2018 Intelligent Reporting Summit Q&A: The Person Companies Pay to Hack their Networks

Clark Sells
August 13, 2018

Christopher Emerson is founder of White Oak Security, a company that tests the security of its clients’ business-critical systems by attacking them. Emerson will speak at the Sovos Intelligent Reporting Summit in Denver in October. Here, he talks about why companies still fail to secure their most important information adequately and what they can do to better protect their data.

Sovos: Tell us a bit about what White Oak Security does. Companies pay you to attack them right?

Christopher Emerson: We’re security testers who mimic malicious actors in clients’ networks and identify security issues. We can also help evaluate the effectiveness of controls clients have in place.

Sovos: What stands in the way of companies being able to secure their data adequately?

Emerson: The people we primarily work with have some background in IT. They know the constraints they have to work with. There’s a balance between securing the organization and delivering uptime. None of our customers want to push out vulnerable systems. Security can slow down the development process. As companies are trying to move faster, security can sometimes act as a barrier. Used correctly, it can be a value add. Used incorrectly, it’s basically just a cost center.

Sovos: But security has been a major concern and a headline-grabbing issue for years now. Why do so many companies still struggle with it?

Emerson: Every environment is different. Asset management for medium to large organizations is difficult because it’s hard to understand what systems you have, where they reside and what data you have on the systems. A hacker just needs to find one system nobody is patching or is afraid to touch for fear of it falling over.

Sovos: So, some companies aren’t patching systems even though they know that failure to patch can leave security holes?

Emerson: There are old systems that don’t get the same care and attention that newer systems do. It’s usually something like a mainframe managing time and activity or part of an ERP implementation. They work well enough, so nobody wants to do anything with them because patching them can be very expensive. It’s entirely possible that a simple configuration update could end up costing an organization thousands of dollars or more. 

Sovos: What is your process for identifying a vulnerability?

Emerson: We start from outside the network and try to start obtaining information about the organization. We start with info that is publically available while trying to maintain a low profile. We look at vulnerabilities, see how we can leverage information to gain a foothold in the network. It only takes one significant error for us to establish a foothold. In most organizations, hacking a system comes down to being able to take over control of the network and access any of their sensitive data. Sometimes it’s credit card data, sometimes personal health information. It is possible to get the information necessary to hack into a system just by doing some external research. 

Sovos: Is there an example of a particularly egregious security hole you can remember?

Emerson: One client had an environment that allowed them to spin up virtual servers to increase server load. Through open-source intelligence gathering, we were able to gain the information necessary to access that system and start spinning up our own servers. 

Sovos: Are there any companies left that really just don’t care much about security?

Emerson: There are definitely some of those that are intentionally lax. We have a couple of customers that do have that mentality. “Why do we need these additional security measures?” But with other customers, one of their goals is to prove that IT needs more budget for security. We get called back to some of the same clients over and over, and we see them being able to make greater strides toward improved security.

Sovos: How do you recommend companies go about trying to better secure their systems?

Emerson: Try to bake security in as a part of the entire process. A lot of companies do testing at the end of development or in production. However, the more integrated security can be early on, from threat modeling at the outset to enabling developers to perform security tests on their own, the less of a barrier security becomes. This idea is definitely gaining traction, but it takes to time to get going and has an upfront cost.

Sovos: What will you be discussing at the Intelligent Reporting Summit?

Emerson: We’re going to take the audience through the anatomy of a hack we performed for one of our clients. The example we’re going to walk through took us about four weeks in total.

Take Action

Learn more about White Oak’s security testing and how the company advises customers to be more secure, and meet Christopher Emerson in person. Register to attend the 2018 GCS Intelligent Reporting Summit in Denver in October. Plus, use code 2018GCS10 to receive 10% off your registration! 

Sign up for Email Updates

Stay up to date with the latest tax and compliance updates that may impact your business.


Clark Sells

Share This Post

Tax Information Reporting United States
How to Respond to the Growing Challenges of 1099-R Reporting

The demographics don’t lie: Reporting for form 1099-R is only going to grow more difficult as baby boomers retire. The form used to report distributions from IRA, pensions, annuities and other similar retirement accounts is poised to explode in volume. As such, financial institutions (FIs) and insurance companies can’t afford to mishandle 1099-R reporting. The […]

E-Invoicing Compliance EMEA
Portugal Issues New E-Invoicing Rules: A Flavour of Clearance but Not Quite There

On 15 February 2019, Portugal published Decree-Law 28/2019 regarding the processing, archiving and dematerialization of invoices and other tax related documents including: The mandatory use of certified invoicing software General requirements for paper and electronic invoices Dematerialization of tax documentation Archiving of tax documentation (including ledgers, etc) Adjacent tax rules and obligations The decree aims […]

EMEA LATAM VAT & Fiscal Reporting
Are We in the Golden Age of VAT Recovery?

The value-added tax (“VAT”) was described in the EU as a “”money machine” over 20 years ago. Yet according to a 2015 study by the European Commission by the Centre for Social and Economic Research (CASE), the “VAT gap” was approximately 168 billion EUR. This represents 15 percent of the theoretical VAT that would be […]

Tax Information Reporting United States
As Legal Sports Gambling Grows, So Does Growth in W-2G Reporting

With the NCAA basketball tournament approaching, the US is gearing up for its biggest gambling weeks of the year. And while most “March Madness” pools might technically be illegal, legitimate sports betting is sweeping the US following last year’s landmark Supreme Court decision allowing states to legalize sports gambling in casinos.   As legal sports […]

E-Invoicing Compliance EMEA Italy
Italy E-invoicing: Esterometro Reporting Requirements for Cross-border Transactions Updated

What is Esterometro? The Italian government’s e-invoicing mandate became effective on 1 January 2019.  While cross-border invoices are exempt, all domestic B2B and B2C invoices must be cleared through the SDI platform. This means that the Italian government and tax authority now have real-time access to the data of all B2B and B2C VAT transactions […]