Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
“We — as defenders — need to know how to secure APIs.”
Guest:
Alissa Knight
Published:
Updated:
Duration:
48 min
Episode summary
In this episode, author, hacker, entrepreneur and content creator Alissa Knight reveals her journey from “bullied computer nerd” to federal cybersecurity contractor to famed car hacker. She gets real about the risk of APIs, offers up some must-hear advice for anyone getting into cybersecurity and delivers candid views about the infosec industry as a whole.
Get inside the head of one of the most provocative and interesting cybersecurity influencers today.
Hear about her work with federal agencies to help secure the future of transportation.
Learn more about the urgent need for better Application Programming Interface (API) security.
Get new insights into the growing threat to health care organizations and financial institutions.
Hear Alissa’s take on how cybersecurity companies can improve their approach to content and marketing.
Mobile apps often leak API secrets Alissa extracts Android apps with an APK extractor, reverse engineers them, and frequently finds hard-coded tokens, keys, and credentials, including for third-party APIs like payment processors.
Authorization flaws are everywhere in APIs Every API she tested in her recent mHealth research was vulnerable to broken object level authorization, where an authenticated user can request objects they are not authorized to see.
Pentesting skills do not transfer automatically Hacking embedded systems in cars is very different from attacking web servers; she learned the in-vehicle network and vehicular mechatronics from a client who whiteboarded it with her for days.
Run risk assessments before pentests She argues pentests fall short without asset registers and risk assessments, since clients only fix vulnerabilities that pose unacceptable business risk.
Shift left and shield right Most security spending goes to post-deployment protection, while secure code training, static analysis, and threat modeling at design time get far less attention.
Topics covered
API Security
Notable quotes
So they're learning how to hack APIs. We as defenders need to know how to secure APIs properly.
And unfortunately, as humans, we innovate before we secure.
…you can't hack what you don't know they have. Right? Asset registers. Just like you can't secure what you don't know you have.
Vendors, features are not innovation. Let me make that crystal clear.
Questions this episode answers
What is a broken object level authorization (BOLA) vulnerability?
Alissa compares it to altering a coat check ticket to collect someone else's coat: you are authenticated and have a valid token, but you are not authorized to access that object, such as another patient's health records. Read this section
How does Alissa Knight test mobile APIs?
She downloads the app, extracts the APK, reverse engineers it to source code, and searches for keys and tokens. She then intercepts the API traffic and replays modified requests in a client like Postman, changing object IDs and endpoints. Read this section
How did Alissa Knight get started in hacking?
She came up through phone phreaking, BBSs, and underground IRC channels in Seattle, teaching herself by compiling exploits and watching packets. At 17 she was arrested for hacking a government network; the charges were dropped and she went to work in cyber warfare for the US intelligence community. Read this section
What is the best way to learn hacking?
Alissa says there is so much free material online, from YouTube to SANS training, that the best way to learn is on your own rather than asking someone to teach you through DMs. Read this section
Why should risk assessments come before a pentest?
You cannot hack what you do not know a client has, and clients will only remediate vulnerabilities that pose unacceptable business risk, so reports should focus on critical issues with business impact. Read this section
About the guest
Alissa Knight is a security researcher, writer, YouTuber, and entrepreneur, and the author of Hacking Connected Cars. She started in the BBS and IRC scene in Seattle, was arrested at 17 for hacking a government network, and later worked for the US intelligence community in cyber warfare. At the time of recording, she runs Knight Ink, which combines hacking with content creation, and was working on a book about hacking APIs for Wiley.
And I'm Bella DeShantz Cook. Today, we're talking to Alissa Knight. Alissa is a security researcher, writer, YouTuber, and entrepreneur. She's pretty much done everything you can do in this business. She's also written a book called Hacking Connected Cars and has two more books on the way.
She's even beginning work on a TV series. Yeah. She's kind of a badass and has some really profound things to say about the business of cybersecurity today. I'm really excited for this one, but first, here's a quick word from our sponsor.
Platform for on demand security expertise. Synack delivers twenty four seven testing, intelligence, and vulnerability management from a global network of researchers. Their work is enhanced by smart technologies to accelerate your critical cybersecurity missions. And now here are your hosts, Bella and Jeremiah.
We currently have Alissa Knight on the show. I'm super stoked to be able to speak to you. So welcome to the show, Alissa. How's your week been for you?
Well, you... I I mean, like, when... What was it? California or whatever was still eating outside and, actually, many restaurants, it was pickup only. We were already eating inside our restaurants, so we've been spoiled over here during the pandemic. So
I remember my friends being there for that and and getting all these, like, videos and pictures while I was, like, totally cool, chill at home and just being like, you know what? That's okay. I did the right thing this year.
Plague. It's the... Isn't it, like, what what what was the, you know, book of revelations wasn't the first one the plague? That is COVID nineteen. It was the plague.
That was a good year. That was a really good year. There were a ton of things that were going on. They had a really awesome car hacking village there that year, I believe, where they did some fun stuff.
live streams are so much more entertaining because, you know, stuff doesn't get cut out on post. But, yeah, thank you for for buying my book. Hopefully, you liked it. Imagine how embarrassing
Yeah. No. I wouldn't even... No. I'm... I mean, you've got, like, Jeremiah over here saying, you know what? I would love to write a book someday. I can't even get past the three dots that keep blinking in front of me. I have no idea what I can't put anything on.
It's hard, Jeremiah. Look. I don't know if you and Bella have ever written, like, long form content, whether it's a white paper or written a book. It's hard. Like, you you you expect to sort of wake up with this inspiration to write, and that's not happening. Right? Like, you you have to sort of... You you you have to make yourself sit down and write. It's the it's the... It's crazy. Anyway... Yeah. And I actually read books on King, and it says the same thing. You you know, there are famous writers in history who have had to, you know, turn off all their network communication on their laptop, lock themselves in a hotel room, and write. And just... Because we're all distracted. We're all distracted so easily, all our pop ups and social media, you know, it's it's really easy.
And I'm the ADD poster child. Right? So I think that's what's always kinda made me a very effective hacker is I'm like the ADD poster child. And so I get distracted very easily. And so, yeah, I actually turned off the Wi Fi on my on my system when I was writing because it was so tempting to load up Chrome. Right? So
Yeah. I I could totally see that. That... To to the point of your book, though, funny funny enough, when I got that, I was I was so stoked because Oh. So I come from sort of traditional, I guess, pin testing background. And, I... You know, I've had the pleasure of operating within a real real Red Team where you do the sort of nation state emulation stuff, but I had zero experience in in car hacking. I think the most exposure I had to vehicle hacking or any sort of API vehicle hacking or plugging into that was... What year was that? I think '20... It was, like, 2014 when Chrysler got in trouble for mailing out those USB drives to update people's vehicles.
Yeah. And I remember getting that in the mail. I don't know if you recall that, but I remember getting that in the mail. And I'm like, this seems pretty interesting. Plugged it in. And looking through the code base, you see all kinds of commits and comments and just API keys that point back to things and a lot of really interesting stuff. And I was like, oh my gosh. There's gonna be a lawsuit here.
Well, you know, it's funny because one one of the things that I find in speaking at conferences and meeting other people in the community is, you know, a lot of people think that you just kinda wake up and you just know how to do this. Right? Like, you're a hacker. You You know how to hack electronic control units. You're a hacker. You don't hack a car. You're a hacker. And it's it's really... And and I came from the same space you did. Right? Like, so I came from the BBS scene. Right? I started out with BBSs. I ran a multi node underground BBS in Seattle. So, you know, I came up that sort of traditional pentesting, hacking IIS or Apache web server. And now I'm intrigued by this brand new world of the Internet of everything and things floating around on water or driving around on the road with wheels that have IP addresses now.
And things that weren't historically connected are now connected, and it was a brand new world for me. And and it's much to your point. You... Just because you're a pentester doesn't mean you know how to hack a car. Like, when I first sat down and began learning this, it really was just like, I didn't even know how to spell ECU, let alone what the hell an ECU was. You know, it's like vehicular mechatronics. What? You know, what? Telematics control unit? What? So, you know, hacking embedded systems is way different than hacking an IIS web server. Right? And so for me, when I was living in Stuttgart, Germany at the time, I had an amazing client who literally sat me down, and this was a a very large company in automotive. And he sat me down and just...
We locked ourselves in a room in Germany and whiteboarded for days on end. Just explaining the vehicular... The the in the in vehicle network, vehicle to vehicle, so v to v networking, eight zero two one, you know, p, all all of these things that I need to understand to do the penetration test that they contracted me for. And it was amazing. It was like this traditional hacker getting educated on hacking a connected car. And it was amazing because, you know... And and he... To this day is a very dear friend of mine. And he... For them, it was like, we don't want a traditional car hacker. We wanna take someone who's really good at hacking and teach them about vehicular mechatronics. And it was this... I I feel like it produced this very creative out of the box thinker when it comes to approaching car hacking because I I very much color outside the lines.
That's my that's my mantra. Right? For me, it was, wait a minute. Okay. Yes. I can take remote control of this vehicle. I can move the steering wheel. I can push the brakes, push the push the gas, accidentally drive the car into the side of the building, which we'll talk about later. It was over a 100... It was a $130,000 car, and I accidentally the side of a building. Anyway, long story. But that's not cool. You know, the fact of the matter was was that this car was talking to APIs. And for me, the... That's where my attention was. Right? So I care very little about the adversary that needs to break the window in order to get in to be able to hit the can... The OBD two port. Yeah. I care more about the adversary that can hack my car from her living room. I care more about the hacker that can take remote control of my car that I'm driving around in my family with from anywhere.
And the scary thing is is that so recently, the the... I've been doing connected train hacking. So several states have reached out to me about this new fleet of connected trains that they that they are deploying. And these things have telematics control units just like cars. The, you know, airplanes flying around in our sky, telematics, all these things are communicating over either wireless or or GSM. And now with five g, even more things are connected. And I don't know if you saw the recent report from Akamai, but was it more than 82% of the CDN traffic is API traffic now? Yeah. Yeah. And Bella, this... That that means that more than half of the traffic on the Internet today is no longer human to app traffic.
Now I totally saw that. That's one of the things that I think most users don't quite realize is in the grand scheme of things, the majority of traffic that's out there, just to reiterate on your point, is not human traffic. So when you see these things that are producing traffic on on the interwebs, then, you know, a lot of that is bot based. Most of it's API traffic, and most of it is is untested. The majority of it is untested.
Yeah. A good good point. And and that's the thing is the plumbing for not just The US infrastructure, but global infrastructure. Look at open banking slash PSD two in The UK. Right? Look at where we're headed here in The United States with the same thing with financial aggregators, you know, mobile apps. We're in an app economy and app first world now. The number of laptop sales are going down while the number of mobile phone sales are going up. People don't wanna lug the laptops around anymore. Even laptops are too big now. My 17 year old kid doesn't know what the hell a mouse is. Right? The the generation z is all about touch screen. Right? What the hell is a mouse? Why do you need a mouse? Right? So things are changing, and and the thing is is that all of this, the plumbing for our entire financial system, our health care system is APIs.
So the thing is is that data is worth more than oil. Right? So hackers are shifting their attention to hacking APIs. They know that that's where the oil is. That... They know that that's where the data is. So they're learning how to hack APIs. We as defenders need to know how to secure APIs properly. And so recently, Wiley has awarded me a new book contract to publish a new book on hacking APIs. So That's awesome. That's coming. I totally just dropped that.
Think it's interesting how much you've talked about where... What you're currently focused on in this very niche area of of car hacking or... And, like, APIs, which I guess are are not exclusive to to cars, but, this sort of, you know, where you are now and and you've mentioned how you got into hacking, but I'm a little bit curious about that original introduction. Like, how did you get into cybersecurity? Why was it interesting to you? And and then how did you go from from that to this? What we've talked about.
So it was in Seattle. And this is about the time... During the time of IRC v t 100 shells for accessing the Internet, Internet relay chat, if you're old enough to remember IRC. Hound hack. And so, you know, and BBS is in dial... The dial up scene. And so I wanted to get into phone phreaking, which at the time was called, you know, is phone hacking. You make box, banana boxes. I was big into the the alt 2600 and, you know, all all this stuff regarding hacking phones and phone systems, making free calls, stuff like that. So that sort of led led me to accessing IRC and some of the more underground IRC channels and meeting other hackers, meeting other people that were interested in this.
Now at the time, there was no YouTube. There was no even securityfocus.com. There was no Bugtraq. There was no Synack. You know? I mean, the idea of publishing op... You know, even if you think about it at the time, open... The concept of open disclosure didn't even exist. So if you found a vulnerability in something and you published it, you could be arrested and thrown in jail. Right? So, you know, bounty hunters wasn't a thing. And so at the time, because you don't have the the education and resources available to you at the time, you really have... Were on your own. You had to download... Back then, Bella, you had to know how to GCC compile a dot c exploit and get it to work in order to be... You know, in order to actually hack anything unless you wrote the code yourself.
Like, you had to know how to fix that. You finally found the exploit for WU-FTPD, and you crossed your fingers that that damn thing would compile. And then like, oh my god. It's not compiling. I gotta find a new exploit or fix it. And so, you know, Metasploit wasn't a thing. A lot of hacking now is point and click. Right? Crime kits. You know, you've Metasploit and Meterpreter shells, and all that thing wasn't a thing. So this is a very long winded answer to your question, but basically, my start to this was figuring it out on my own. And really just downloading things, looking at what the exploit was doing, launching TCP dump, and recording the packets back and forth to look at what the stimulus and response was, what it was doing with the the service on the other end. And then once sort of kind of breaking that apart, just...
Okay. I'm gonna admit it. Targeting networks that I shouldn't have been targeting. So the first network I hacked was a fast food chain. I won't say who. I was lucky enough to not get caught. And then when I was 17, I... My parents were so excited because they're like, oh my god. She's gonna graduate. She's gonna graduate. They were so worried about me graduate. And it was for my graduation. And sure enough, I hacked a government network, and I got caught this time. And they were waiting for me at school. The agents were waiting for me at school, and it was weeks before my graduation. And I went from being, you know, the bullied computer nerd to, like, the most popular kid in high school. And... Because they arrested me in front of everyone in the quad. And
Yeah. Exactly. So fast forward, the the district attorney dropped the charges, and I ended up going to work for the US intelligence community in cyber warfare. And realized that, hey. You know, I could get paid to do this. This this this is a thing. And so... Yeah. And so the cybersecurity scene kind of started to develop around me. You know, security focus came along, and then open disclosure came along. I published the first vulnerability on hacking VPNs. And that was at the time on Bugtraq. And now we have platforms like yours where, you know, you can make money being a bounty hunter, you know, finding vulnerabilities and being paid for them. Oh, what a concept. Because when when I when I presented my vulnerability at Black Hat briefings on how to do this, they sent lawyers to the briefing...
To the presentation. And I had been fired from my job for for wanting to talk about this. It affected every VPN that was deployed. They sent lawyers to the presentation. It was a bad time for vulnerability researchers. If you wanted to do vulnerability research, you had to make sure that you look good in orange because there was a possibility that you would get arrested. So, you know, you know, thank god things have changed, and you can do it without worrying about the knock at the door.
I'll age myself a little bit and say, you know, one, I got into computer anything at sort of a late stage in my life, like not until late college. But by that time, I took an introductory security course. And basically everything that we learned was like, yeah, this is how it used to be, but that doesn't work anymore. And so a lot of my introductory or introduction to cybersecurity was like exclusively web applications, like, because everything is just online now basically. And and Right. A lot of it was. Yeah. I mean, I think a lot of us who, know, call ourselves hackers or have any pentesting experience probably have a good amount of, you know, figure it out on your own. I think that's how a lot of security is. But so much of it was like, okay, here's how here's how people originally figured it out and then it's been fixed. I always find it so interesting hearing about, like, you know, I don't know, the more OG hacker experience.
But it was different back then. It was very different. I mean, you know, it was upload download ratios. It was z modem. Like, it was, mom, I've been downloading for four hours, and you picked up the phone. You know? It was... That was that was life. And so, yeah, it is... It's tough. And and and so please don't take this the wrong way. Audience, do not think I'm this, you know, horrible person when I say this. But, like, I totally love to mentor. Okay? Sure. I'll be a mentor. I'll mentor you when I've got the time. And I'll have people message me like, hey. I saw you on the Synack podcast. I was wondering if you could teach me how to hack. There's so, like, there's so much out there for education on how to learn how to hack, how to learn how to analyze packets, how to learn anything, security tube, YouTube, SANS, you know, training.
Like, there's so much information at your at your fingertips now with the Internet and and Google. There's no reason you should have to approach anyone and say, teach me. Like, learn... The best way to learn is to learn on your own, the best way, because you have the capability to be better than me.
Like, if if someone asks you to explain to teach how to hack, like, maybe you're gonna you're gonna talk about a different thing than I would... Than Jeremiah would. Like, we all have different focuses.
You might you might talk about, you know, the the the fallibility of Apache or or you may talk about, hey. You know, screw trying to buffer overflow Apache or, you know, with FTPD. I just sent an email with a weaponized PDF file and game over. You know? But I may talk about what are all the APIs in the environment. Everyone has their own narrative.
You've gotta take onus upon yourself to... Like, if you wanna learn something, awesome. If you want to put in the effort to learn something even better
That fuego, that fire. Yeah. Well... And, you know, it's... What... What's interesting for me is... So I'm... I will admittedly say, and you you both know this. I'm not a bounty hunter. I don't have anything against bounty hunting. I've no... Nothing at all against bounty programs. But recently, I've been learning more about them. And and the interesting thing that I found in in researching them was you guys actually offer content out there to teach people how to do certain things. Like, I think probably one of the best API hacking articles that I read was actually on a bug bounty site. Like, there... It's it's really interesting. Like, it's really trying to educate the command like, hey, not only if you... Not only will we be there for you if you're interested in being a bounty hunter, but we're also gonna give you tutorials. Like, what? You're gonna even train and teach bounty hunters?
Like, that's insane. You know? So, I mean, I just think we live in a really exciting time right now. And if people would just stop trying to take the shortcut and say, teach me hacking through DMs, I I just think there's so much information at our fingertips these days.
I do wanna get a little bit more technical about some of your experience and, maybe low key, maybe ask you to teach us a little bit of some some stuff. So specifically, you know, we... We've talked a little bit about your experience, hacking connected cars. You were working in Germany, hacking connected cars. I'm wondering if you could give us a little bit of an explanation, and we can get a little bit technical here just for the record, of, like, how how does that work? We've talked a little bit about APIs and how those are relevant to to connected cars. Can you tell us a little bit about how that how that is structured?
Sure. So there's really two types of APIs that I target. I target mobile APIs and web APIs. Mobile APIs to me are a lot more exciting because of the systemic problem of developers hard coding tokens and keys into the mobile app without a code obfuscation or slash application shielding. And so I'll literally just download the mobile app from the app store and use APK extractor to extract the APK off of the device and load it onto my machine, reverse engineer it back to the source code, and actually just scrape the source code looking for keys and tokens. And you would be shocked. Maybe you wouldn't. But you would be shocked if I told you how endemic that is in the industry to hard code, not only just tokens and keys and credentials, like usernames and passwords into apps for their own APIs, but also third party APIs like payment processors.
It's it's it's very common. And, you know, so the research over the last few years that I've been doing into hacking APIs has has been really eye opening. Because for me, using these mobile apps, I didn't really understand or know that this was going on underneath it. Where, in some cases, things being passed unencrypted or even talking to app developers and them not knowing that I could actually extract the the Android app off of the device and reverse engineer it and look through the code. So just a lot of really insecure crappy development going on out there. I don't know if I can say that word on your show. Apologize if I can't. But, you know, just just really, really piss poor programming and as from a security perspective. And so once I've done that, I'll then go after the API and do what I do, like, call woman in the middle attack and inject myself in that in that communication and actually understand how the API works.
So especially in cases where there's no documentation, like if it's a bank, there's no documentation on the API. Not that I've done this illegally. It was sanctioned, I promise. But injecting myself on that side. Yeah. Exactly. Really just kind of mapping out that API and look at the API request and the responses. So like stimulus and response, and then taking that API request and then feeding it into a free API client like Postman or Arc, and modifying that API request to specify different object ID, different endpoint. And every single API tested, for example, the recent mHealth research was vulnerable to BOLA or authorization vulnerabilities. And for your audience who doesn't understand what BOLA or broken object level authorization vulnerabilities are, I use this as a great analogy.
Stop me if you've heard it. But it's like if Jeremiah and I... Or let's say Bella. Bella and I were at a cocktail party and she was standing in front of me like, oh my god. I love that Burberry coat that Bella's wearing. And I'm thinking... And I'm sitting there wearing, like, this ghetto coat from, like, Marshall's. And I want Bella's coat. Right? So she goes to the coat check, and she checks in her Burberry coat, and the coat check gives her the number 18. And I come up behind her and I check-in my ghetto coat and I get number 17. I take a Sharpie and I modify that ticket to be an eight, that seven to an eight, give it back to the coat check, and I get to leave with Bella's coat. That's a great example of a vulnerability. So I've got a ticket. I'm authenticated. I have a JWT token. I'm authenticated. I should be there, but I'm not authorized to leave with Bella's coat.
I'm not authorized to request those patient health records. So, you know, that is a very common attack that I I employ against APIs. So hopefully, that answers your question, Bella, my methodology. You know, for web APIs, it's very different because you don't really have that mobile app to reverse. But there's a great tool called Burp Suite where you can actually... And really any proxy, there's also mitmproxy. I... I've been using Burp Suite a lot more lately because it's like an all in one Swiss army knife. And so it'll actually proxy the request and send certificates in both directions and a light to decrypt that traffic. And they actually have a built in Chromium web browser where you can go after web APIs that way and immediately intercept and analyze those requests and test an API directly from within Burp Suite.
Extrapolating out the whole API discussions, right, and putting it into wider perspective. When we talk about these things from, you know, consumer grade products like, you know, regular vehicles and and and API things on maybe mobile applications and and and how that affects the common user. When we go a bit wider, how does that look for, say, you know, government and planes and, you know, military operations?
So a very interesting thing happened to me recently, and I'm I'm still kind of in the midst of it, so I can't really talk too much about it. But I will disclose enough for people to understand what's going on. So if you have been to my YouTube channel, and if you haven't subscribed and hit that bell button, sorry, if you if you look on my YouTube channel, there's a couple videos there about me hacking federal and state law enforcement vehicles and me standing in a parking lot actually remotely controlling of a a law enforcement vehicle. And I published this on YouTube. Now I didn't publish the screenshots for you to see what I'm actually doing and how I'm doing it, but it was enough to scare the hell out of the US government. And so a lot of the... Actually, all of the three letter agencies, DHS, FBI, CISA, NSA, they all...
They reached out to me. And so the interesting thing here was I was actually approached by the US government, by law enforcement to do this research. Just not all the components actually talk to each other in the US intelligence community and law enforcement. Yeah. I know. Maybe it's gotten better, but I think there's still a lot of politics at play. So they actually reached out to me to perform this research, and they actually permitted the filming of a documentary. But once the federal government got involved and law enforcement got involved, it was very much like, oh my god. Because if you think about... Let's let's talk about this for a minute. Let's be honest. Let's point the pink elephant out in the room. If I can do this with law enforcement vehicles for this particular automaker, doesn't that mean that this vulnerability exists in every one of their cars on the road? Of course. So this is a very big problem. And so much to your point where, you know, we we we can talk about something in a very...
At a very small scale that that affects a very small attack surface. But it's very... But you can also extrapolate that and and actually expand it. And all of a sudden, you realize that, oh my god, APIs are everywhere. These these vulnerabilities are everywhere. This is affecting every... Everything in which we live, work, and play. Like, everything from our passenger transport. I'm doing a penetration test of a super yacht. Like, a yacht. Why does a why does a boat need an IP address? Really? Come on. But, you know, this is what's happening. Everything is becoming good. We, as humans, want to continue to innovate. We, as humans, in this... These millennials and the z... Generation z all want always on connectivity. How do you do that? You have to give everything an IP address.
And unfortunately, as humans, we innovate before we secure. And we need to fix that and move to a shift left and shield right mentality where securing things at the code level when the code's being written or when the product is being made and then shield right when it's actually in production and none of that is being done.
So looking looking in the future, right, five, I don't know, five, ten years down the line from here, with a lot of this research that you've developed, how do you have the largest impact? And before I pause, I would like to, touch on Knight Inc and some of the strategies that you have there to help address some of these things.
People ask me, like, what the hell is Knight Ink? What are you doing? Like, I'm still trying to figure that out. So I'm a very complex creature. So if if... I guess the best way to describe it is if a hacker and an... And a content creator were to have a baby, I would be the product of that. So, basically, I merge hacking with content creation because I firmly believe that CISOs and cybersecurity engineers are sick and tired of the marketing bullshit of papers talking about the features of the product and trying to demystify whether or not the product actually does what the marketing material says it does. And so I'm trying to create a new kind of content that proves the efficacy of a cybersecurity company's product by hacking it or hacking something that shows how their product would have prevented it.
So let me give you example. One of my biggest exploits in claims to fame were, a small little cybersecurity startup that no one really knows about called SentinelOne approached me and said, hey, look, we're publishing... We're creating this new product called SentinelOne Ranger, and it's going be an IoT security product. And we want you to write a white paper. And I was like, oh, I got a better idea. What if I were to show through an actual hack of me pulling my car up into the parking lot of a bank and hacking the bank through the CCTV cameras in the parking lot and showed how your product would have prevented that. And it was amazeballs. It was this this light went off, it was like, oh my god. I could actually do this for a living. And so that's what I'm doing at Knight Ink.
I'm a big believer in Simon Sinek's. People don't buy what you do, they buy why you do it. And, you know, it's it's like... It's why we're all walking around with a... With an iPod or an iPhone in our pockets to listen to m p threes instead of Creative Labs. Creative Labs came out with the first m p three player seventeen months before Apple did. But Creative Labs told us what it is, and Apple told us why we need it. So it's... We're it's a... We're in this world where we need... We only make our purchase decisions off of why we need something, not what it does. So I work with cybersecurity vendors to help them carve out their Blue Ocean strategy, if you will, and and explain the efficacy of their product in a way that CISOs and cybersecurity engineers actually want to see that narrative around. Anyway, so I went off on a tangent, but that's what I'm doing.
I... I'm I'm I'm a cybersecurity influencer and content creator. I'm I'm also really trying to... Okay. I'm gonna piss off some of your audience here. I used to be an analyst, and I do not believe in the ivory white tower and the analyst industry. It has a lot of pay for play. And I think a lot of CISOs and a lot of cybersecurity engineers are sick and tired of it. How can CISOs and security engineers really make purchase decisions off of the company that has... That's the highest bidder? What about the companies that can't afford to work with secure... With these analyst firms? What about them? What if their products are more superior, but they just can't afford the analyst firm? How does that make us more secure? It doesn't. It doesn't. So I'm really trying to disrupt the analyst industry and the content creation industry.
64% of your buyers are making purchase decisions off of custom content, not advertisements. People no longer want to be advertised to anymore. They don't wanna be inundated with Google Ads. They're making purchase decisions off of podcasts like this, off of white papers, off of videos, off of content. And so I think that's where our industry is broken, and I think it needs to change.
I think, you know, you've hit the nail on the head with talking about, you know, content and the why. Because it's not necessarily the what. You could have the best product in the world. You know, reference that m p three example that you gave. Right? You could literally have the best product in the world. But if you can't tell your story as to why, then it falls short. And so I love the fact that you're doing something like Knight Inc, especially when it leads to, you know, how does the future of cyber and the future of APIs and the future of these things that, you know, commercial and government entities aren't looking at, when it leads to developing better better content around why, that's, in my opinion, exceedingly important. And so, you know, props on that, by the way.
One of the things I wanted to discuss really is, you know, along with that content strategy, for those that are listening, what are some of the things that, you know, just maybe real quick, some quick I do not wanna say check marks. Some some quick sort of hints that you can lead to for how the industry should be moving forward.
I think what we need to do, first and foremost, is stop disenfranchising certain groups of people within our industry and making them feel less than because they're not programmers. Because they're not the right color. They're not the right gender. They're not the right gender identity. They're they're... The disenfranchisement of cybersecurity of this whole more elite than thou attitude that we have in cybersecurity that ostracizes or disenfranchises certain parts of our population is wrong. And I think adversaries want more of it. Those who are attacking us and just the ransomware as a service gangs, all...
They want us to basically turn on each other. Because how do you defeat an enemy? You turn that enemy against themselves. Right? So it's all asymmetric warfare. It's all asymmetry. You know? So having said that, I think one of the first things we need to do is we need to start coming together and stop making people feel like they're not as good of a hacker because they don't have any CVEs to their name, which is stupid. I can't believe that ever came up on Twitter. You know? You're not a good enough hacker if you don't know how to code. That... All of that is nothing but people trying to feel better than other people in the industry, and it's wrong. I also think that where we need to go and what we need to do better at is we're relying too much in the security industry.
If you look at the overall ecosystem of cybersecurity products, a lot of it is ShieldRight security product. A lot of it is post deployment protection through firewalls, WAFs, network detection and response, endpoint detection response. All of these different tools and products to build the layers of the onion versus the shift left security solutions where can we just send developers to secure code training? Can we just write more secure code? Can we just do static code analysis while it's being written? Like, what happened to fixing things while the ingredients are being put together and then baked instead of waiting until it's baked and rolled out and accessible from the Internet? I think that's another big fail that we need to get behind it.
In venture capitalists, private equity firms, I'm talking to you. Stop investing so much. I'm just taking down everyone. It's a shotgun approach. But, you know, VCs and private... And then look. I started my venture capital fund after I sold my last company. Like, I I... I've got great friends who are VCs. I'm not... You know, I don't... I'm not a hater. But what... But VCs, shame on you. There's just there's too much of... You know, it's like if you put machine learning in your PowerPoint, you're gonna raise your first round of seed or at round a. You have machine learning, if you have AI, whatever. But we need to start investing more in providing resources and support to companies that are helping us just make more secure products versus securing more products. The other thing is...
And this is a very interesting turn that the industry has taken recently. I don't know about you, Jeremiah and Bella, but have you noticed that a lot of really amazing innovation is coming out of Israel? Like, oh my god. 100%. Oh my god.
So I think the new Silicon Valley is Tel Aviv. Look at all of the amazing tech real... I'm not talking about features. Features, cybersecurity companies, I'm going after you now. Now I'm talking to you. Vendors, features are not innovation. Let me make that crystal clear. Features are not innovation. Real innovation is coming out of Tel Aviv. And if you look at this, you know, there's... There there... These new product carriers, breach and attack simulation, deception. A lot of these companies are coming out of former 8,200 of the Israeli defense forces and coming out and leaving the idea up and starting their own cybersecurity startups and bringing that out to the West.
Yeah. I'm a I'm a big time nerd for threat modeling. So, the whole the whole idea of shift left, like, I... I've worked as a pentester, but, basically, as soon as I learned about threat modeling, I was like, oh, this is it.
There's a great chap... Section of my book in threat modeling. So I actually break out and demystify all of the different threat modeling frameworks that you can use, like Microsoft's. You know? So you've got these different, like, pasta, like, these great threat modeling frameworks. And I agree with you. I am drunk on the threat modeling Kool Aid. I I... I'm... I love just drawing things out and thinking about things from just a hierarchical level when you're talking about threats and... Because at the end of the day, really, the meterpreter shell and Metasploit should be the last step. Everything else should be done for that. Do you know how many arguments I've gotten into with pentesters over why we're failing so bad with pentest is the...
Or at least not as exhaustive as we could be because we're not doing risk assessments before it. Like, you can't hack what you don't know they have. Right? Asset registers. Just like you can't secure what you don't know you have. You you... The the the process of risk assessment is so near and dear to my heart, and it... Because it's so important. And I think that's another big fail in cybersecurity that we need to do more of is freaking risk assessments. Number one, first and foremost, I'm sorry, pentesters, but that client of yours is not gonna fix every vulnerability. They're just not. They're not. They're going to remediate the vulnerabilities that are in an unacceptable risk to the business. That is what's gonna happen. So you can throw away that Nessus report with over 600 pages of vulnerabilities like self signed certificates that no one cares about and talk about the critical vulnerabilities that have a business impact.
You've got a book. You've got a lot going on on YouTube. If if our listeners are interested in finding any of the the content that you're putting out, how how can they find it? What have you got going on?
Yes. So I'm really big into cinematography and film production. And so the first place I always publish content is YouTube. I do weekly livestreams, weekly videos. Check my... Check out my YouTube channel. Follow me on YouTube. Subscribe. Hit that bell button. And that... If you wanna support me, the best way to do it is is by following me and subscribing to my YouTube channel. Follow me on Twitter. Connect with me on LinkedIn. I'm pretty much everywhere. On Instagram, you can see photos of my food. I can't say that, I do really anything useful or value on Instagram except take pictures of my food, but that's about it. Oh, and you know what? Actually, Bella, Jeremiah, I do wanna drop this. You've heard it here first on this show.
I was approached by producers from Netflix to publish and work on a new TV series. So I'm actually writing a screenplay for a TV series. Basically, the the the producers... And I don't know if it's gonna end up on Apple TV or Amazon Prime or Netflix. But, basically, they wanted a new TV series where the protagonist, unlike mister robot, that... Where the protagonist is a woman. And so in talking with the producers, I'm... They want the TV series to be based on my life. So I'm writing a screenplay right now. So if a lot of you are like, that much content's coming from Alissa Knight right now. It's because I'm trying to figure out how to make more hours of the day. And so I'm I'm working on a screenplay right now. I just finished the pilot episode. It's gonna be amazeballs. I want all of you to know, and I will come back on this podcast and and drop it when that when that new TV series is gonna air.
We have one final question. It's it's one that we ask every single guest, and it's also the question that we ask every single new hire here. So what is one thing that no one would know about you just by looking at your LinkedIn, your website, or your YouTube page?
Oh my god. That's a good question. What is the one thing that no one would know about me without looking at my Twitter, LinkedIn, or YouTube? I have crossed off everything on my bucket list except for skydiving. Before I die, skydive. I had one thing.
I've started and sold companies. I've worked for the US intelligence community in cyber warfare. I've started a defense contracting company providing counterinsurgency support operations in The Middle East. I've published books. I'm now writing a screenplay for a TV series. The one thing that I have to do before I die is I need to fall out of a plane.
Do you know which industries are most hardened against cyber attacks? How does your sector stack up when it comes to finding and fixing vulnerabilities? Vulnerabilities? Are you doing enough to ensure you don't lose your customers' trust? It can vanish in an instant due to a breach or a cyber attack. Synack's 2021 trust report is your essential guide to understanding how industries measure up when it comes to security preparedness. Download it today at synack.com. That's synack.com.
