Unspoken Security Ep 13: Challenging Assumptions at the Intersection of Cyber & Physical Sec (Pt 2)

I've always been teetering on that edge and the dark side pulls me over every once in a while, but at least I've made a career out of it.

Welcome to Unspoken Security by Zero Fox, the raw and gritty podcast for cybersecurity professionals who want to understand how threat actors are leveraging the internet. In each episode, your host AJ Nash engages with various industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding security. Ultimately, the lessons learned will enable security professionals to take an intel-driven, proactive approach to physical and cybersecurity that extends past the perimeter. Let's get started.

This is how legends are made.

Welcome back to Unspoken Security. As many of you know, I assume this is part 2 that you're about to hear. If you didn't catch part 1, you'll want to go back and take a look at what we published a couple of weeks ago. Anna and Sean were guests on part 1 and it ran long. A lot of great content. We didn't want to break it down. We don't want to lose a lot of things. So we split it into 2 pieces. So this is going to be part 2 of Anna and Sean's time with us here at Unspoken Security. Again, if you haven't seen part 1, I recommend you go back and listen to that one first. This won't make a lot of sense because we're going to be right in the middle of the show. Uh, and if you have, looking forward to hearing your, your feedback and comments as you finish up part 2, learn about a bit more about what they do in terms of physical pen testing, uh, and also some of the really cool real-world stories they have. And of course, their unspoken truths that we haven't gotten to yet. Uh, so without further ado, let's jump into part 2. So I, I wanna tip on something. I got a third question we gotta get to, but I wanna, I wanna track on this. So how do you test the untestable, right? There's some things that you just can't, I mean, I look at and go, well, I mean, how am I gonna test a, an assassination attempt or a bombing or, you know, something like that. You're clearly not gonna do that. I mean, you're, you're obviously not gonna manufacture a fake bomb either. I mean, that's, that's obviously way more stress than you'd want. So how do you do that? But also another thing I wanted to touch on, these will go together, I think, is we had talked before we went on and started recording all this. I know we had talked about, you had, you had said that red teamers are assumption hunters, which I think is a really big point. I wanna make sure we hit on that. Cause when you talked about it, uh, privately, I thought that's really cool. And I think it ties to this, like you're obviously not gonna be able to do the bomb thing. So there's some assumptions, but how do you test the untestable? And then talk to me about what it is to be an assumption hunter, because of course the whole show is about, you know, the assumptions. And then we'll get into the third question we have still.

Yeah. So testing the untestable, that is ideally where red teams shine, right? That's the creativity part. And so you're obviously not going to try to kidnap or assassinate a CEO. But if you sit down and you try to, if you sit down and you try to figure out like who, and you red team through it, like who's the adversary? What are they gonna do? Like they need motive, opportunity, capability. And so figuring out what opportunity might they have, well, they're probably gonna do surveillance and look for an opportunity when the person's alone, and then they're going to gather, like most adversaries, especially in the physical space, go through the same life cycle. There's opportunistic thieves and then there's people that plan things out, which are going to cause serious damage to the company. And so if you're talking that, like, you look at, you do the surveillance just as they would, right? If you want access, you go out and do that. You figure out, okay, they're probably going to find someone when they're out on a run alone and they leave their security detail behind. So you figure out what time they do that, you figure out where they're gonna be, and then you park a car there. And if they run past you, you don't tell them that you're there. You don't do anything. You just say, hey, you asked me to do this. This was, I took every step up until, you know, causing anybody harm or even alarm. And then I did it. I mean, same with bombs. There's, there's plenty, like if you're doing mail screening, you can, there, there's great companies and vendors that have very realistic devices, or you can build them yourself. If you want to get put on a list, you can build that and then go through and mail it. Ideally, if you're mailing it to yourself, you're going to the loading dock and you're putting it in the incoming packages. You're not sending it off with UPS. But at that point, it goes through the full cycle and you watch and you see if they catch it. And so you can always test these difficult areas. You just have to be extra creative, and it's absolutely possible to figure out how to do that. And then the assumption hunter was an excellent question. I will keep it short and maybe hand it to you, but ultimately any security gap is an assumption. You assume an integrator installed something correctly. You assume a security measure exists or works or somehow very commonly, you assume another team is taking care of it. They assume you're taking care of it. So like we, we end up matchmaking at companies a lot of the time saying, hey, these two or three security teams, you should all talk to each other because you all think you're securing the thing. You all think the other one's securing it and nobody is.

Yep.

And so it's really just kind of the Spider-Man meme in person. And we do that more often than you would, you could imagine. And so yeah, ultimately we. Look for any assumptions that leaders, security managers have. We document them, and then we try to test and challenge them. Sometimes we validate them, which means they become facts, and that you can make much more confident decisions with facts. And sometimes we refute them, and they become gaps, and they can decide they're spending money on a security measure that doesn't work, and they can either decide, "Let's save the money, accept the risk, and move on," and suddenly you have more security budget. Or they can figure out how to mitigate it. And so, yeah, ultimately everything we do, red teaming boils down to identifying and challenging, testing assumptions. Anything on your side?

No, I agree.

You ate it all up, Sean.

Go ahead.

I get excited about it. I'm going to ask— I'm asking Anna the third question directly. Please. Okay. Now, what do you got to add to this one first? I don't want to cut you off.

No, I think, I think that's a big part of it. Right. And like part of the assumptions as you kind of going back to that, comparison we made earlier between pentesting and red teaming and the fact that, you know, one of it is a little bit more like controls-focused or centered around controls than the other one. It's because there's an assumption that, hey, you know, if we're trying to protect from unauthorized access, we got to test our turnstiles. And it's like, maybe you got to test your loading dock. And so There's two, two kind of points that I wanna make to this. One is no path to do this is necessarily, you know, too complicated or too easy. And again, you're gonna want to rely on your intelligence to keep things realistic here, but never underestimate your adversary, right? So, and that's one big one. Never underestimate your adversary. Another side of it is if something can be done simply, don't over-engineer it. And I think that, that one is a little bit harder to wrap your head around, right? But, you know, if you, if you can just have someone hold the door, don't start picking the lock after they've shut it behind them, right? Like, and I'm, you know, this is coming from someone who kind of knows how to pick locks if I have to, but I'm the one that go, will go on the lobby and usually get a temporary badge or at least a tour. I'd have tried to talk my way into a building. I don't like to put in the physical hard labor. So, so choose the easier ways. And I understand, you know, some people won't think that speaking your way into, um, or chatting your way into a building is necessarily choosing the easy way, but sometimes it can be. And it again depends on your adversary and depends on what you're testing. But having the gamut of options and making sure that you're not thinking, oh, It's nation state, therefore it must be this most sophisticated thing. And it's, you know, insider threat and it's this and this. Statistically, probably it is, but, you know, don't overlook some of the solutions that may be in front of your face. But we're here to kind of ask those questions, guide, guide in our interviews to, you know, more probable and likely paths that we can give information that, again, fills that picture out. Builds that puzzle out. So, so whoever is in charge, whoever is making these decisions, can make them from a more informed place.

I, I, yeah, that— I, I, I'm just picturing— sorry, I, I daydreamed for a minute because I was picturing how you're social engineering your way in. Like, is it, is it the, yeah, the pregnancy outfit? Do you do the too many packages? Can you help me? Like you said, you take—

have you heard—

polite, you know, the crying always works. I Listen, you hit a good point. People generally want to be nice, right? And want to help each other. And those are scenarios, pregnant woman, almost everybody opens the door, right? You know, somebody's just frazzled and exhausted. Oh my God. I'm just late for a meeting and crying. Oh, let me help you. You know, there's somebody with too many packages or donuts, right? That's always good. Hey, I brought in donuts for the team. Oh, well, allow me. As long as I can have one. Sure you can. So I'm just picturing all that and going, yeah, that seems a lot easier than picking locks, I guess. Now I know people who like picking locks who would disagree, but, uh, exactly.

Yeah. There's a healthy debate on that too. But, you know, I've, I've, I've kind of done all of those scenarios of pregnancy belly is uncomfortable, which kind of gives you a preview of what an actual pregnancy is like, but you can hide tools in there as well, which is a big bonus. I hear, I use it as a pouch. I use it as a pouch because then I can just reach in and get any tools that I need because No one's going to start, you know, checking whether there's a real belly or not. So if some metal is protruding, it's a little weird, but you know, what are you going to ask a pregnant lady questions? So I've done that. I've done this super friendly route. I've done the new employee route. I'm so excited. Oh no, I'm here on the wrong day. You're kidding me. Well, can I at least take a look at my desk? Um, and so I've, I've resorted to very many, uh, less than kind ways to get my way. But, um, honestly, I think I would advise any aspiring social engineers is be wary of faking any medical emergencies.

They'll call an ambulance.

Diabetes insulin one was kind of iffy there for a moment, but crutches always work.

So crutches, yeah, another good one because you can't— yeah, help with the—

about your social engineering.

Crutches is a good one. So Anna's a professional liar and an actress. I gotcha. Good to know. So, Sean, I know he's just not saying as much.

I'm just mission dedicated.

Okay.

You can look at it how you want to look at it, but I don't say that negatives.

Those are awesome stories. I mean, that's all good in my opinion. You're making people better. That's the point, right? So there's nothing wrong with that. And you didn't say a bunch of things were off limits. Like, those seem like just, again, people want to help people.

And the opposite, the opposite of helping, like, it's the goal should never be or the outcome should never be like people on crutches are suddenly going to get less help or Anyone on crutches is, are inherently suspicious. I mean, there's, there's a second half of this where there are processes and protocols like, hey, let me hold the door for you. Awesome. You're in the lobby that everyone can come in. I still need to get the same badge or the same information. Like you can still be helpful and also talk to people and, and politely ask them questions. And so like good security isn't like yes, no, like you're either suspicious or you're not. It's. Hey, let me, like, it's half customer service, half security, and you're still helping the woman who's pregnant or the person that's pregnant. You're still helping the person with crutches. You're doing all of that, but you're still following protocol. And so it's just, it somehow lowers the bar for various people when something's slightly abnormal, let alone somewhat abnormal. And so being able to help your security officers have very simple SOPs that they still follow when these different situations pop up are essential. It's simplicity, like you said, in the adversary route. And I'll say on the security side, like simplicity for people that have to deal with a million scenarios a day, whether cyber or physical, is going to be key so they can follow the protocols and help the various types of people that you might come in. Sorry, I'm making things hard on myself. Harder for you, but that's good.

I love it.

I'm here for it. That's the goal. So yeah.

That's the goal. Yeah.

The second half too is making sure that they, yeah, you still have very effective security, helpful security, good customer service, but their goal, their job is to keep good, allow good people in and keep malicious people or adversaries, real or fake, out of the building.

This feels personal.

I'd take it personally, Ana, that he looked right at you when he said malicious people. For those who are only listening, That was quite a pointed look here. All the side-eye went to Anna on that one. So, one more question. How do organizations get and measure the value of red teaming, right? How do you decide to spend the money? How do you decide if it's working? Like, how are people measuring the value of your services? What kind of metrics are there? Like, how does that all work out?

Oh, that's a great question. I think one of the things that you have to keep in mind is that you're already spending the money. As an organization who tries to protect anything, you're already spending the money. What we are here to do is validate, refute, confirm, overturn that what you're spending your money on is actually what you should be spending money on. And as a little subset of that, that the measures you think are in place and performing a certain way are actually there, are actually performing the way that you think they're performing. And not only that, but also kind of orchestrated with the rest of your security systems. And so that's where, again, the red team is kind of set aside from the pen testing component of physical security assessments, right? Where it looks at the holistic setup. So it looks at everything within a system, and whether or not it's coordinated or kind of go for that Swiss cheese model. But you don't want to know, oh, the doors are working, or the turnstiles are working, but you can go around them, right? Like, if no one's thought about the question, if no one's thought to actually test them that way, and everyone just walks up with their badge and it works, then yes, the control is actually working. No qualms with the control. But if there's a planter on the other side of it and you can just easily you know, distract the receptionist or the guard over there and sneak past it, then are your, you know, tens or hundreds or millions of dollars of investment actually working the way that you think they are? And the answer is not always. And we're here to give you that answer in a way that's data-driven, a little bit more scientific, and differs dramatically from the vendor who sold you this control, right? And that's, not to talk bad about vendors, but they come from a specific level of expertise of that control. They don't necessarily have oversight of how it is integrated with the rest of your existing controls and how they work together, if at all.

And so that's a good point. I mean, something can work as designed and not be effective, right? Like you said, the turnstile, it works as designed, the badge works, the turnstile switches it, whatever. As far as a vendor, you'd say, hey, it works exactly how we said it would work. That needs a badge. Turns out won't move without a badge. Turns, you know, it reads the badge, it works. So it's, it's working exactly as designed. But as you just pointed out, if you can get around it, if there's a planter or whatever, it's not effective then. It's, it's working as designed, but it's not an effective security measure. And those are two different things. As a vendor selling the turnstile, it's not their, it's not their problem if you decide to put it in a place with a planter next to it and a guard that doesn't pay attention, you can get around it, right? They've done their job. They sold the tool and it does what they said it would do. It's your job, as it turns out in this case, to show that that's still not effective. Security measure unless you do these other things. So it's where it's supposed to be working properly, which is a really, really interesting point that I don't think a lot of people think about. I hadn't thought about it until you just said it.

Well, and that is the question that is the backbone of existence of teams like mine, right? We are there to— we are there to ask those questions and then push the buttons. Or as I've seen this guy do, slide under the turnstiles to see if they detect infrared at a certain level or anything else. Right. But if no one's testing it, Your audit team might get as close to it as, as you can think, and they'll come in with a checklist of certain things. And again, those things might very well be in place and be working as prescribed, but they're not the team that will note the gap or even know to look for it. And again, that's not audit team's fault or anyone else's fault. It's just that mindset that I'm gonna get in by any means necessary. And I just have a very different perspective. And that perspective informs the asking questions where others just nod their head and they're like, okay, access is protected because there is a turnstile that works well.

I want to see Sean slide under turnstiles.

So I'm going to pass that over to you.

I want to see Sean slide under turnstiles. I want to see some video of that. So what are your thoughts, Sean? I know metrics—

We can put it in show notes that, uh—

Yeah, I definitely want to see that one. I'm going to share that one out to people. Sean, what are your thoughts on metrics? I know you've been doing this a while and You know, you and I had breakfast and talked about this not long ago, and you said that you've, you've had an evolution in this thought process.

Yeah. So I originally just started with kind of a brute force, like a myopic, like the more vulnerabilities a red team can report, the better they are. And that may be true depending on the organization, but that falls solidly on the pen testing side. And it also is very zoomed in. So when I was helping pull together a first physical red team at a large, like a tech company, our metrics, which I thought at the time were, were evolved and, and they're still progressive compared to where I started. It was what changes, what positive changes and mitigations actually occur after the team goes out. And so that forces the red team to actually work, like have compelling reports, work with the blue team to fix things. Et cetera. And that's great for internal red teams. If you go back a year later and retest and all the vulnerabilities are gone and you have to find new ones, like, that is effective. And if you go back and nothing has changed, the company's wasting money red teaming because there's no action taken. And I say that as a red teamer. And, and more recently, and mostly through experience, honestly, like, there's 3 different categories that I would put the benefit in. Like, one is just risk discovery. So that's what I talked about, like a red team uses threat intel, they identify vulnerabilities and they look for the threats targeting your assets. So all those combine and you identify like the unknown unknown risks. It's one of the only teams to do that. There's shifts. The second one is shifts in perspective, which is just making better decisions, helping— it's kind of purple teaming, helping the blue team think differently. And then the third is kind of the one that I've really focused my time on, which is education and awareness. So gamifying security, like any team can technically do this. The red team, it just seems like the one that's often the most empowered to be hands-on in the field, figuring out like the various efforts that you can like demonstrate or teach security officers or typically like security managers or even the budget team. I talked about bringing out some of those folks, like bringing them out to actually see what vulnerabilities exist, how they can be exploited, the education component. And then if you want to teach everybody how to like have better security, we've built Where's Waldo programs where like, if you're a company that requires badge, it requires everyone to have a badge on and it needs to be a company badge and you can get yelled at if you don't have it. Swap out an employee's badge with a badge that just says Waldo with a photo of Waldo and send out a mass email that says, hey, an employee's walking around with this. If you identify them, let them know and they'll give you some free company swag. If you gamify it, suddenly everyone's looking for badges. If you, if you have sensitive prototypes, then you can't take pictures. Send someone in to take a bunch of pictures, like over the course of a couple days. Obviously, you're not trying to do any of the COVID stuff. And as soon as someone reports them or is like, hey, what are you doing here? Give them all sorts of swag and appreciation. And suddenly, slowly, that changes culture. People are suddenly excited, like, oh, hey, there's a red team that's out doing fun things, or even a blue team that's decided to go in the field. It doesn't need to be a red team to gamify security awareness. And suddenly, from what I've experienced, like, we'll be getting pings all the time. Like, hey, we just had an employee that, like, really wants to get the swag, and they saw someone jump the fence and run into the building. Was that you guys? And can you send them swag? I was like, no, that wasn't us. Please call the police. And maybe that's actually happened before, but maybe it changes culture. Like, people get excited when they're like, oh yeah, like, no one's going to think a real adversary is going to do stuff. But when they know the red teams out when they know there's this gamified kind of system for security awareness. Everyone wants fun swag or fun rewards. And so suddenly you see your suspicious activity reports, your employee engagement, looking at different things go up. And so that section of red teaming, it's just generally like awareness, education, etc. I've seen more return on investment for companies in that area than kind of the, the broader, the, the solely focusing on the risk, uh, identification. Um, but they all have their place. And if you do red team assessments, you get all three of them. So, um, it really depends what a company's looking for. But, um, metrics-wise and value-wise, to me, that where you get the bang for your buck is not only are you testing and identifying gaps, you're also increasing security just through the awareness component as well.

Yeah, I'm— the only thing I would add is that security— and this is going to sound straight off like a motivational poster of security department, but security is everyone's responsibility, but not everyone's trained to it. And so you can't expect non-security people to know security things and these, you know, suspicious indicators or like specific behaviors that maybe you and I have mastered, but not everyone who has a busy day, who's getting a thousand things done, would even know to keep an eye out for. And so this reduces your threat surface by, you know, whatever percentile, just because the entire demographic, all of your employees, all of a sudden are keeping an eye out for something, as opposed to just your security guards who You know, there's obviously limitations within the industry for that, right? But it's also just human. And this just gets more human eyes on things that other humans do that may or may not be for good. But either way, it's creating awareness. It's introducing certain trends that are more common than others. And it's also building an opportunity to have anyone have the right resources to address the situation that's a little bit out of norm in a friendly but firm way. And I think that's what's missing. Most people anyway are inherently conflict averse. They don't want to be like, hey, you have the welder badge, what are you doing here? Right? No one wants to kind of antagonize anyone else. But if you're like, friendly but know your protocols or know what to say or have a prompt or the next step. And sometimes it's as simple as literally knowing the number for the security department so they can send somebody. That's a really easy fix that you wouldn't even know to put in place if it wasn't this effort to kind of build the whole company's culture up. And so it's a simple but really engaging way to get everyone on the same page instead of just this very select demographic that is high in numbers, but it doesn't make all the difference, try as we might.

Well, I think, I mean, that's— I mean, I think the big point, right, you made it. It's, yeah, security is everybody's responsibility. We hear that all the time, but not everybody is trained, right? Not everybody's knowledgeable. Not everybody thinks about this the same way inherently. Even if you go to your annual training, you check the boxes and nobody pays attention. Let's be honest, right? That doesn't sink in then. And then they go back to their job, and if their job is, you know, they're the receptionist or they're in accounting or they're the loading dock or whatever it is, right? They're doing what they do every day. They're very, very good at their job. This isn't ingrained. This isn't a culture, as you guys have said a couple times about, you know, creating this culture of security. And I love the idea of, you know, the gamification and making it a positive and, and making people excited about it, right? They, they want this to happen. They want to participate in it. It's not a bad thing. It's— everybody gets to be better and You pick up some swag or I don't know, lunch or whatever the hell they're giving away for these things, but whatever makes people happy and excited. So I think, but I think you really hit it on the, you know, security is everybody's responsibility is easy to say, but you really gotta build that culture where it's everybody's thought process too. Or, you know, it's just, it's just words, right? I mean, you could say it's everybody's responsibility, but that's unfair if you're only gonna follow up with these, you know, weak annual trainings that people check through. It's the same thing every year and they don't really pay attention and then they go back to their jobs. So, all right, listen, we got to close out the show. Everybody knows at this point, right? This is my favorite part. I'm not gonna lie. The name of the show is Unspoken Security. So with that in mind, you got to tell me something you never told anybody, something that's been unspoken to this point. Now, I got two of you today, which is gonna make extra fun for me. So I was gonna pick on Ana first, but because you just finished that last question, you get a minute to see what Sean's gonna reveal, because I'm curious if you've even told each other these things. So Sean, Tell everybody listening, all of America and the world, we are around the world, millions of people. No, I wish that was true, but it's not true yet. It's not true yet. But anyway, the 8 people that listen to the show, tell them something unspoken, right?

Yeah. So I started my red teaming, hacking, whatever you want to call it, career I was thinking I was a little journalist and this is when I was young and when cell phones were, you pulled the antenna out and everything and suddenly there was new cell phones that maybe had a little screen on the outside and you didn't have to pull the antenna out. And I thought that technology was so cool. And the first one that had a camera, I hacked it so it could take like 6 pictures a second and suddenly you had like 4-second videos you could take. And publish that. And so like, I got very into phones for many years of my nerdy young life. And I started publishing and publishing like, hey, here's the new tech that's coming out. And I would gather all the different little pieces from the internet. And eventually I found my way into systems and employee portals that maybe I shouldn't have been in. And so I was thinking I was just being a really good young journalist publishing this exciting information about this brand new phone technology. Like Google was considering coming out with some type of operating system. And I, I was one of the first to publish on that because I read about it somewhere internally. And, and many years later I look back and I was like, nah, I was, I was just hacking into shit I shouldn't have been in.

And, and you were committing felonies is what you were doing.

Yeah.

You were, you You were stealing IP and releasing it to the world. That's well done, Sean. Good work. Yeah.

So it was all Ed, Ed was, yeah, all hunky dory till one of the big companies' digital forensics teams showed up at my doorstep and told me to stop, which I did. And, uh, so that's, that's where we are today. We're, we're not getting into the rest of the story. All, all good.

I'm sure the statute of limitations has run out on all this. Don't worry if anybody's listening and has a badge, just leave them alone. It's long ago now and he's a good guy. But yes, so yeah, as a kid you were accidentally breaking in and stealing IP and sharing it with the world. That's a good job. Well done, Sean.

I just, I was young, dumb, and I loved Bones.

Listen, it's a great story. I mean, what are you gonna do? You were a hacker and you were doing stuff and you did it innocently, which a lot of people have. People got in trouble for things that they didn't intend to break the law or they didn't think about it in that way, right? And I mean, that's the mindset, right? You were into something, it was your passion, you were geeky about it, and it didn't occur to you that you were crossing lines. Like, that's cool, probably set you up for your career now, as long as you stay out of pinstripes.

Couldn't agree. I definitely peaked in my hacking decades ago, so.

Oh, that's okay. I doubt that's true. I doubt that's true.

You got street creds.

Yeah, yeah, starts and ends, but yeah.

All right, Anna, what's your secret? Nobody's heard this before, including Sean, from what I understand.

Including Sean. It's far less exciting, so I kind of wish I had gone first, but for those 8 listeners that have stuck around this far, I just want to thank you for being here on this nerd journey. I love it. I say it lovingly. People have taken offense, but you know, we are one. So my story goes way back in the days of the Soviet Union, but I, you know, I'm a program builder and I'm a program manager, but What people don't know, including present company, is that my first project that I ran was staging a riot in 7th grade where my favorite teacher—

This is awesome. I don't know why you thought this wasn't better than Sean's. It's clearly better than Sean's already. You staged a riot. And where were you at this time? I want you to finish the story, but I want people to know, because I, I know where you grew up.

Where—

Yeah, I— I was born and raised in Republic of Georgia in the, the shambling aftermath of the Soviet Union falling apart. And so, you know, there was civil war and unrest and military coup this week and a civil coup the following. And so there was a lot of unrest and we kind of, before we started recording, I know we joked about some acquired trauma, but my favorite teacher had left and I found this unfair because I didn't have a lot to hold on to. And so I just, I remember distinctly making posters and recruiting people to participate and I got into a lot of trouble. And so that just refined my tactics for the future, but I'm gonna just leave it at that cuz that was my first more or less security-related project that I ran.

But you staged a riot in the former Soviet Republic of Georgia.

It was like a weekly occurrence.

It's really not that big of a deal, but how, how big of a riot was this?

It was, no, actually it started with like 20-some people, but it got very quickly out of control. And my mom did have some choice words for me after she spent some time at the principal's office. And yeah, I learned my lesson, but I don't know if that's the moral that they wanted me to take away from it.

Better ops sec, right?

Yeah, better ops sec, better backstopping, you know, kind of. Remove myself as the leader of the movement.

But yeah, but you knew how to motivate people apparently to a cause and, and how to appeal to their emotions, which I'm sure still plays in your favor now.

And I've just always, you know, I've always advocated for education. That's what I can say.

There you go. That's right. It was, it was all about education. It was all for the children. Like, just say it's for the children. People love that stuff.

This is a fresh take. This is a routine perspective on the right side of the law.

Who said?

Yeah. You know, this explains my career so much, right? It's just like, okay, I've always been teetering on that edge and the dark side pulls me over every once in a while, but at least I've made a career out of it.

Yeah. I mean, listen, there's a lot of hacker stories like that. That's just how it works, right? That's the mindset is hackers, whether they're red team, whether they're blue team, whether they're, you know, white hat, black hat, whatever it might be, however people want to label them, there's a mentality there. You know, it's about doing things that are a little outside of the boundaries and trying to, you know, See how far you can go. Listen, I'm notorious for you, any sporting event, any major venue. I like to go through the doors that say employees only, you know, the back. I, I'm, I've been known for, I'll do it at movie theaters too. I've been known to do it. I used to work in a stadium. I worked at the Metro, the old Metrodome. I, I worked there. So I got used to all the ins and outs of stadiums and I realized just most of those doors you can just walk right through. And so I've done it. I've escaped out of, I didn't feel like walking the whole mall. I was like, I'm just gonna go out this area and kind of walk through about like an employee area and. Sometimes it works out well, sometimes it doesn't. Last time I was in Vegas, I made the mistake of going the wrong direction out of a casino on a back door, and I didn't feel like wasting time, and I ended up in a, like, trapped in a fricking alley. I didn't know where the hell I was, and the Uber couldn't find me. It was a nightmare scenario. So a lot of people in this industry just do that. Like, they, they break rules and go different directions, not out of malice, but just outta curiosity. And you know, hey, where does this go? What can we do here? What's the worst thing gonna happen? You know, somebody gets you, oh, I got lost. I didn't mean to, you know. Now I'm old enough and I got a few gray hairs. I can actually pretend to just like, you see now, I suppose, but oh, I was looking for the bathroom, you know, I had, you know, whatever. You can make up a story, right? And most security guys be like, I'll just walk you back where you're supposed to go. It's not like I'm showing up in the locker room and, you know, getting autographs. So everybody's got one of those, man. And I think your story's a hell of a lot better than mine. And despite what you think on, I think your story's a hell of a lot better than Sean's. So like, they're both really cool stories. So listen, I want to thank you guys. I can't thank you enough for being on the show. You know, it's, you guys do amazing work. I think it's, it's what you guys do is really interesting stuff. You know, most people are envious of the career you guys have, myself included. Like breaking into places for a living is pretty freaking cool. Before I, you know, before we close it out, just, you know, I can give you all the thank yous, but is there anything you wanna say? Do you wanna plug your company at all? The people, where can they find you? Like you totally can do that. I wanna make sure you guys, you know, people know you guys are awesome now. So how do they hire you? You know, who are you? You know, where can they find you? And then, then I'll just close out the show and be done.

Awesome. We're both incredibly passionate about red teaming, and so if you're an aspiring red teamer, a company that wants to build your own internal one, a cyber team that wants to do physical, or any, anything in between, and you just want to chat, you can email either of us. You can just do info@pinerisk.com. Where we try to publish and open source, and if you want a red teaming template, like we're We're not in it, like we're, we're in it to professionalize red teaming. We want more people doing it. Doesn't mean we're, we're out doing it. We'll send templates and we'll support you as much as we possibly can. So feel free to reach out. We're happy to, to help. I'm happy to talk to anyone earlier in their career. And yeah, that's it. Thank you very much, AJ, for having us. I really appreciate it.

I will just add a quick caveat that if there is someone who'd like me to drop on a building out of a helicopter, I'm here for it. And that's, I'm not at Pine Risk. And I'm available for that anytime. So just, you know, we're here to solve problems and have chats like this. And thank you for having us. It was great telling you these stories and our experience.

So, oh, totally. I'll have you guys back. You can tell all sorts of war stories. So I noticed that Sean's at info@pinerisk.com, very corporate. Ana wants to get dropped out of airplanes. So hers is just ana@pinerisk.com. I know Sean is actually also sean@pinerisk.com, by the way.

I get motion sickness. I'm not going to do the helicopter thing, but I'll be, I'll be there.

I, I, I, I'll tell you guys, like, I think you guys, if, if anybody doesn't know who's listening, look 'em up on LinkedIn. Pine Risk, uh, is pretty awesome and these guys are great and you'll see the rest of their resumes and all the things they've done. You know, I, I highly recommend, you know, working with 'em cause they're just cool people. So again, I just wanna thank you guys one last time for coming on the show. Really appreciate it. Everybody who's been listening and watching, thank you as well. You know, do all the things to, to help us, you know, likes and, and reviews and downloads and, and, and all the, I don't know, click all the buttons and do all the things, right? Uh, just just keep, keep doing this and, and give the feedback, right? You don't like shit, let me know. You do like it, let me know. You got people you think you want on the show, you want to get rid of me and get me off the show, let me know. Just, you know, whatever it is, just reach out. You can find me on LinkedIn, you can find me through ZeroFox at, you know, aj@zerofox.com. You can DDoS me if you want, I don't care. So anyway, again, appreciate your time, appreciate everybody listening and watching. Uh, until next time, you know, that, that's it for this episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security, brought to you by ZeroFox, the only unified external cybersecurity platform. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.