yeah. But I think in my mind, I was just like, I mean, I know they're saying garage, but I don't think they really mean it. So I go to the location. I'm like, this is a garage. Okay. We're gonna do this though. Soon we are right. We're do this. But I loved it. It was just the best thing. Best experience.
Right, right, right, right. Yeah, why don't you read that IP address? Give me one second, I'm just gonna do a few jumping jacks. You know? But yeah, that's why I basically started my cybersecurity experience. But over time, I realized that apart from work, it actually, you know, spills into your home because you also started having computers in your home and you want to protect it. So you, then you just start to learn about like how to keep things protected, maybe just different things. What would happen in a, like, let's say if you're in a chat room and all of a sudden you just got a virus because you clicked on something that you thought was coming from somebody legit, or you're, you know, back in the day, you know, I did at the time, I don't do it now, but downloading music and stuff and certain things that you would get from Kuhr and Bear Share.
So I know before working, you know, at Synack as a solutions architect, you were on the Synack Red Team for a bit before you joined, like, full time at the company. What was that experience like working as, like, a Bug Bounty hacker?
I mean, it was really cool because even the Bug Bounty thing, it's just like it it was an exciting thing when it really get... Kinda got really big and popular. And I started in other, you know, platforms before, but what was cool about Synack, I I have to say this, the thing is, which is funny, because it's in the crowd source space, but a lot of people love Synack because it's not as crowded. Yeah. And it's a really cool thing because Synack made it where you were vetted in, and in the community, there's something about that that feels really cool, that I made it through a process that I have to be vetted in. It was referred to as the Navy Seal of Cybersecurity, like in the different chat rooms and stuff. But it was a really cool experience because you're not, you know, you don't, I thought I was gonna just feel kind of like by myself, but you're actually with a community of people sharing different things.
But what I loved about the Bug Bounty is in the enterprise world, you deal with one environment and that's what you see all the time. In a bug bounty, you are seeing, like you're seeing so many different environments. So what you see evolves over time, right? And it's an amazing thing because you're just seeing things that you would have never seen if you were just working at or looking at one environment. And there's something really advantageous about that in the bug brownies in the bug brownie world.
Is there a lot of competition? I feel like that world could get so cutthroat. It could so easily get so cutthroat. Right? For for listeners who may not be super familiar with the Synack Red Team, you know, it's it's our, at Synack, our group of 1,500 plus elite security researchers around the world, all essentially competing to earn money working, finding these really important vulnerabilities on customer networks. What's that environment like? You say it's the Navy SEALs. I picture Navy SEALs just trying to stay ahead of the next one and doing 10,000 push ups and... Is it pretty intense?
Yeah. I mean, it is intense, you know, but I I do see that here. This... The environment is is really cool because there's different things that are always evolving, like different mentorship programs that's within the SRT, just the fact that you learn from each other. But there is a level of, like, I would say, like, example, you know, there's there's scripts that these individuals have that I would say is their baby, you know? It is always ever evolving, right? So in that sense, it's very competitive, like, you would never just get a preview to that. And I would say that that's one of the the one of the one of the things that's most competitive is, I know for me that was a challenge because when you have some really good scripts, you know, there's things that you can do to get really creative to get these tests pretty quickly versus the other person.
You can say that's their secret sauce. You have to get your hands on that. But yeah, I would say that part is pretty competitive, you know, as far as the secret sauce.
Was it like getting into working Bug Bounty both with Synack Red Team and you mentioned you tried other platforms as well. Did you have an idea of what working on Bug Bounty was like before you started doing it? And then when you started doing it, did it live up to your expectations?
I had an idea, but, man, it was way different than I thought, way different. And it actually exceeded my expectations. And I really loved it because it made you realize that, wow, there's so many different things that I can even do for my own organization that I'd even think of, you know, because there's something about when you're given like an opportunity to look at another environment and sometimes even their prod environment and to be able to test that with permission. That's just like, oh my goodness, wait a minute, what am I going to find? You know, versus, you know, something you see almost every day, it's like, yeah, it's nothing really new, but there's something about that, you know, and one thing about, I'd say it would be nice for hackers, like someone getting to hacking to have is just the idea of being curious. So for bug bounty, if you're a very curious person, like this is just a gold mine, you know?
And I didn't realize just the vast of information and things that you could see. Like just like, for example, like there'll be technology that you may have not even heard of that you see one of your targets have, and it's just like, I never heard of this. I'm gonna have to Google it real quick. Oh, this is great.
I hear you on Googling. I often I often end up need to frantically frantically Google things, terms that I don't understand. You know, even... I I feel like for outsiders of the industry, even terms that we toss around, like penetration testing, it just sounds sort of awkward and incomprehensible. I'm wondering even what that means to you doing pentesting.
Yeah. Know. Like, sometimes it's just... There's no good word when somebody asks you from the outside, like, what do you do? You know? Because you can say all the different terms that we have, ethical hacker, pentester. You know, it's it's still very hard, you know, but pentesting is, you know, typically what we use in. What I try to explain in a basic form is, you know, there's obstacles and you're you're literally trying to penetrate. You're trying to penetrate and see how far you can get, you know, what can you pass? Like, there's some defense and as an offense, you're trying to, in basketball terms, example, you're trying to do a crossover, you know, and you're just trying to continue penetrating. But that's typically how I explain this to people on the outside just so that they have a good understanding. But what I really tell them big picture is, you know, yes, we have tools, we have compliance, but the thing is, how do you know you're really protected?
I appreciate the basketball analogy, but I'm I'm just telling on myself today, I can't drive stick, and I really can't play basketball. People think I'm six foot two. People think that I'd be good at it, and I just end up in the wrong spot. Everybody's yelling at me. Oh, no.
Guess. I know. I need to I need to... We we need to we need to bring in some other analogies here. Yeah. But but... No. I get it. The the crossover. Right? Getting... You know, trying to trying to really get past any obstacle in your way and score that goal. And what do they even say in basketball?
Hudney, so, like, you you talked a little bit about, like you mentioned ethical hackers and I wanted to ask you about like, I think something that we deal with a lot in this field, particularly on this side of things, like where we are working with customers and we're trying to like have them pursue security, I feel like we often hit this wall of misconceptions or misunderstandings about the type of people who work in security as bug hunters or as pentesters. What do you... Like, what kind of misconceptions do you see and how do you maybe, like, correct people on those misconceptions?
Oh, yeah. I mean, back in... When I was getting to bug bounty, like, when I realized how cool this really was, you know, it's funny because there's two things that I always got from people when I would tell them about Bug Bounty and how great it is. The two things, the first thing was how can I trust you guys? Right? And then the other one was with all the... Like, you were to find all these vulnerabilities, who's gonna manage all that? You know? But as far as the first one, how can you trust? That... That's the biggest thing is, I mean, who are these people? Where are they... Where do they live? Like, I don't know what they're doing. Like, these kids, like, what you guys doing? You know? How can I trust you? You're gonna do stuff. You're put stuff in a dark web. You know, even when you go to a black hat today, like, there's even misconceptions there. Like, you know, people start hiding their phones and all this kind of stuff.
I mean, I think sometimes it's just... They go too far as far as, like, what what things are really like. But, of course, some things like that do happen. But it is funny that it's just a trust issue. It really is. It's a big trust issue. And that's the biggest thing that I find is, yeah, you guys are bug hunters, hackers, but how do we... How can we trust you? You know? Even when you put ethical in front of it, it's like, I don't think that's possible. That's what they say, you know?
And then it's like, if you have to specify, right, then that's already a bad sign, you know? So it's like, what is this hacker business? But I do think that that term gets just really short shrift. It's... I think it's a really valuable term, you know, styling oneself a hacker. Really, to me, it speaks to something actually quite positive and creative, right? Finding your way around different obstacles. To your point earlier, Hudney, it's a really interesting field. And one thing to circle back on the vulnerabilities point, I feel like a common maybe criticism of especially bug bounty models, right, is, hey, look, maybe you're you're really good at finding these potholes on the bridge, right? But what about the bigger structural issues, the really impactful vulnerabilities that could jeopardize the entire bridge or the... Your entire organization. Have you ever found anything like that, and how do you know? Is there, like, a a eureka moment, or how do you even know when you've come across it?
I like to call it, like, the the sixth sense type of thing. Right? Because it's funny because typically when you find it, that's the thing that's really special about this bug bounty space is, like, in the traditional pentesting, it's more very methodical. It's like, okay, let me just follow this method. Okay, did this, I did this, okay, cool, I did this. See, with a bug bounty, like, you know, you're you're starting, and you don't know where you're gonna go. Like, honestly, you just sometimes just don't know where you're gonna go, but you just keep going. You find this one thing, and then you kind of pivot, and you keep it there. And it's like, oh, wait a minute. Let me go back to that. And, of course, you got your good music in the background, whatever you like to play, and you're just in the zone. Right? You're going down this rabbit hole. And then when you finally see that one thing's like, oh, wow, this is it right here. That's why book binding is actually really special because typically, you know, you have a good kind of environment where it's not so restrictive.
You know, you're just kind of thinking like more open, right? With the pentesting, it was always like, you know, this is step one, this is step two, this is step three.
Yeah, or a couple of people with clipboards versus, you know, a whole team individuals looking into your networks and pentesting your networks, which I think that does sort of set things apart a little bit.
Oh, yeah. And when you do find that thing, I think it's also important to understand, like, what your target is, because you, you know, in order to understand that thing is that thing, it helps to know like what your target is, right? To understand like what makes this such a big impact. Because I remember, you know, back in the day, you know, work, like I would find something, you know, early on and just really understanding this, and, you know, C level would be like, okay, that's, congratulations, like, what does that mean for me? And I realized that, wow, like, I do have to look at this in a bigger picture. Have to understand my target and what really matters. And that's really one, that's really the thing that's really good about the adversary is they understand, okay, this asset, for example, may generate this amount of revenue, so if I get to this, this is how it can impact the business, so therefore, when I do a ransomware, for example, they will more than likely pay up.
Well, I do wanna lock into kind of a concrete example of that. I feel like the Log4j vulnerability, that's a Java login utility that just had a terrible flaw that emerged and just went haywire. I mean, headlines were screaming about the Internet on fire because it was just everywhere all of a sudden, and everybody was hunting for this vulnerability, trying to figure it out. I guess on the flip side, you know, we haven't really seen widespread disruption from that, but I wanted to ask you about Log4j and just what you think of this Vone and have we seen the last of it?
Yeah. We most definitely haven't seen the last of it, but there is a lot of arguments out there on the Internet, a lot of fun ones. But the thing about it is, what I think makes this one a little bit different is Java is like everywhere. I mean, there's about like 12,000,000 developers that use Java in the whole world. Right? And it's... Sometimes it's really hard to know where it's at. And I'm... And I'll be honest, like, sometimes I think when this not for sure happened, I'm presuming that there are people that just turn stuff off. Okay? And so the the... Yeah. You know, it hasn't been as, I would say, like, oh, there's another pretrial, there's another one. But I think it's gonna be a long a long con... Long game type of thing. Right? Because I think even recently, a few days ago, Black Friday has been popped by Lazarus, the Lazarus Group.
I did see that. I mean, it's still happening. You know, it's just more so, did somebody turn it off? Did somebody shut down their services? Because they don't know where it's at, you know? And then, honestly, it is it is a lot of work to find, scan, where might it be. And even when I find it, is it really vulnerable? Or... Oh, because the thing... One of one of the biggest things about... In our space right now is because assets are growing and growing and growing, it's just hard to manage those things, right? And it's hard to know, oh, I thought I sunset that. Oh, it's still up? Oh my goodness, I forgot. So it's just, I think it's a long game, but Java's everywhere. So honestly, I I think that Log4j might be around until the Internet shuts off.
Yeah, I think one of the most interesting things about Log4j for me, I think sometimes like when, you know, we all work in or, you know, we're in cybersecurity. So we see all this kind of stuff all the time. I think a lot of the initial responses of like large customers and large organizations being like, oh my gosh, what services do we have that might be affected? That's no surprise, right? Like, that happens every time we see a large widespread vulnerability. But one of the most interesting things for me was like... So I really like video games. And in all of the like video game circles and spaces that I'm in, we all had to have these conversations about whether or not our Minecraft servers were vulnerable to Log4j because it was like it was Minecraft was vulnerable.
I think like I just remember in that moment I had this like really weird realization of like, Oh yeah, like sometimes the stuff that happens in this space is not contained within that this space. And I think that was like that's what really made me realize how widespread this is. And I think to your point, you know, like if it's in something, I mean, obviously Minecraft is like what, probably the most played game ever. Like, that was easy to catch. Right? But, like, how many people have, like, little random pockets of, you know, Minecraft servers or whatever it is, like, whatever servers that they're running that they forgot about. Like you said, that they're just like Yep. Did we turn this off? I don't know. And I think it's it's definitely... I will not be surprised to see it in random places, like you said Yeah. Kind of forever.
Yeah. And I I I was gonna add this is, you know, typically now a vulnerability comes, I mean, literally the next day or probably that night, there's a POC on GitHub. Right? And, I mean, you can pop Block four j in, like, under three minutes. Even if you're not IT savvy, you could be some 12 year old kid somewhere just like, oh, let me try this out. That's a little nerve racking. You know? Yeah.
Tell me about it. That doesn't... And I I know that's part of what set off this frenzied response to try to find and patch and then repatch when a new patch came out, etcetera, etcetera. But I mean, there's a challenge sometimes. I feel like there aren't enough people to do this, right? There's just there's this talent shortage in the cybersecurity industry that I know certainly we harp a lot on at Synack because it is an urgent problem that needs addressing. Hudney, I'd be curious to hear your thoughts on how to build a bigger tent in cybersecurity, how to get more people immersed in the industry, involved in it, fixing some of these really tough problems.
I'm I'm I'm trailing to that because one of my favorite distros of Linux is Ubuntu. Ubuntu means community, right? It's gonna take the community to do this. This is why I love open source so much, because you have a lot of eyes on a particular software, right? Like, there's something special about that, right? And again, it takes the community to have different set of eyes, different perspectives. Of course, as we know, being in our crowd space and Synack here, I like to always, what I like to use in our day and age is waves. For me to drive and for the app to tell me through the community, again, the crowd that there's a tire on the right side coming up in about a mile, my goodness, that's like, wow, that's amazing. You know? Even when I tell you that there's a cop, you know, that'd nice to know too, but you should be following the speed limit, so I'm not saying don't speed.
I really like that kind of idea of, you know, the industry needing to, like, move more towards community to solve problems, including the talent gap problem. But like, who drives that push towards, you know, a community mindset in cybersecurity?
Yeah. I mean, it is... That is a good question. So I do think about that even myself. I I really do feel like it's something that it needs to come from the cybersecurity individuals, right? And it shouldn't have to be something that's like organized only in the workplace. That should be something that we basically evangelize, even starting from home, and then it propagates out, right? Like, example, like, one thing that I love to do is I love to mentor people into cybersecurity. But even when I do that, I don't just focus on the technology aspect, I focus on the human element as well, Right? Because when you understand the bigger picture of what... What's all going on, it starts to make more sense. So for example, if I... I'll tell somebody, okay. It's good to understand, like, networking, routers, and switches, but let's start with your router at home.
Right? Like, you know, right now for breach, all these breaches that are happening, one of the biggest things is network segmentation. I said, okay. Let's start that at home. Well, we have TVs today that have an IP address. Okay? And when Samsung is creating a TV, for example, they're not thinking, oh, let me secure that TV. That TV is connected to your network with no protection, as opposed to like a laptop, you know, maybe with the AV on it, but the TV doesn't, right? Your refrigerator has an IP now. You might wanna segment these IoT devices so that they're not on the same network. So let's start at home first. And then we go to the, oh, well, how do I do that? Oh, okay. So we're gonna log in to router, we're gonna do this. You know? So it makes it more real because it's not your home. Like, it's your stuff. Like, when it's your stuff, it's a little bit different. When it's the company's stuff, honestly, like, people just have a feeling like, well, it's not my stuff.
Yeah. So if you are... If you're listening and you're like, I don't think I'm a cybersecurity expert. Well, if you've, like, done anything to make sure that your devices are secure, then boom. You're you're on your way.
I am curious, you know, just looking stepping back and looking at the cybersecurity arena as a whole. Are there any issues that you feel like just don't get their fair shake or don't get enough attention or investment in this space?
You know, I think the the... For that, I would say one of the things that I love that Sean Parker said when he was talking about Facebook, he used a term and he says psychological hack. Okay? And I think the thing that really doesn't get pressed on is we focus a lot on technology, but we just miss the psychological part of hacking, you know, I guess we could call it also social engineering. This is a really big aspect, and I will I will cover that with also the reconnaissance phase. We talk a lot about exploits a lot, but the reconnaissance phase doesn't get enough attention. The reconnaissance phase is huge. It's a big deal. I just think it doesn't get... I don't know if it's because it's the first phase of an attack. You know? I don't know. I still don't know what it is, but I think it's the reconnaissance phase aspect.
Yeah. Reconnaissance phase would be the, equivalent to, like, you know... I like to use this example, you're like, you're watching a movie and the bad guys, even if it's like, because I've even been home alone, how are how are we gonna get into Kevin's house? Alright. This is what we're gonna do. And typically, you see like the map drawn out on the table. Okay. This is the entry point. This is the entry point. So you're you're you're basically mapping how you're gonna find a weak entry point. Right? Because you're not necessarily gonna go to the front door, but sometimes you can do that. But you're trying to figure out how can I get into this environment? I gotta think this out first. I'm gonna collect all of these different data points, all this different data for me. I'm going to do some homework even before. I wanna figure out, like, maybe who are the neighbors or, like, even if your target is some particular C level person, you're not gonna necessarily target him first.
You're gonna go to his his wife, you know, or, you know, husband, whatever, or uncle or sister, you know. It's it's all of this collection that you're doing to understand your target, you know, and that takes some work. Right? Like... And I feel like that just doesn't get enough emphasis on it.
I I I think I think it's like I think it's similar or adjacent or at least recon is like a massive part of the threat modeling process. Like, I think threat modeling is maybe even just like a more corporate word for Yeah. In a certain sense. But like, I think it's really interesting. I've done threat modeling, like assessments or even just had threat modeling type conversations with people who are working on security where like sometimes it really can be as simple as like, hey, but like this is all fine and good. Like all these protections are really smart. But did you think about this or like what what research have you done into like the library that you're using for this functionality? Because I just saw an article yesterday that said it's super vulnerable. Like and I think it is really interesting that sometimes like I feel like we almost get these like I feel like in security sometimes we get these tunnel vision of like, well, I know that SQL injection is super bad.
So I have spent so much time making sure that we are definitely not vulnerable to SQL injection. And someone's like, right, totally great, totally, totally fine. But have you heard about this vulnerable library? Like, have you heard about this other thing that you're not doing? Or like, you know, whatever it is. And I think like having more emphasis on that research and like what information is out there about what I'm using, what, you know, what this environment is. I think that that's that's definitely should be a bigger part of the of the security kind of workflow.
You know, even to your point, and we were talking about before, like kind of knowing your environment, like if you don't have something there, when there's a big zero day, and we jump, the enterprise jump, and it's like, but do you actually have that tool? Oh, wait, I don't even have that. Yeah. Okay, so let's relax. Yeah.
Yeah. And I think that was a huge thing that happened with Log4j where there were people all over the place that were like, oh my god, are we vulnerable? And they didn't even have any Like, it's really important to know what happened.
Yeah. Is, you know? And honestly, think that's the reason why there's so many breaches is you just don't know your territory, you know? But what I like to say is the hacker knows. They know, and that's a big deal.
So I guess, you know, thinking back to, going back to some trends that you're witnessing and seeing, what do you feel like is the next big thing in cybersecurity? Do you see any, are we going to continue to see these open source vulnerabilities like Log4j? Is it maybe something else gonna come on the horizon that you anticipate? What sort of trend lines are you seeing?
Yeah. I I do foresee more of those open source vulnerabilities. I mean, I think the biggest thing is we have more assets today more than ever. So anytime there's more assets, there's gonna be more vulnerabilities naturally. Right? Like, even now somebody's home is way different than in the past. Like, there's so many ways to pop a house now because of different things. Like, people have Ring devices in their homes now. You know, back in the day, it's just
You know, there's just more assets, right? That's how I kinda look at is there's more assets. And now instead of applications being more like on prem and local, like to go to start, launch your application, now you're going to launch your web application, which is accessed all over the world to do four forty three and eighty. And then it's like you're logging into the application, like a website and web application is so different. Website, it's like you just have a flyer posted about, oh, we're open at this day, that day. Okay, whatever. But now we have web applications. We have open doors that we can access from anywhere in the world. So it's a game changer, but at the same time, it's nice too to be able to access it everywhere in the world, right? So for me, the biggest thing I see is, and it's funny because Gartner called this the EASM, External Attack Surface Management. They coined this last year.
But since the nineties, you know, hackers has been all about the attack surface. And I think that's gonna be the really the biggest thing because because there's so many assets, now there's just more opportunity to get into so many places that it's hard to keep up with, right? Like, because honestly, some of these breaches, I'll be honest, like, some of them are even that sophisticated. It's like, oh my goodness, I haven't even realized that there was an Apache server out there that wasn't patched. My goodness, I didn't even realize that. So EASM is gonna be a good help for that to be able to start knowing your assets, but at the same time, actually, I would say even playing the game. Because now that you start to understand your assets, you you start to more understand, okay, potentially, this is what they'll go for, and this is why. You can you can... You start you start to understand the why about something. When you understand the why, you can play the game better. But when you're just doing things, you just don't even know why you're doing it, you're just doing it, it's just hard to understand what is the adversary looking for.
No. That's a really good point and and really appreciate all the insights you've shared into kinda what you're seeing and and your work. And I did wanna ask, we always ask our guests one question toward the end of our interviews, and that's what's something that we wouldn't know about you from your LinkedIn? In other words, maybe a fun fact or something that that just wouldn't be apparent to somebody browsing through your LinkedIn.
LinkedIn. Yeah. So you wouldn't know that I I I love... I'm a soccer player. Arsenal is my team. My my wife and fam, my kids. Oh, no. I know. I'm putting it out there. Been married for sixteen years, two girls, and we love traveling all over the world. We love Disney World a lot. And something that you probably never know is my wife and I, we love dancing. Love dancing. It's like the best... It's like the most free... Just very free. You know? It's like one of the best things, dancing.
I do love dancing as well. I I I respect that. I... Again, I'm not sure which is worse, my dancing and my basketball, but you can flip a coin. But I do I do enjoy it. I do enjoy it, and we really appreciate you.
Hudney, I feel like that's your secret. Like, you you didn't say you had a specific... I mean, you had your Zen mornings, but maybe this is your secret, you know, fight the stress of cyber
don't really... I feel like that's something... Maybe I should try that. A breech happens and, you just do a little quick breach dance, you know, a little breach dance. And then just kind of focus.
Dance the dance the hackers away. Yeah. Well, thank you so much for coming on the program here and really enjoyed talking with you. And I'm probably gonna have to go double check my own local IP here. Yeah. Make sure everything's
sweating. I don't know how to feel about this conversation now, but we really appreciate your insights, and it's it's been great getting to know some of your work.
If you like today's episode, please give us a five star rating and subscribe wherever you're listening to this. It'll really help us get noticed on your favorite podcast platforms. Also, share this episode with your friends. And if you haven't already, make sure to check out all the other really fascinating people that we've already interviewed. We're also open to suggestions. If you know someone we should be talking to, drop us a line at we'[email protected]. That's we're in podcast at synack.com.
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
