2018 Intelligent Reporting Summit Q&A: The Person Companies Pay to Hack their Networks

Clark Sells
August 13, 2018

Christopher Emerson is founder of White Oak Security, a company that tests the security of its clients’ business-critical systems by attacking them. Emerson will speak at the Sovos Intelligent Reporting Summit in Denver in October. Here, he talks about why companies still fail to secure their most important information adequately and what they can do to better protect their data.

Sovos: Tell us a bit about what White Oak Security does. Companies pay you to attack them right?

Christopher Emerson: We’re security testers who mimic malicious actors in clients’ networks and identify security issues. We can also help evaluate the effectiveness of controls clients have in place.

Sovos: What stands in the way of companies being able to secure their data adequately?

Emerson: The people we primarily work with have some background in IT. They know the constraints they have to work with. There’s a balance between securing the organization and delivering uptime. None of our customers want to push out vulnerable systems. Security can slow down the development process. As companies are trying to move faster, security can sometimes act as a barrier. Used correctly, it can be a value add. Used incorrectly, it’s basically just a cost center.

Sovos: But security has been a major concern and a headline-grabbing issue for years now. Why do so many companies still struggle with it?

Emerson: Every environment is different. Asset management for medium to large organizations is difficult because it’s hard to understand what systems you have, where they reside and what data you have on the systems. A hacker just needs to find one system nobody is patching or is afraid to touch for fear of it falling over.

Sovos: So, some companies aren’t patching systems even though they know that failure to patch can leave security holes?

Emerson: There are old systems that don’t get the same care and attention that newer systems do. It’s usually something like a mainframe managing time and activity or part of an ERP implementation. They work well enough, so nobody wants to do anything with them because patching them can be very expensive. It’s entirely possible that a simple configuration update could end up costing an organization thousands of dollars or more. 

Sovos: What is your process for identifying a vulnerability?

Emerson: We start from outside the network and try to start obtaining information about the organization. We start with info that is publically available while trying to maintain a low profile. We look at vulnerabilities, see how we can leverage information to gain a foothold in the network. It only takes one significant error for us to establish a foothold. In most organizations, hacking a system comes down to being able to take over control of the network and access any of their sensitive data. Sometimes it’s credit card data, sometimes personal health information. It is possible to get the information necessary to hack into a system just by doing some external research. 

Sovos: Is there an example of a particularly egregious security hole you can remember?

Emerson: One client had an environment that allowed them to spin up virtual servers to increase server load. Through open-source intelligence gathering, we were able to gain the information necessary to access that system and start spinning up our own servers. 

Sovos: Are there any companies left that really just don’t care much about security?

Emerson: There are definitely some of those that are intentionally lax. We have a couple of customers that do have that mentality. “Why do we need these additional security measures?” But with other customers, one of their goals is to prove that IT needs more budget for security. We get called back to some of the same clients over and over, and we see them being able to make greater strides toward improved security.

Sovos: How do you recommend companies go about trying to better secure their systems?

Emerson: Try to bake security in as a part of the entire process. A lot of companies do testing at the end of development or in production. However, the more integrated security can be early on, from threat modeling at the outset to enabling developers to perform security tests on their own, the less of a barrier security becomes. This idea is definitely gaining traction, but it takes to time to get going and has an upfront cost.

Sovos: What will you be discussing at the Intelligent Reporting Summit?

Emerson: We’re going to take the audience through the anatomy of a hack we performed for one of our clients. The example we’re going to walk through took us about four weeks in total.

Take Action

Learn more about White Oak’s security testing and how the company advises customers to be more secure, and meet Christopher Emerson in person. Register to attend the 2018 GCS Intelligent Reporting Summit in Denver in October. Plus, use code 2018GCS10 to receive 10% off your registration! 

Sign up for Email Updates

Stay up to date with the latest tax and compliance updates that may impact your business.


Clark Sells

Share This Post

North America Tax Information Reporting
June 7, 2023
4 Ways to Elevate Your Direct State Reporting Process

Direct state reporting obligations have gotten increasingly difficult for some businesses over the past few years. With more states requiring direct reporting of form series 1099, more companies are subject to penalties if they do not comply with those obligations. As state reporting evolves, ensuring your process is efficient is critical. Strengthening your reporting process […]

EMEA VAT & Fiscal Reporting
June 7, 2023
The Value of SAP S/4HANA Add-On Software Certification

Many companies utilise SAP for their tax processes, but limitations in native software functionality add a layer of complexity. Custom coding is often required for businesses to achieve their desired results, producing the need for ongoing customisation and optimisation – this creates a hefty burden for companies, in addition to their tax compliance obligations. SAP-certified […]

North America Sales & Use Tax
June 5, 2023
Sovos Onboarding: 6 Departments Dedicated to Customer Success

If you are evaluating Sovos, we want you to understand expectations for the customer experience and what teams are there to support you. At Sovos, we have a range of teams ready to support you from the day you sign a contract. Whether it be a customer success representative to review the value you are […]

North America Sales & Use Tax
June 1, 2023
3 Things to Remember if You Get a Sales Tax Notice

Have you ever received a sales tax notice from a state department of revenue? Whether you answered yes or no, there are important things to keep top of mind to help keep your business prepared. Finding out that you have failed to comply with one or more of your sales tax obligations can be startling. […]

EMEA VAT & Fiscal Reporting
May 31, 2023
Bizkaia: What is Batuz LROE?

The Ledger of Economic Operations (Libro Registro de Operaciones Económicas), also known as LROE, is a main compliance element of the Batuz tax control system. This system is under implementation in the province of Bizkaia, located in the autonomous Basque community in Spain. Taxpayers under the Batuz mandate must comply with both TicketBAI and LROE […]