Covert IT Security

Deke George makes his living by hacking into computer systems. The systems belong to banks, retailers, police departments, colleges, hospitals, nuclear power plants—you name it.

Sometimes he and his cohorts attack from a remote computer, probing for weaknesses they can exploit to break in and do mischief to a network or a database. Sometimes they actually con their way into the victim’s building to see if they can get to its servers. The best way to do that, George has learned, is to “carry a clipboard and wear a shirt with your name on it. Everyone trusts those guys.”

He runs no risk of going to jail for any of this. The target organizations are his clients, and they pay him to do it. George is the CEO of Minneapolis computer-security company NetSPI. One of the services NetSPI provides is “penetration testing.” This is a type of security assessment in which a penetration tester attempts to penetrate whatever defenses a Web site or a computer system might have in order to demonstrate whether and how a client’s nightmares could come true.

Those nightmares might involve the theft of customers’ credit card data, felonious access to bank accounts, or the loss of trade secrets and other intellectual property. That’s not to mention the insertion of crippling viruses, or stealthy “bots”—software that use an organization’s computers to launch spam blitzes against other systems.

The penetration tester’s job is not just to evaluate IT security policies or assess vulnerabilities on paper, but to see how well the defenses hold up against realistic attacks. Good penetration testers, therefore, are people with the skills and instincts of outlaw hackers—for better or worse, the romantic heroes of techie culture—who work on the side of the angels, as if they were retired international jewel thieves consulting to Interpol.

“From a glamour perspective, it’s the coolest job in IT,” says penetration tester David Bonvillain, head of assessment practices for Accuvant, Inc., a Denver-based computer-security company with an office in Bloomington. “We have a lot of applicants.”