hey ted
welcome back to the podcast thanks for
having me kyle thanks for having me
um i know the the last time you were on
the podcast we talked a lot about
the the research that uh you and your
company did
and uh you know since then you've taken
some of that research and put it into
a book called uh hackable and really
talked about how
you can use some of these uh security
concepts
um and uh yeah so i just wanted to kind
of
you know for folks that want to go back
and listen to
the uh the first podcast we did it's
episode 10
and we talked a lot about the research
that you did and um
just for folks that maybe haven't
listened to that one if you could just
give out the kind of overview about you
know
you and what your what your company is
yeah so my name is ted harrington i'm
one of the partners
of a security consulting and security
research company called
independent security evaluators and
we're like
the good guy hackers all right we're the
ones that companies come to and say
hey come break our stuff before the bad
guy does and and fix it
and so as as a result of that you know
of course
how we make money is companies hire us
but we also publish a lot of research
it's essentially the same thing
except that uh we're doing it to publish
it we're not getting paid for it
and so that's uh along the lines of what
you're alluding to and some of our
research is we've hacked everything from
cars to smartphones to medical devices
cryptocurrency wallets
and uh yeah like like you mentioned i um
i decided to write a book and when you
write a book you want to tell stories
and so i just tell
all these stories from research and
stories from our customers too of course
without naming names but that's that's
who i am i i help companies build better
more secure software
and and why write a book so why did why
did you take all this and go
through the the rigor and the
painstaking uh
or maybe it wasn't painstakingly maybe
it was fun for you but maybe you could
just talk a little bit about that
you know the why and then the process of
writing the book how was it
yeah it's funny that's the second time
today that someone's actually asked me
why write about this super technical
idea
in a very analog format which is a book
and it's it's a really good question
the reason why i wanted to write it in a
book is
that uh smart people read books
and i'm trying to meet people the smart
people where they are right
and so i wrote a book to help people who
are trying to level up their
security game their their understanding
of
you know how systems work and and how to
break them and all that stuff and so
when i decided that i was the
i guess the moment that made me decide
it was i really observed
sort of two things first thing i
observed was that
every conversation that i had with
whether it's a current customer a
prospective customer or just
people that i talk to at industry
conferences or just you know
other parts of my life it seems like
when it comes to security
everyone had really essentially the same
10 problems and not everyone would
necessarily say
all 10 of them every time but every
conversation someone had one or more of
these problems was what they were
struggling with
and when i first noted that i realized
that you know that's that's pretty
interesting
i'll have to think about that and then
as i was thinking about those problems
and the solutions to those problems
i noticed something else and what i
noticed was that the the conventional
solutions to those problems that
everybody has
the conventional solutions are almost
entirely wrong
that was the moment that sort of kicked
my butt into gear to say look you
i said this by myself like i know how to
solve these problems
and i i see it as a
itself a problem almost a tragedy that
the people who
know they have a problem and want to
solve that problem are being given
advice
that is bad advice so i wrote this book
to correct that whole situation
and when you start i think from that
position of service right which is i can
help someone solve their problem
what follows the writing process is
actually not
i mean it's hard it's it's tremendously
hard and it takes a ton of work
but it's not like uh it's not unpleasant
it's actually a lot of benefits come out
of it throughout the process
that's great i like i like taking that
uh approach that you know you're being
of service and really helping people
figure out what their problems are and
how to
best solve them now what are you just
mentioned that
you know a lot of these companies that
you help they have a lot of similar
things you found some patterns with
you know some of these prospective
customers what what are some of those
patterns what are some of those uh
typical things that you you saw with uh
with customers that kind of got you
thinking about how you could put these
into into a book
they there's a handful right uh so
they're things like
one of the challenges is that people
don't necessarily know
sort of what the right mindset or right
approach or right attitude
is to approach security and this is one
of those things where people sometimes
don't even necessarily
state that as a problem it's inherent
and implied in the way that they
think about the problems another
challenge is people don't necessarily
know how to work with
security consultants they don't know how
to vet them
or how to pick between them or even once
they are working with one
how to think about information like for
example a lot of people
think that what's called black box
testing is this great thing because they
think it
is like oh it's like emulating the
attacker it's like real world conditions
but it's it's actually none of those
things it
it delivers all these bad things like it
makes your partner really inefficient
uh i saw issues where people struggle
with understanding how much to spend
what to spend it on when you're spending
that money what are the efforts that it
goes towards how do you fix
issues how fast should you or how
frequently should you
look at security again and then really
the big one the big
sort of the the big kahuna is
what's the business benefit right
look i'm a security guy of course i and
i'm an optimist
i believe that security is a value
on its own like it's worth doing because
it's the right thing to do and i
i genuinely believe that about security
but i'm also a pragmatist
and i realize that no business is going
to do anything
just because it's the right thing to do
uh now
without wait let's not pick that apart
in terms of like well what about
defrauding their cost you know that's
not my point my point is like people
aren't
uh people don't start commercial
for-profit enterprises
to just do things that like that feels
right there what they're trying to do is
pursue their mission and a lot of people
think about security as this
like tax on the business they think of
it as well
how do we minimize this cost that is
security
and that is a problem because
actually what security is is it's a
differentiator
it's a competitive advantage and when
it's done right and it's used right
you're able to actually
use it in your sales and marketing
process and most people don't know how
to do
that at all let alone that it's
something they can do and so
you know you hear these things enough
over and over you're like i can solve
that
and that's and essentially i structured
the book around
the there's ten chapters in the book and
the first nine chapters are
here's how to essentially do security
right like here's how to think about
your relationship with your partner
here's the right mindset
here's the right methodology here's what
testing should look like here's how to
fix
issues here's how to deal with change
here's how to build security and here's
how to
um set your budgets or think about your
budgets and then
so that's the first nine chapters how to
do security right and then the
uh the tenth chapter is how do you prove
it because then if you can prove it
people will buy from you i love it and
that really resonated with me when i was
reading this book so i'm a product owner
on the product side of things and
you know i have an awareness of security
but i don't necessarily know
the technical details of a lot of the
security stuff so it was really
eye-opening for me to to read this book
and i really like that you take that
approach to you know rather than saying
and like a lot of people like you said
like a lot of people will
do security it's like okay i gotta check
these boxes rather than
bringing that as a part of your
development to make a product and
and really having really solid security
gives you a competitive advantage to the
you know your competitors and really
helps you deliver that
really amazing product and so how do you
go about
um you know pitching that to
executives who you know like like you
said they're really focused on
you know um the bottom line you know
they're focused on uh
what their mission is for the business
and and um
you know at the end of the day making
making money so
um how how do you
how do you approach that to you know
executives
well i guess i guess there's three
things to do so one is tell stories
because storytelling is really uh it's
how we as humans
actually consume information and can
figure out how to take action on it so
i tell a lot of stories in this book but
uh telling stories
about companies who did it right and
companies who did not do it right
the second is provide
data but minimal on the data and so this
is
something i think that's kind of
surprising to a lot of people in a very
scientific field like security
or more broadly in technology that even
though we all love data we love
analyzing it we love looking at trends
and
stuff data no one makes decisions even
though we're all like give me the data
so i make a decision now we make
decisions on emotion
and based on essentially storytelling
and so what the data needs to do
is to support the argument that you make
in a story so
when you want to convince an executive
something you tell them a story
that helps them understand how that they
can see themselves in the story and they
can see the success or the failure that
might result
use data to support it and then you tell
them exactly what to do
in crystal clear terms literally do this
do this
and do this no don't beat around the
bush like be super clear and succinct
and finally tell them what the outcome
is that they will get
and that's how decisions are made by
executives
they will uh you know they understand
the data to make sure that what they are
assessing about the situation actually
makes sense they want to know exactly
what to do
and then they want to know what they're
going to get if they do that thing
yeah makes it you make it sound so easy
and i'm wondering how
how was it like you know because and
that's something that you do well in
this book i think it is uh
and the book is called hackable i don't
think we talked about the name of the
book yet so it's hackable
and uh so so and you do a good job of
that this book
of writing really clear stories and
analogies and
and you you know uh putting things in a
way that anyone can understand it
uh how did you um
how was that process for you is it was
it easy for you to
make it succinct and you know easy to
understand or was there a lot of editing
involved like
how what was that process like
that is not easy one of the things that
i i've been saying
to people that i've learned from this is
that it's really
hard to write simple
you know you're like well that sentence
only has four words
and this one has like 25 words you're
telling me that one's harder right it's
like yeah that's way harder to write the
the four word sentence
and so that that was really hard um it
did require a tremendous amount of
editing
but here's the trick to it so uh like i
could
give you all the sort of like mechanical
and technical sides of how you actually
edit a manuscript
but the part that i think's really
interesting
is how do you make written word
sound easy to understand
you do that by making it sound like
you're talking to somebody
and that's really difficult too so it's
like okay well the answer is this really
hard thing
so how's that helpful well the way that
you do that
is you you envision someone that you're
talking to so in my case
i wrote my book talking to my nephew
who's
uh he was 12 turned 13 through the
process so he's a young he's you know a
smart
interested curious kid and
thinking that how do i describe this to
him knowing that he's not the audience
for the book it's not this isn't a 13
this book is for
professionals in technology but if it
can make sense to a 13 year old
it will make sense to the executives and
they'll thank me
for it being easier to understand
because it's simple no one wants to work
harder than you have to understand
you want it to be easier so once
i was thinking about like i'm gonna
write this
as if i'm speaking to my nephew that
makes a lot of the writing decisions a
little easier so for example
you know i might say something like i
can't remember now what the more complex
ways i might say something would be but
here's the perfect example perfect
example someone asked me this yesterday
they said uh
i'm not making this up they go they're
like ted
tell us how does machine learning and
artificial intelligence
impact digital transformation and the
way that it will make us think about big
data and
how do we synthesize all of this in
order to empower our stakeholders to
take action i'm like
what so i think about a sentence like
that which is like all jargon and
buzzwords
corporate lingo and the question is
ted how do we deal with change
my nephew can understand that right i
can understand that
the executives in the boardroom can
understand that and that's
that's really hard to really simplify
what it is that you're trying to say
um but if you do that then what you're
able to do is you're able to take your
message and
actually make impact because if the
reader has to think too hard and they're
like
i'm not entirely sure what he means here
okay we'll just keep going and all you
just lost the opportunity to help that
person solve their problems
wow i love that that's uh that's a good
that's a great tip and and i
and i asked from a personal uh you know
level because i i've been thinking about
writing a book i've had ideas for books
but then just like
never got into the like okay i'm gonna
get you know like
really go all in and do it so i've been
dabbling and you know at some point i
think i'll write one so
thanks for that that's really really
great advice um
i wanted to dig into something else that
you mentioned about you know companies
that
do it right versus companies that don't
do it right are there any examples that
you can share
i have a whole book full of examples
yeah so here's what's interesting is
that the companies
the stories of other companies that
don't do it right are way more
interesting
because they're so dramatic and the
companies do it right it's like
they were supposed to do x they did x
it's like that's the story but i can't i
can tell you
i'll tell you some contrasting stories i
do have a good fail and a good success
story
so where we should focus the story let's
focus on mindset because i think that
this is one of those
areas that is sort of overlooked a lot
of people think like
security security it doesn't matter how
i think about it but that's like saying
like fitness is fitness it doesn't
matter how i think about it no it
it matters like if you want to get fit
you're probably gonna be in good shape
and if you're like
show me the list of push-ups i have to
do and i'll do those push-ups today and
that's it
you know like you're not going to get
right it's all about your attitude so
um there's one company that we worked
with
that makes a medical device that injects
drugs into your spine now that's a
let's just let's just set that as a
baseline of what we're talking about
here
so we had done this security assessment
for this customer
and we were um at the end of the
project we were doing what's called a
results presentation we essentially just
walk
the customer through the different
issues that we found helping them
make really making sure they understand
the problem so they can fix them because
that's that's our mission right we want
to
make sure that people do something with
this and can be better and all that
stuff
so we're we're walking the whole team
of our customer through the issues and
the ceo
interrupts and he says it that's not
that big of a deal
and uh we're like please you know
elaborate explain why this isn't a
problem we had literally just showed him
how an attacker could attack the
software that operates
this device and then as a result it
would actually hurt or potentially kill
patients so this is kind of a big deal
if you could actually do that
and his answer was he says look even
though what you say could happen
i'm just not that worried about it
doesn't mean that it will happen and
again we're like
okay i just showed you this is a really
bad scenario so elaborate he says look
let me
let me put it this way he says i drive a
bmw
and i love this car i never want to see
it get scratched and he says
theoretically someone could take a piano
haul it onto the roof of our office
building throw it off onto my car and
completely destroy it
but i'm just not that worried about that
no
my mind was blown you know this guy he
we had just explained to him how someone
could
hurt a patient as a result of using his
his system
and his answer was to come up with these
think that it was similar to a very
far-fetched
like unreasonable scenario and you know
it was it was a bummer because we
couldn't really change his mind we
couldn't turn him around what he really
wanted us to do was sort of just
revise what the report actually said and
so it just sort of that was kind of the
end of it
and the sad story uh the story had a sad
ending
when later he went to go get approval
by the government agency the fda that
approves medical devices for use on
patients
and they started talking about security
and they were like well tell us about
your security flaws and
how you plan to fix them and basically
he tried to shut it he tried to do the
same thing he did to us try to like
well it's not a big deal he tried to
sort of marginalize and dismiss it and
they didn't really like that and so the
product ultimately wasn't approved
and if you don't have fda's approval you
can't sell the product so
the company went out of business now
that's really bad and
i don't mean to i'm not celebrating that
failure i don't mean to gloat and i hope
that
that's not what i'm conveying but it
needs to be this cautionary tale needs
to be
shared right here's someone who who just
didn't want to get better and so they
didn't get better and
so it ended badly so
that's how to do it not right yeah you
don't if you think about it
bury your head in the sand when the
evidence is there in front of you you
have to
act on it right yeah you have to i mean
and
and this person was i i really feel for
this company and
the ceo because he started from the
right place
right he said let me get an outside
organization let me get people who are
really good at this and yeah it's going
to cost me time and it's going to cost
me money and
it's gonna result in work but let's do
it like that's where they started from
they wouldn't have hired us
if they weren't already demonstrating
those characteristics those are great
characteristics everyone should think
that way
but when the rubber met the road when it
said okay now you gotta fix your stuff
i think that's where that's where it
really fell apart because i think what
they were really hoping was a we
wouldn't find anything or b we would
just
sort of rubber stamp it and be like yeah
this is good
which like which wasn't at all what
we're you know what we're there to do
but we have another customer who sort of
had the opposite and
so now we can look you know flip the
coin to the other side and say okay what
about someone who does it right
and this was a company who's whose story
is like i said a little bit less
dramatic but still pretty cool
they uh they were they realized that
security really mattered to their
customers they worked in an industry
where
the people they were selling to really
prioritize security
and so even though they were a small
company they didn't have a lot of money
didn't have a lot of people they still
invested
to do it right and they went big and and
by big i just mean
they they covered the full attack uh
the full scope of attack services which
is what what they should do and not
everyone can do it but in this case they
did
and they over time they were able to
find all these issues and fix them and
keep getting the product to be better
and
and that was really a big difference
right they said once they got the the
flaws
they went and took action on it they
fixed it they made sure that their
developers were getting better as a
result
and you know fast forward a few years
later they wind up getting acquired for
an enormous like nine figures and
you look at these two stories side by
side i should mention by the way that
they didn't get acquired just because
they were secure they obviously had
everything that made sense for them
to be acquired but they were only in the
game
because they could prove security there
were other options that could have been
acquired as well who were who couldn't
prove security and so the acquiring
entity was like yeah we want you guys
and so now compare those two stories
right one went out of business
one produced millionaires and that's
pretty extreme
right but that really shows you how this
thing that seems
like that shouldn't matter we're talking
about this like
technical scientific thing no mindset
matters and it really is
that big of a difference in terms of the
impact to the business
is how you think about it wow
wow thanks for thanks for sharing the
stories i think that's uh
yeah it's really great to see i mean
it's a really
you know those are obviously two
completely different ways of looking at
security and
it does make a difference on how you you
you
react to that information how you take
take that mindset and take that approach
to security
um one of the things that i really liked
uh in your
in in your book and you talked about uh
and you really
um for me you really kind of took
like what the probabilities are in
uh being able to figure out what a
private key for a cryptocurrency wallet
is
and you know i think you use imagine
you're on a beach
and you know you you have a
grain of sand what's the probability
that your friend could go to the beach
and pick up that same grain of sand and
then
multiply that times all the beaches on
the planet and all
and let's say i can't remember how many
planets there are that have that are
earth-like that have those speeches
and the likelihood of you picking up
that same grain of sand is like the
likelihood of figuring out
you know what a cryptocurrency private
key is
yet you were able to figure it out on
these 752 different keys along with this
uh
bitcoin bandit as you described them
that was
able to take out millions of dollars out
of these cryptocurrency wallets
um how does that happen
uh i was really riveted listening to you
tell my own story back to me and how how
did you i was like
damn this guy knows what's up
oh man that was that was cool that was
cool for me
tell me more tell me about chapter one
now
oh man i can't even know what your
what was the question how does that
happen how does how do you
how do you discover you know how do you
in in theoretic
theoretically you should never that
should never happen right you should
never be able to pick up that grain of
sand but you've done it 752 times
like how yeah so the
maybe the bet there's a couple ways to
answer that question we could like
dive deep into the technical way or stay
at the
conceptual level i think staying at the
conceptual level is probably better
because there's a whole white paper that
someone can read who wants to get into
the actual nitty-gritty of how we did it
but i think the the the how does that
happen
it's from this this mindset of
looking at the way that a system is
supposed to work
and then evaluate can it work
differently
i mean that's fundamentally that's
hacking
now and of course that term we should
probably mention is uh
is a bit abused in the media you know
a lot of people come to refer to that as
bad people
um all that a hacker is is someone who
looks at a system
it's creative problem solver and says
hey can i make it do something
differently than it was intended to do
and you know like the classic show
macgyver when he would
fix an engine with a paper clip you know
that's hacking right the paper clip
wasn't designed to be an
engine fixing thing you know that was
that was taking something and
repurposing it
and that's what hacking is so whether
you're talking about
hackers who are motivated to do good
like ethical hackers people like us and
our peers
or attackers who are motivated to do bad
they're both hackers
and so then what a hacker's doing is
they're looking at a system and they're
saying okay well
it has this capability can that
capability do something else and
uh essentially without getting too into
the weeds on it the
the sort of the what if questions that
we're asking that's that's the uh
that's the arsenal in the arsenal of the
uh the hackers toolkit is the what if
questions like what if
flank uh the what-if question there was
looking at
uh some things related to um errors
and so looking at how
the the software handled errors
and um basically what what we looked at
was we found
that in so doing it that process
is what we found a way to abuse and
that's also what the
the blockchain bandit who stole millions
of dollars from this
this particular exploit sequence that
was leveraging the same thing we found
you know that's what they also had
discovered so that's that's essentially
it looking at a system and saying
look supposed to do this thing what if
it does this other thing and then just
trial and error until you find something
that you can uh exploit
huh interesting interesting so it was on
the the error handling piece of it
that's interesting
um so something else that you mentioned
about is you know a lot of people are
like all right black box testing right
try to
try to try to hack my [ __ ] and try to
get in try to get in
and um and you kind of caution people
against
just doing black box testing can you
talk a little bit about that
i would say i did more than caution i i
think i
i i think i made a uh an academic case
against it
except in select uh use cases um yeah so
okay
black box testing yeah that's that's a
good question so this goes to
methodology
i mentioned that one of the problems
that people have whether they know it or
they don't know it
is how do you actually work
with or security consultant your
security partner
whoever you're having doing your testing
and a lot of companies have this
misplaced notion
that they want black box testing because
what black box testing is this is about
withholding information
it's about saying um what what people
are thinking with blackbox testing
they're saying
well what i want to do is i want to have
the attacker try to break into my system
so if i hire
somebody to to evaluate that why don't i
just
like recreate what an attacker would
have so just see can they break in
but that's that's pretty dumb for a lot
of reasons
and the reasons are a few so the first
reason is
you're literally paying them you're
paying your security partner to learn
the things you already know
so i use the metaphor that i like to use
as a castle and so it's like
if a king said hey i want to know if my
enemies can assassinate me
i will ask one of my you know one of the
the nobles in my kingdom to send their
knights and see if they can break in but
i'm not going to tell them anything
about it
and so now every minute that those
knights are spending
trying to like break into his castle
they're doing things like
they're counting the alligators in the
moat they're looking how many archers
are up on the turrets
what's the easiest place to cross the
moat these are things the king already
knows
what what did the king get by paying
somebody to go do the things he already
knew he didn't get anything
and that's another problem
is that what you're really testing
you're not testing your defenses the
king's not testing the castle
the king's testing those nights because
really what the test says is can these
knights in
this amount of time get into this castle
okay what does that tell you about your
enemies like
not really anything and then the final
issue
is that you don't know what to
do with the information right you don't
know if they come back and the knights
say hey
you know we saw some stuff but we
couldn't really get to the king
um of the stuff that we saw we didn't
know how to fix it
right uh for example the archers weren't
very accurate
well is that because the archers have
poor equipment is it because there's
the footing where they're standing is
bad is it because they're training
they're not properly trained
is it because that wasn't even the
archer shooting the arrows because the
the actual archers were somewhere else
you don't know because the king didn't
tell them any
information but if instead they the king
had walked them around
and said okay here's the moat here's how
many alligators are in the moat
here's my archers you'll you'll notice
that this is their first day of training
uh the the knights could quickly without
testing anything say well you're gonna
want to train your knights
and you need more alligators that took
two seconds
and that's the kind of stuff that black
box actually really prevents
you from getting getting benefit out of
and so the opposite is white box which
is
high levels of collaboration sharing a
lot of information
that's where the king is walking you
around pointing things out
introducing you to the guards
introducing you to the architect
of the overall system and that's really
the better way to do it
and it it replaces this mistaken notion
that you can replicate real world
results
by withholding information that's that's
really really bad what you want to do
instead
is you want to capitalize on one of the
few advantages that defenders have
defenders have
the advantage that's information
information leads to shortcuts
so being able to say to your to your
security team
this is what the whole thing looks like
what should we care about and they're
like that
that might take an outside organization
weeks or months or maybe never
to get to the like that that you got in
20 minutes
right and and i think in that analogy
you say also too that you know
the the king hired these knights to try
to get in and
they couldn't and then a week later they
got attacked you know they got attacked
by this underground tunnel that they
never told the nights about right so
so like had the knights known there was
an underground tunnel like that's
something they could have
you know uh used as as a way to to get
in type thing so
so yeah i think that you know uh you you
you really make the case for being
making sure that the you pick a security
partner that's going to
you know help um
help you figure out you know yeah find
out those things that are important to
you the things that you know about the
things that
uh that way you can speed up the testing
and really get more out of what you're
paying for right
totally um so then uh you know i just
wanted to ask you a bit about like what
are your thoughts about like how do you
choose like
uh vendors or third-party you know
because you
ever today everyone's got to work with
other companies that have technology and
they have your data and you guys are
sharing data
and you know i think i think target's
probably one of the biggest examples of
you know having a third-party vendor
that
where there was an exploit that that
where they you know
kind of got screwed over because of that
how do you go about
choosing vendors and working with
third-party services
or how should a company rather yeah so
if you're if you're the
the buyer of the services and you're
looking to hire
whether it's a service provider or
you're looking to
license or subscribe to a tool that's
that is a difficult challenge and the
reality is that when you start working
with another company
you are inherently accepting their
security posture
and so the way to think about that
there's there's a few but
the first thing that you want to do is
you want to really understand what
they're doing
and so i mentioned earlier about how in
chapter 10 and
i explained to everyone like here's how
to actually use it in your sales and
marketing process
so this is sitting on the other side of
the table this is where you want to say
okay
what do i need to be getting from the
people who are selling to me and what
what should be the things that should uh
raise some red flags for me
the red flags would be anytime you hear
people making
uh claims that are hollow or they don't
back
up or just sound preposterous so things
like some of the
things that you hear all the time that
are just total head scratchers
people say things like well we use
bank level security we have military
grade encryption
and those are ridiculous claims because
what they're trying to do is they're
trying to say because we use the same
encryption
as a bank or as a military what's
required in the military because we use
the same encryption
we are as secure as a bank and that's
just not true i mean that's like saying
um this cheap
hyundai entry-level hyundai is actually
a luxury car because it has rolls-royce
grade
tire pressure it's like
okay yeah i mean uh hyundai does have
the same tire pressure as a rolls-royce
but it's not a luxury car like what are
you what are you trying to imply you're
trying to apply this broader truth so
that's one to be aware of
another would be things like when people
say oh we're highly secure
and then they don't back it up or when
they say oh we do
uh annual external penetration testing
and you're like why you do it only
annually
why is it only external and do you know
what penetration testing actually means
are you just getting a scan
these are the kinds of things to look
out for because many
companies don't know how to do security
and then they definitely know how to
talk about it and so as the buyer that
makes it really difficult
in order to to understand those services
how they thought about security what to
do about it
and it just requires a different level
of effort
in order to understand what you're
getting into
interesting um yeah i really i
i've been really enjoying reading this
book i haven't i haven't quite finished
it yet but i i do like uh
one of the things that i think that you
did with is really cool is you kind of
put some easter eggs
or at least one easter egg in it and uh
so you can you can go and and i'm not
gonna i'm not gonna
do any spoilers about the easter egg i
want to encourage people to go out
and buy the book and find it but then
it's interactive too so you can you know
you can go online and learn more about
what you've
learned from the book uh and kind of
figure out these
little hidden uh thing you know these
hidden easter eggs that you got in the
book
and uh so i think it was really cool it
was really fun and it was good for me
you know someone that's not uh super
technically savvy but you know somewhat
aware
um kind of putting things in in
perspective so
i highly recommend uh people go out buy
the book
you could buy it for you know your
co-workers um
you know people that you've maybe tried
to explain security to and they roll
their eyes at you or something like that
like this is a fun book to read and it
really
helps uh put it in perspective and
really helps the right it really
um the regular person can wrap their
mind around it so i really like what you
did there
and uh where can people get it if they
want to buy the book
well it's available on amazon so it'll
be easy to find
but maybe the simplest thing is to just
go to hackablebook.com
and anything you could need as a result
of this conversation you'll find there
so obviously there's a way to buy the
book
it describes the book my contact
information is there so if you wanted to
reach out to me about
whether it's just speaking engagements
or talking about working together or if
it's just you just want advice
you know hit me up i love talking about
this stuff all my
information to follow me on linkedin or
twitter is all there so
hackablebook.com is what i would suggest
awesome and i'll include that in the
show notes as well and i'll also
uh find that the the crypto thing that
we talked about the
the the case study i'll find that and
putting at the show notes as well so
um yeah anything else any final
final thoughts uh it's been a lot of fun
yeah it's it's definitely been fun uh i
think the only thing to end on is
like i said for i'm an optimist and i
think that
so much of security is really focuses on
fear and uncertainty and doubt and it's
kind of like
kind of a bummer and i think
that security some of those things are
true there's
there's real problems out there
uncertainty is re i mean
no one knows anything about anything
it's just like yes these are these are
real challenges
but there's really a bright
light to all of this which is you know
you look at a book like this and
um and you look at books that my my
peers and my friends and everyone in the
security committee look at the security
community even as a whole and the
security conferences and like
there's so many people working so hard
to try to drive these the the industry
forward to solve these problems and
that would be one thing i'd want people
to take away from this that
yeah there's real problems but there's
real solutions to those problems that's
the one that's why i wrote this book
that's how i wrote this book
and uh you know don't don't
succumb to the sort of fatigue that
everyone has of security breach
headlines and everything and
it's not an impossible task and we're
all in it together so
that would that would be i think the
last thing is sort of just end on a real
positive note that
yeah it's hard but most things worth
doing
are hard and so let's go build better
more secure software systems
awesome i love that final note so thank
you so much ted for
uh taking the time and uh everyone
listening
go check out the book hackable go to you
say hackable.com
or application.com
and uh yeah get yourself a copy
all right well thanks so much for having
me and thank all of you guys for
listening