You don’t hire bouncers in the hope that they’ll smash up your bar, and you don’t hire bank guards in the hope that they’ll break into your vault. But in tech, keeping systems safe starts with attacking them, relentlessly and with all the ingenuity you can muster. Serious software vulnerabilities that make it into products used by the public—browsers, operating systems, login portals, apps—are hard to find, almost by definition: If a grave weakness had been discovered during testing, any responsible developer would have patched the code before the product was released. After release, the best way to find weaknesses is to act like a bad guy. You hack the system, probe for soft spots, find mistakes you can exploit. Then you fix them, before the actual bad guys get there.
Read Full Article »