Hackers. Can they be Trusted?
The computer-security world is divided when it comes to who
belongs in the profession and who doesn't.
Should security companies hire hackers? Or are they better
off steering clear of the computer underground? We put the
question to a pair of veteran security consultants.
By: Brendan I. Koerner
Title: showdown at hacker gulch
Should security companies hire hackers? Or are they better off steering clear of the computer underground? We put the question to a pair of veteran security consultants. Here's what they had to say:
Randal Taylor is vice president of strategic development for Digital Defense, a San Antonio, Texas-based firm specializing in vulnerability assessment and penetration testing.
"We've got guys who are very well respected in the hacker community, but they're respected for their abilities rather than their exploits. I would be very, very concerned about hiring, let's say, a hacker who has gone out and stolen information. When our customers ask us about our background, they have to be able to trust us implicitly. If we go in and say, 'Oh, we've got some guys with criminal records, but they're reformed now,' our client base will go to the next guy.
"We do a detailed interview, and I ask them, 'Have you been arrested for hacking?' What we find often is they were guys who have not stepped over the line. They've come up to the line, and that line is a gray line, but we're very particular about not bringing in guys who hack for the sake of hacking. Right now, the law says you can scan a host, and it's legal. So if a kid scans a host, OK, you've got to learn somehow. It's a matter of whether a kid is out there learning or out there breaking the law.
"We are very fortunate to have some very skilled hackers. We've got some kids that are young, around 19 years old, who are phenomenal hackers, some of the best in the world. They really love what they do and have a lot of passion. What we can do is bring those people in and legitimize what they do. We recently hired a hacker from Chicago, a young kid whose parents always thought he was just messing around. Now he's working for a company and getting paid to do this.... We give him the ability not to step over the line. And when he comes in here and sees our big lab full of equipment, he's like a kid in a candy store.
"The hackers we have, they'll recommend people they know sometimes. Just recently, a few of them said, 'We know this guy who hacks Oracle real well, but you wouldn't want him because he's got a ponytail.' And I said, 'I don't care-if he's good, bring him on. The only reason most of us have short hair is because we can't grow hair anymore.'"
Brian Kelly is CEO of iDefense, a security intelligence and risk-management company based in Fairfax, Va.
"I can tell you unequivocally that the majority of people I have consulted with would not hire an individual who has been suspected of participating in unauthorized or illegal activity.
"It comes down to two key assumptions, the first of which is trust. You have to ask yourself, 'Is this person trustworthy enough to provide access to critical information elements of a company?' The access [our employees] have is very subtle, and it's hard to monitor what they're doing. It doesn't make sense to bring in an expert, then feel like you have to monitor everything they do.
"The second assumption is that [hackers] bring some special skills and experience that aren't available anywhere else. That may have been true 10 years ago, when hackers really had to be experts, really had to understand various protocols, had to write their own exploitation tools. Now you can download tools from hacker sites, just point and click, and you don't even understand what kind of attack you're launching.
"There is a phenomenal amount of [security] talent out there, both at the boutique firms and at the Big Five. These are individuals who understand the technology, understand the protocols, the software. But most importantly, they understand the business of their clients. Many of them come from financial institutions, so they really have business experience to go along with their [technical] skills. Those sorts of people are far more valuable to an organization than somebody who claims to have experience with various exploits.
"True white-hat security personnel sometimes monitor underground bulletin boards, and they go to Def Con. That level of involvement is acceptable, and sometimes it's required-even government offices sometimes send people to the [hacker] conferences. But if you're actually exchanging different exploits and swapping code, I believe that's stepping over the line. If you're actually creating and building the knowledge base for people who don't necessarily have white-hat motives, that's stepping over the line."
Source: http://www.business2.com/magazine/2001/06/hacker_gulch.htm
