2018 Intelligent Reporting Summit Q&A: The Person Companies Pay to Hack their Networks

Clark Sells
August 13, 2018

Christopher Emerson is founder of White Oak Security, a company that tests the security of its clients’ business-critical systems by attacking them. Emerson will speak at the Sovos Intelligent Reporting Summit in Denver in October. Here, he talks about why companies still fail to secure their most important information adequately and what they can do to better protect their data.

Sovos: Tell us a bit about what White Oak Security does. Companies pay you to attack them right?

Christopher Emerson: We’re security testers who mimic malicious actors in clients’ networks and identify security issues. We can also help evaluate the effectiveness of controls clients have in place.

Sovos: What stands in the way of companies being able to secure their data adequately?

Emerson: The people we primarily work with have some background in IT. They know the constraints they have to work with. There’s a balance between securing the organization and delivering uptime. None of our customers want to push out vulnerable systems. Security can slow down the development process. As companies are trying to move faster, security can sometimes act as a barrier. Used correctly, it can be a value add. Used incorrectly, it’s basically just a cost center.

Sovos: But security has been a major concern and a headline-grabbing issue for years now. Why do so many companies still struggle with it?

Emerson: Every environment is different. Asset management for medium to large organizations is difficult because it’s hard to understand what systems you have, where they reside and what data you have on the systems. A hacker just needs to find one system nobody is patching or is afraid to touch for fear of it falling over.

Sovos: So, some companies aren’t patching systems even though they know that failure to patch can leave security holes?

Emerson: There are old systems that don’t get the same care and attention that newer systems do. It’s usually something like a mainframe managing time and activity or part of an ERP implementation. They work well enough, so nobody wants to do anything with them because patching them can be very expensive. It’s entirely possible that a simple configuration update could end up costing an organization thousands of dollars or more. 

Sovos: What is your process for identifying a vulnerability?

Emerson: We start from outside the network and try to start obtaining information about the organization. We start with info that is publically available while trying to maintain a low profile. We look at vulnerabilities, see how we can leverage information to gain a foothold in the network. It only takes one significant error for us to establish a foothold. In most organizations, hacking a system comes down to being able to take over control of the network and access any of their sensitive data. Sometimes it’s credit card data, sometimes personal health information. It is possible to get the information necessary to hack into a system just by doing some external research. 

Sovos: Is there an example of a particularly egregious security hole you can remember?

Emerson: One client had an environment that allowed them to spin up virtual servers to increase server load. Through open-source intelligence gathering, we were able to gain the information necessary to access that system and start spinning up our own servers. 

Sovos: Are there any companies left that really just don’t care much about security?

Emerson: There are definitely some of those that are intentionally lax. We have a couple of customers that do have that mentality. “Why do we need these additional security measures?” But with other customers, one of their goals is to prove that IT needs more budget for security. We get called back to some of the same clients over and over, and we see them being able to make greater strides toward improved security.

Sovos: How do you recommend companies go about trying to better secure their systems?

Emerson: Try to bake security in as a part of the entire process. A lot of companies do testing at the end of development or in production. However, the more integrated security can be early on, from threat modeling at the outset to enabling developers to perform security tests on their own, the less of a barrier security becomes. This idea is definitely gaining traction, but it takes to time to get going and has an upfront cost.

Sovos: What will you be discussing at the Intelligent Reporting Summit?

Emerson: We’re going to take the audience through the anatomy of a hack we performed for one of our clients. The example we’re going to walk through took us about four weeks in total.

Take Action

Learn more about White Oak’s security testing and how the company advises customers to be more secure, and meet Christopher Emerson in person. Register to attend the 2018 GCS Intelligent Reporting Summit in Denver in October. Plus, use code 2018GCS10 to receive 10% off your registration! 

Author
Clark Sells

Relevant Posts

New York Implements Economic Nexus by Resuscitating 1980’s Law

When New York first passed its law defining what constitutes a “vendor” subject to collecting sales tax in the 1980’s, the idea of online shopping sounded like science fiction. In retrospect, NY may have effectively enacted the first “economic nexus” law when they drafted their definition of “vendor” to include a person who regularly or […]

Read More
IRS Uses Unprecedented Methods to Enforce ACA Reporting Penalties

With recent enforcement measures, the IRS has offered definitive proof that the Affordable Care Act (ACA) is still alive and that the agency plans to strictly enforce ACA reporting. Last spring, the agency issued Letter 226J to Applicable Large Employers (ALEs) that failed to cover 95 percent of employees. ALEs are companies with 50 or […]

Read More
Government Shutdown Will Not Move IRS 1099 Reporting Deadlines

UPDATE (Jan. 8): Reporting season is moving forward according to plan. The IRS has announced that it will process tax returns on schedule and without delays. While the agency will clarify its contingency plan in the coming days, organizations should proceed as planned with 1099 reporting and other seasonal filings. The IRS will recall a […]

Read More
4 Big Post-Wayfair State Sales Tax Developments to Watch 2019

The South Dakota v. Wayfair decision last June has created a lot of angst for indirect tax professionals and the businesses they work so hard to protect from the burdens of sales and use tax filing. Six months later as we begin the new year, that angst has not gotten any lighter. Any federal legislative […]

Read More
The 5 Biggest Stories in Indirect Tax Compliance 2018

2018 was a volatile year in indirect tax compliance for tax, finance and IT professionals worldwide. With an increase in globalization and tax gaps surpassing tens of billions in some countries, it’s not surprising that one of the biggest challenges governments are addressing is revenue collection. Like enterprises, governments are creating new, technology-driven processes to […]

Read More