YT YouTube2Text

YouTube2Text → Transcripts → Всё об информационной безопасности | Кибербезопасность | DevOps, CI/CD | Хакеры | Алексей Федулаев

Всё об информационной безопасности | Кибербезопасность | DevOps, CI/CD | Хакеры | Алексей Федулаев — Transcript

by КодАвтоматизации · 17,336 words · 2,817 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00What is information security?
0:02Essentially, it's a state, a property
0:04of information where it is kept secure.
0:06They work with VPNs too, that program
0:08is banned. Yeah. So, in short, this one
0:11.
0:11Comrade Major, not on this podcast.
0:13So, in the end, how are they hacking
0:15things these days?
0:16DDoS, phishing, misconfigurations.
0:19Tell me, who are the Ops? The
0:21Ops are, essentially, exploitation.
0:24It's unlikely a hacker would think it's
0:25that easy. manuals, for example, from
0:28one of the groups, and it describes how
0:30to hack it,
0:32how to protect your site if it's, say,
0:34on WordPress, on Bitrix.
0:36I heard a story about WordPress from
0:38back in my youth, that it's a very
0:40buggy, bad thing.
0:43Hello everyone, you are on the
0:44Kodmatization channel. My name is
0:46Alexander. Today I have information
0:48security expert Alexey Fedulaev as my
0:50guest. Hi, Alexey.
0:51Hi.
0:52Thanks for coming. Thank you so much
0:53for inviting me.
0:54Currently, Alexey leads the cloud
0:57security department at MTS Web Services
0:59. Previously, Alexey headed the
1:01information security department at WBR.
1:04Alexey is also a frequent speaker at
1:06various conferences dedicated to
1:07information security. In this podcast,
1:10we will learn what information security
1:12is, which companies need it, who a
1:14DevSecOps is, and why this is currently
1:17the highest-paid profession in IT. On
1:20that note, let's move on to our guest.
1:22Alexey, first question. Tell us, how
1:25did you get into information security?
1:28That's a long story. Actually, as a
1:30child, I probably wanted to become a
1:32doctor, but I was absolutely terrible
1:34at humanities. I didn't understand them
1:35and didn't like all those
1:37history, social studies things. You
1:39know, you look at them. But I was good
1:41at chemistry, biology, math, physics,
1:43basically more exact sciences. I
1:45studied in a grammar school, in a
1:47chemistry-biology class. But then at
1:49some point I realized that I didn't
1:51want to work as a doctor, because I
1:53also don't like working with people.
1:55Yeah. I mean, I imagined myself sitting
1:58there as a doctor, and people pestering
2:01you, saying something happened, I don't
2:03know, my kid sneezed green. Sitting
2:05there in the doctor's seat, I realized
2:07that in a few years I absolutely
2:09wouldn't want to be disappointed in my
2:10profession. And in the ninth grade, I
2:13had an uncle who worked in security. I
2:16was like, what do I need to do? He said
2:19, "There's an information security
2:21department, apply there." After school,
2:23I only applied there. There was
2:26information security for
2:27telecommunication systems and
2:29information security for automated
2:31systems. So I applied to both, got into
2:33both, chose the one that required a
2:35higher score for admission, and went to
2:37study there. Yeah. But overall, my
2:40introduction to security, as such,
2:42probably started earlier, when I got a
2:44computer in the fifth grade; I loved to
2:46play games, and, naturally, my parents
2:49didn't really like me spending so much
2:51time on the computer. I mean, at first,
2:53there were various Windows passwords
2:55that I learned how to bypass. For BIOS
2:58passwords, I learned to take out the
3:00battery and reset them. At that time,
3:02every evening was like an Oscar
3:04performance; my dad would come home,
3:06and I’d be like, "Dad, turn on the
3:07computer, I want to play." He’d be
3:09like, "Whoop, no password." He’d go,
3:11"Where’s the password?" And I’d say
3:13, "Oh, was there a password?" Well, I
3:15didn't know, I really didn't. I would
3:16have played all day. Of course, I
3:18played all day. Then there were various
3:20antics, like the neighbor would
3:22sometimes pull the cables out, so I
3:24learned how to plug everything back in
3:25correctly. I had a spare power cord for
3:28the computer. And it just went on from
3:29there. And, I suppose, the real
3:31foundation—that is, the spark of
3:34curiosity—was already there. A friend
3:37and I were really into different phones
3:39. Back then, I think I had an HTC HD2
3:41on Windows Mobile. Such an old phone.
3:44We reflashed it to Android 4.0. I was
3:46probably about in my first year of
3:48university. HTTPS really wasn't a thing
3:50back then. You'd walk into any cafe, a
3:53McDonald's, connect to a public access
3:55point, grab any user's session—I
3:57don't know—on VKontakte, log in,
3:59paste the session, get onto their
4:01profile, set a picture of Dzhigurda as
4:04their avatar, write something funny in
4:06their status; essentially, you owned
4:08the account. Well, naturally, these
4:11amusements grew and grew, especially as
4:13our programming skills improved. Then I
4:17installed Windows Phone 7 on that same
4:19phone. And surprisingly, the memory was
4:22enough. That took some serious trickery
4:24. In my first year, I bought an iPhone
4:273GS. I’m from Penza, I suppose. In
4:29Penza, I was one of the first to have
4:31an iPhone 3GS. It came locked to
4:33Verizon, which, of course, I had no
4:34idea about. Basically, I spent.
4:36And what is Verizon?
4:38Verizon is an American carrier. Meaning
4:40, you buy a SIM card and a plan from
4:42them, and, well, with some...
4:43It won't work with Russian SIM cards.
4:45Yes.
4:46Yes. Yes. So it wouldn't work with
4:48Russian SIM cards. I spent a fair
4:50amount of time on forums trying to hack
4:52that phone. I had to switch to iPad
4:57firmware just to get it to work somehow
4:59. The network. And later, by the way, I
5:01sold it for more than, uh-huh.
5:03than I bought it for. And the same way,
5:05I don't know, a friend of mine had,
5:06I think it was a Galaxy S3 or something
5:09. We were also learning from some
5:11guides on the internet, where the
5:12chance of bricking it was 50%. To root
5:16it. The first time, by the way, we
5:19messed up. I don't know, it was like
5:222009 or maybe 2008, I guess. I don't
5:25know where in Penza we found a guy who
5:27re-flashed the phone's EEPROM, but we
5:29had messed up the bootloader, and he
5:31restored it for us. And only then did
5:34we manage to root Android, and
5:35everything took off from there. Well,
5:38and somehow it all just started growing
5:40from there. I mean, I wanted a Mac, of
5:42course, but my parents gave me a Dell
5:45for my studies.
5:46So why specifically iPhone and Mac back
5:48then? What was it? It was somehow,
5:50I don't know, maybe some kind of
5:52aesthetic. It was probably more about
5:54curiosity, just interest. Like, I had
5:56tried Linux and thought, "Oh, Mac, I
5:59haven't tried Mac yet." And Apple
6:02hardware was expensive. Back then, the
6:04iPhone wasn't, you know...
6:06The 3GS, how much? It cost me 13.5 [
6:09thousand].
6:10From Canada or America, wherever it was
6:12, including shipping. So, yeah, that
6:14was a lot of money. The next iPhone I
6:16bought, the fourth one, I got with my
6:18salary and it cost about 20 thousand. I
6:20think I spent almost my entire salary
6:22on it, and I had been given this Dell
6:24laptop. I decided to turn it into a
6:26Hackintosh. So I went back to the
6:28forums, guides, and all that stuff.
6:30Like my favorite jokes about Linux, the
6:32network and sound didn't work. There
6:35wasn't any clear way, at least not to
6:38me back then, to build drivers, but you
6:40could pull drivers from Linux,
6:42repackage them as kexts for Mac, and
6:44through trial and error, try to get the
6:46network working. I got it running, or
6:48rather partially got the sound card
6:50running, but I had to try a bunch of
6:52Linux distributions, pull the drivers
6:54out of them, repackage them, and make
6:56something work. And somewhere around my
6:59second year of university, I had
7:00already hacked my second iPad and got
7:02into programming. I mean, I had GC
7:04right there on my iPad. Everything else
7:07was just like, man, how? I mean, I’d
7:09come in and turn in lab assignments
7:10already on the iPad. And this
7:13constantly changing interest, like
7:15wanting to poke around in this or that,
7:17it really drew me in. The atmosphere of
7:21those years also contributed to that. I
7:23mean, there were books by Kris
7:25Kaspersky—not to be confused with
7:27Kaspersky.
7:28Yeah. He was a really cool reverser; I
7:31learned a lot of interesting things
7:33from him back then. Well, there were
7:36various sites, I think they still exist
7:38now. They’re called VX Underground
7:40now, but back then they were called VX
7:42Heaven. It was guys who collected
7:43malware samples; I don’t remember or
7:45know if it was in my first or second
7:47year that I wrote a polymorphic
7:49generator in Assembly, which I learned
7:51from the viruses of those years that
7:53I’d seen on those sites. It basically
7:55just split the code into chunks and
7:57inserted random garbage instructions.
7:59Every time I re-generated it, I ended
8:01up with different code. I mean, it
8:03wasn't based on size or some, let's say
8:06,
8:06What were you writing in back then?
8:07Assembler, C.
8:09And was it already
8:10Did you learn it on your own? Ah, well,
8:12in school we had something like a
8:14little kangaroo, I guess, since it was
8:16a gymnasium, where it would jump around
8:18and draw with its tail. But in reality,
8:21it was probably Pascal, Visual Basic.
8:24And what added to the interest was when
8:26they showed me that you could actually
8:28do something cool with programming—
8:29not just adding numbers, but doing
8:31mischief. That was fun, especially back
8:34in the Windows 98 days; you could
8:36control elements, I mean, you could
8:38You shouldn’t show a school kid that
8:40they can be mischievous. I mean, you
8:41could move the mouse toward the Start
8:43button and it would just run away from
8:45you. That was very entertaining or
8:48funny. At my first job, we had a lot of
8:54fun; we played Battlefield and, you
8:56know, Warcraft, the first DotA, and
8:59Sasha Ivanov, my classmate, worked
9:01there with me. We wrote a program, gave
9:06it a Warcraft icon, and it would have a
9:09naked girl pop up in the startup, but
9:11we decided not to be that harsh. And
9:13when new guys came to work, they’d be
9:15like, "Oh, you guys play Warcraft?"
9:17We’d say, "Yeah, where can I get it?"
9:19We’d say, "Oh, go over there, there's
9:21a server." He goes there, sees the
9:23Warcraft icon, it says Warcraft,
9:25he downloads it and runs it. And we’d
9:27all be like, "Hey, what are you doing
9:29here at work?" It was, well, pretty
9:31funny. Yeah. And then it just kept
9:34growing, you know, trying to tease
9:36someone, do something. At some point, I
9:39figured out how to defend myself. Well,
9:41in my freshman year, I studied it quite
9:44deeply and started learning C ++. In
9:47that same first year, I already got a
9:49job. They didn't hire me for security
9:52as a freshman because I didn't know
9:54much about it, but I got a job as a
9:56backend developer in PHP. So I was
9:59already coding, and, well, PHP is
10:01actually very similar. Then from there,
10:05I moved on to Perl, one of those
10:07languages from back then; it's also a
10:09C-style language, I’d call it. And by
10:12my second year, I came to work in
10:14information security.
10:15Uh-huh.
10:16So, a real job, and I kept diving
10:18deeper into it there.
10:19A few little notes. Yeah. It's cool
10:21that you wanted to become a doctor.
10:25That’s an interesting thought, too; I
10:27had a colleague, she also worked as a
10:29doctor, and she said, "I wanted to be a
10:31doctor, it was my dream." And this
10:38profession sort of shook her faith in
10:40people, and she finds it hard to work
10:42with them now, so she became a content
10:44manager just to avoid dealing with
10:46people at all. Yeah. Because all sorts
10:52of people come in, some in a good mood,
10:54some not so much. And you said you
10:56didn't want to work with people, you
10:58basically set that up for your future.
11:00She had to go through the experience of
11:02working as a doctor, while you just
11:04said, "No, I'm like...""Well, I think I
11:06never really liked hospitals, I saw the
11:08kind of interactions that happen there.
11:11" No, actually, I was very wrong back
11:13then. I thought if I went into security
11:15, I wouldn't have to work with people.
11:18That was a mistake. It's also great
11:24that you had so much energy and
11:26channeled it into something more
11:28interesting instead of just breaking
11:30things or causing trouble; you were
11:32more into studying interesting stuff,
11:34like jailbreaking an iPhone. That's
11:41also cool, because I’ve seen so much
11:43news about kids breaking things and
11:45then ending up in trouble.
11:48In that phrasing, that might not be
11:50entirely true. I broke things, I broke
11:53a lot, and most of my learning was
11:54exactly for the purpose of breaking
11:56things. Right, Officer, not on this
12:00podcast. Well, uh, it was more, not so
12:04much to cause any, you know, harm, but
12:07more of a show-off.
12:11To brag among my friends, look at what
12:13I can do; all of that started breaking
12:15people quite a bit at some point, but I
12:17probably wasn't quite ready for it. I
12:22mean, the realization of how people
12:23behave in front of you and what they
12:25actually think, that really threw me
12:27off at that moment.
12:29Actually, your path is really
12:31interesting, because I've watched many
12:33of your interviews and podcasts, and
12:35you usually speak as an expert, and how
12:37you came to information security. It
12:39really is such an interesting path, and
12:41you have a huge background. It's not
12:43just "I'm an info-sec guy," you've done
12:45so many different things. And it's
12:48interesting, I'm glad you told this
12:50story, because usually you're the one
12:52asking everyone everything, or you only
12:54talk about work, and it's not always
12:56clear to me. Well, because I don't have
12:59as much knowledge as Alexei. Here's my
13:01next question. What kind of project
13:04from your work or activities blew your
13:06mind? What really made your head spin?
13:09Yeah, there were probably a few
13:11projects like that. The most
13:13interesting one, I think, was when I
13:15was already working in Moscow, working
13:17at the Open Mobile Platform on
13:19information security, helping to
13:21certify the Aurora operating system—
13:23there is such a thing.
13:25I know.
13:26The Russian one.
13:27And at some point, the guys from
13:28Kaspersky Lab reached out to me. I was
13:30like, "Damn, I don't know, things are
13:32going so well at this job, I like
13:34everything, I'm having a good time." A
13:35recruiter contacted me and then
13:37disappeared for a month. Then he came
13:38back a month later and was like, "Well,
13:40let's do the interview." I was like, "
13:41Well, okay, sure, I'll come." And I
13:44came. And there were, I think Katya
13:46Rudin was there, Maxim Yudin was still
13:49at PHDays then, and some other guys.
13:51And they crushed me so hard on
13:53information security that I was like, "
13:56Damn, what, how?""And how big is the
13:58gap in our understanding?" And I was
14:01like, "That's it, I'm coming to take
14:03your knowledge." And they had a project
14:06for Kaspersky products that was "Secure
14:08by Design," meaning that if you have
14:10competent, well, this constructive
14:12security or Secure by Design, it allows
14:14you to protect against even unknown
14:17vulnerabilities. And at the moment they
14:19explained that to me, I was like, "Wait
14:20, what, how is that possible?" They
14:22were like, "Well, come on over, we'll
14:24show you an implementation, like, we've
14:26got Spectre." Back then, the Spectre
14:28vulnerabilities had just come out,
14:30which allowed, um, manipulating the
14:32processor's speculative execution. That
14:34is, the processor doesn't execute
14:36instructions sequentially; while it's
14:38waiting for something, it starts
14:40executing them ahead of time. I mean,
14:42it calculates different branches and
14:44then picks the right one. And from
14:46those calculated branches, you could
14:48pull something out, for example, try to
14:50get access to a protected memory
14:52segment and extract information from
14:54there before the processor realizes
14:56that something went wrong. And they
14:59were like, "Come by, we'll show you." I
15:01was like, "Alright," went there, and
15:03yeah, they really did show me. "Cool."
15:06Well, it worked partially, but it
15:08didn't have that much of an impact. And
15:11I was like, "Wow,
15:12were you impressed?"
15:13Yeah. That's awesome. You said, "I'll
15:15come and take your knowledge." That's
15:18exactly what I've said too, you should
15:20always go for the experience, not the
15:22money. Later, you'll be able to sell
15:24that experience for more.
15:25Oh, yeah, yeah, I was like, "I'll come
15:27and take your knowledge." Usually, I
15:30think it goes hand-in-hand anyway. I
15:34mean, you probably shouldn't just chase
15:36the money. And sometimes, you have to
15:39make a difficult choice. Sometimes they
15:42offer you more somewhere, but there are
15:46other factors, I don't know, the team,
15:48the vibe in the team. I won't get into
15:50those internet jokes about being a "
15:52friendly family," but all things being
15:54equal, compared to sitting around with
15:56one and a half coworkers doing
15:57something. It's a different story when
16:00you have a large, motivated team where
16:03a year of work will give you a much
16:05bigger boost in terms of actual
16:06experience, because many people confuse
16:09them; tenure doesn't equal experience.
16:13You could spend 10 years just warming a
16:15chair, or you could spend a year
16:17working with guys like that, learn a
16:18lot, share knowledge with each other,
16:20and you'll come out a specialist at a
16:22completely different level. That's why
16:26a year in one company and a year in
16:28another company are not equal.
16:30And, in fact, it was the same way here.
16:33I came, there was a lot of interesting
16:35stuff, and I learned a lot.
16:37Like that meme about companies, too. "
16:39We're a family," though a dysfunctional
16:41one, but a family nonetheless. So, what
16:43project really inspires you? What
16:46project are you most proud of? What
16:48have you done to really help someone?
16:50Well, probably one of my educational
16:52projects. I have many, they probably
16:57have a certain entry threshold now, but
17:00I have a lot of security materials
17:02collected in one place, because when I
17:04was learning all this, there were no
17:06books, and certainly no courses. Yeah.
17:13So, I had to piece it all together bit
17:16by bit and practice. Now I have it all
17:18gathered in one place. Plus, I’m
17:22working hard right now on educational
17:24activities, specifically bringing the
17:26value of security to the masses.
17:30So, you’re proud that you provide
17:32information to people,
17:33right?
17:34But there is a lot of your information
17:36online. That’s true, no argument
17:38there. You know, there’s a bit of—
17:40you mentioned that you used to learn
17:41everything yourself. I also gathered a
17:43lot of information myself when I
17:45started web development, but now
17:47there’s so much, you don’t even
17:49know where to go or what to study. Take
17:51security, for example. The problem
17:54isn't even that there’s too much.
17:56There’s a lot of fluff, a lot of
17:58repetition. If you used to go in, read
18:01something, poke around—like you’d
18:03read a thousand pages and, if you were
18:05lucky, only two were useful. That’s
18:10why there’s so much, like in my
18:12favorite meme, you know, the scuba
18:14diver underwater with two buckets of
18:16water. When you try to get rid of some
18:19of the water, it turns out it’s all
18:20water and there’s very little
18:22that’s actually useful. Although the
18:24trend has been changing lately. I see a
18:27lot of guys who are also doing it; they
18:29were always there, they’ve just
18:31started connecting more online. I mean,
18:36there are channels, lots of research,
18:38various PoCs—proof of concept—
18:41demonstrating how a vulnerability works
18:43. There are all kinds of niche chats
18:48and everything else. Back in Penza in
18:512009, there wasn’t that kind of
18:53community. In Moscow, it was probably
18:55just starting to emerge. Things like
18:57hackathons, DefCon, some CTFs. In my
19:00youth, I didn’t even know what that
19:02was. And now, interns come to work for
19:05me who have already played CTFs and
19:07already understand how to hack. It's
19:10cool that they are developing in such a
19:12community.
19:12Uh-huh. Cool. I have another question,
19:15a bit off-topic for the podcast, but
19:17still interesting. When did you make
19:19your first million and what did it feel
19:21like?
19:23Man, that was so many years ago.
19:25Wow, so many years ago you were already
19:27making millions. Well, I mean, a
19:29million a month or
19:30Well, yeah, yeah, a million. There.
19:32And a million per month exactly. No,
19:34well okay, back then it was
19:36like that. You did something, and it
19:37just came to you right away. Did that
19:39happen,
19:39right? I had my own company, we grew, I
19:43started alone, well, in parallel, I
19:45mean, with my main job. And we found
19:50some interesting, let's say, orders.
19:53The first month or six weeks was
19:54absolute hell, because I was carrying
19:57it all alone. I mean, I'd go to work,
20:00come home, sit there until night, doing
20:02the typical Russian entrepreneur, sole
20:05proprietorship, doing a second job, and
20:07it just kept repeating over and over
20:09until my friend joined me. And I think
20:14when we started doing things together,
20:16I finally caught my breath, after
20:18probably a month or six weeks of that
20:20non-stop work, and we started scaling
20:22and bringing on more people. I think at
20:25some point there were about 10 people.
20:28So, in principle, we had decent
20:30contracts, and, yes, million-ruble
20:33turnovers, but it all ended after 2014.
20:36I mean, 2014 hit, and these firms
20:38really took a dive because, for example
20:41, if an order, well, a contract was
20:43made before 2014 and the amount was
20:46fixed, after 2014, when equipment
20:48prices doubled, well, that was just
20:50your problem. And, naturally, that
20:53maintenance part we were handling, well
20:55, it was one of the first things to get
20:57the axe. So, I think we finished our
20:59projects in 2015 and that was that.
21:03What were the feelings, or how was it?
21:05The feelings were great. I, well, the
21:07first thing I bought for myself was
21:11a proper MacBook,
21:12to work with. I already had a MacBook
21:14before, I think I bought one of those
21:1611-inch ones back in my third or fourth
21:17year. They used to have those tiny,
21:19tiny ones. But this time, I got one for
21:22work so I could sit and work anywhere.
21:25I got a MacBook Air, one of the first
21:27ones. Well, I had been living away from
21:30my parents for a long time by then. I
21:33was slowly renovating my apartment. I
21:35bought the car later, by the way, that
21:37was probably what year, maybe 2014 or
21:392015, somewhere around there. That's
21:42how it is.
21:42Cool. Listen, you talk a lot about
21:44MacBooks and iPhones. I'm a fan of
21:46Apple tech myself. Is it true that it's
21:48secure? It is safer, on a MacBook, well
21:52, personally I've never had a virus.
21:54And they say there are really no
21:56viruses, that everything is maximally
21:58protected, or is it just a marketing
22:00ploy? Well, I understand that if you
22:02have a goal to do it, you will. But
22:04purely for the consumer,
22:05it's not quite like that. If you look
22:09at the prevalence of Apple tech,
22:11especially back then, I mean, today you
22:13come to work and they give you a
22:15MacBook, and basically anyone can buy
22:17an iPhone. Back then, maybe why, well,
22:20I was young and it was that it sort of
22:22made you stand out, right? I mean, you
22:25had one phone with some kind of rooted
22:27Android, and the other was
22:29like a laptop that people just couldn't
22:31afford. And since Apple tech was much
22:35less common, it was less often a target
22:37for such things, but there were viruses
22:39. There were slightly different tricks,
22:43like you could put an executable file
22:45that looked like an image, and people
22:47would click on it because Mac didn't
22:49show the extension, I think—it does
22:51show it now, I believe. Well, it was
22:54hidden by default. There were other
22:58tricks, and Windows was just inherently
23:01more widespread.
23:02It was generally much more widespread.
23:04Now we see the mass adoption of Linux.
23:07There's a bunch of stuff for Linux.
23:09Back then, too, I think there was
23:11plenty of stuff you could read on how
23:13to create rootkits, how to load kernel
23:15modules, and all the rest. And in
23:18principle, macOS is a Unix-like system,
23:21and all those rules apply there too. So
23:24it's not safer? People say the same
23:26about the iPhone, that it's harder to
23:28hack than an Android phone.
23:30No, and well, actually, Apple cares
23:32more about security, in my opinion. I
23:35don't like Google as a company, and I
23:37don't like Android, it's an evil
23:39corporation. It is an evil corporation.
23:41There you go. And Apple is just the
23:43same kind of evil corporation. I can
23:45already foresee. All corporations are
23:47evil to some extent.
23:48Oh, yeah. But it seems that, back in
23:51the day, Apple did much more
23:53specifically for its own users. I mean,
23:56we remember those issues with
23:58trojanized apps, a bunch of infected
24:00programs in the Google Store. Apple has
24:02always been a bit more attentive. That
24:04doesn't mean they haven't had their own
24:06blunders. There were just far fewer of
24:08them. Plus, security in MacBooks is
24:11designed a bit differently. I mean,
24:14they have a separate chip, I think it's
24:16the Apple S something. Well, Secure
24:18Enclave. Right. And essentially, when
24:21it requests permission, that decision
24:23is made on a separate hardware chip.
24:25They introduced that Trusted Execution
24:27environment back then. That's going to
24:29be a difficult word, but it's not the
24:30point. Anyway, it was just better built
24:33, a bit more secure, plus less common,
24:35and they aren't as annoying as Windows.
24:39Especially back in the Windows Vista
24:41days, when it would ask 500 times: "Do
24:43you want to delete this file, yes?""Are
24:45you sure you want to delete this file,
24:47yes?" Are you feeling threatened? No,
24:49send a confirmation to your email, or
24:51something else. And I think the main
24:55reason it was like that is because
24:57people just got tired of clicking that
24:59UAC every time—yes, yes, run as
25:01administrator—and they got used to it
25:03, they became indifferent. Because of
25:07all those constant alerts, they didn't
25:09take that window seriously anymore. And
25:11when they finally ran something
25:13malicious, they’d just be like, "Ugh,
25:15Windows again," and click yes. Yeah, I
25:17think that was part of the problem.
25:23Also, in terms of Unix-like systems,
25:25you don't always need root privileges
25:27for everything.
25:32Uh-huh.
25:34So, you log in as root, do something,
25:36log out, and you’re back to being an
25:38unprivileged user. You can escalate
25:42privileges if you need to. In Windows,
25:44you're the administrator and a
25:46high-privilege user at the same time.
25:49Nobody taught you to create a regular
25:51user account, set a password, and not
25:53work as an administrator. Those kinds
25:56of materials just didn't exist. But
25:58these systems natively push you toward
26:00that just by how they're built. That
26:02might be part of it too.
26:04So, what does your workstation actually
26:06consist of?
26:07My workstation—I haven't used Windows
26:09since about 2013. It's Mac and Linux.
26:12Same here.
26:12I use a Mac as my laptop, it's a great
26:15typing machine and it's enough.
26:17Don't you have issues where you can't
26:19download certain apps on a Mac? Well, I
26:21haven't run into that, but for example,
26:23my wife couldn't install AutoCAD on her
26:24MacBook, and we had to get a Windows
26:26laptop for that.
26:27Honestly, I can't say anything about
26:29AutoCAD. No, I'm speaking figuratively,
26:31have you had situations like that?
26:33Uh, at one point, maybe, especially
26:36when I was at that firm around 2014 or
26:382015, I needed a proper Word, you know,
26:41to write and create documentation for
26:44it. I solved it with torrents,
26:46Parallels, and everything else. Yeah.
26:49Right. And then, by the way, those
26:52subscriptions arrived, so I just got
26:54Office 365 and was fine, but wait, I
26:57remember now, I found where to buy it.
26:59Basically, there are ways to activate
27:01things multiple times. Like, it gets
27:03activated in some closed environment,
27:05and then you can reactivate it using
27:07the same key. I think I bought it for
27:09maybe 200 rubles.
27:10And you use it for 30 days and just
27:12keep renewing it. I know about those
27:14things too. But I bought a key that had
27:16been activated somewhere at a closed
27:17enterprise, I mean. Well, I don't even
27:19know where. It was just some random
27:21site,
27:21and they were using it,
27:22yeah, and they don't need to reactivate
27:24it. It works on their computers, and
27:25they gave me the key. I mean, in
27:27reality, even if that computer dies, I
27:29can still reactivate Office. Which is
27:31what I did. At first, I contacted
27:33support, but there were even funnier
27:35cases back then. Like, we used to forge
27:38documents and send them to Microsoft
27:40just to get those full development
27:41suites and everything else. Yeah,
27:43development. Wow.
27:45Right. So you put together a story that
27:47you're, well, I think I had already
27:49finished university by then. But I got
27:51a full development kit while I was
27:53still in university. They sent me
27:55Visual Studio and all the latest stuff,
27:58everything possible, for free, the full
28:00packages. And I even had a developer
28:02account for Windows Phone. I mean, the
28:04new phone with the tiles and all that
28:06had just come out. I got really into it
28:08back then, thinking, "I want to try C#
28:10for the frontend." It looked kind of
28:12like modern frontend development, where
28:15you write some code, and after PHP, it
28:17felt pretty familiar to me. So it's
28:20kind of self-descriptive, you create
28:22the view part and in C#you create these
28:25handlers.
28:26You're describing a letter you sent to
28:28Microsoft right now. It's called "
28:30Social engineering starts with us."
28:32Yeah,
28:33Alexey has already practiced that.
28:35Well, I think we've all practiced it.
28:37Next question. Tell our viewers, what
28:40is information security and how does it
28:42differ from cybersecurity, are they the
28:44same thing or not? I won't be using any
28:49overly academic clichés now. Well,
28:53information security, generally
28:55speaking, is a broader, more general
28:58concept. Essentially, it’s a state, a
29:01property of information being secure.
29:03We'll talk about that now.
29:05Cybersecurity likely refers more to a
29:08specific system being resilient to
29:10cyberattacks. But overall, information
29:12security—well, the way we were taught
29:14at university, which in my opinion was
29:16wrong—is that what is it? It's
29:18confidentiality, integrity, and
29:20availability. Meaning when information
29:23isn't leaked and can't be read by
29:25someone unauthorized, when we can
29:27access it exactly when we need it, and
29:29it cannot be altered. Back in my youth,
29:33I think even while in university, I
29:35started reading Western books. They
29:37have everything a little bit—well,
29:38not exactly different. That is, the
29:40classic CIA triad is complemented by
29:43authenticity, accountability,
29:45non-repudiation, and reliability. So,
29:47authenticity, non-repudiation,
29:49reliability, and that accountability
29:52bit. And all this complements it as a
29:55whole, because, well, here's a simple
29:57question: if you take the standard
29:59triad, what is a digital signature?
30:01Confidentiality, integrity, or
30:03availability?
30:04Yes, confidentiality, integrity, or
30:07availability. Honestly, I couldn't even
30:09tell you.
30:10Well, in some sense, a signature
30:12ensures integrity. But that's not all.
30:14It also, in a way, shows authenticity,
30:18right, of the origin. I did the same
30:20thing.
30:20So, a digital signature is information
30:23security,
30:23right?
30:24And cybersecurity is if you need to
30:26protect things inside, right? or,
30:29Well, essentially, yes, the system—no
30:30, it can also have a signature there,
30:32it can be one of the protection
30:34measures. It's just that information
30:35security is a more general concept that
30:37goes beyond the boundaries of a
30:39specific network, system, or object,
30:41whereas cybersecurity is limited by
30:43those frameworks. So, cybersecurity—
30:45for example, the cloud. By the way, I
30:48wanted to ask, what is cloud security?
30:51I even prepared a little bit for this.
30:54What do people in cloud security
30:56actually do? It's data protection,
30:58cloud infrastructure security, access
31:01control, identity management, threat
31:03monitoring and response, and regulatory
31:06compliance. That sounds terrifying.
31:08There's so much to it.
31:10Like that meme: Dad, what are clouds
31:12made of? Servers running Linux. So,
31:16they are distributed systems, but in
31:18reality, they're just sets of computers
31:20. Clouds used to be built using systems
31:25like VMware, a virtualization platform
31:28that let you spin up a guest VM with a
31:30different kernel to run a workload. And
31:35, obviously, you could combine hardware
31:37into large clusters and slice them up.
31:39Modern clouds are Kubernetes-based now.
31:44Kubernetes allows us to reach the
31:47desired state more flexibly, easily,
31:49and quickly. It also ensures isolation
31:55between various user workloads through
31:57Linux security mechanisms. So, what is
32:02cloud security, then? Cloud security is
32:06the security of the underlay
32:07infrastructure, which is essentially
32:09what lies beneath the Kubernetes layer.
32:13That means the infrastructure, the
32:14Linux servers, their security, and the
32:17underlay networks where the physical
32:19traffic runs. Next, there's Kubernetes
32:21—that's Kubernetes security, the
32:24security of its components, and
32:26configuration accuracy. After you've
32:28tied everything together, there are
32:30various overlay networks that connect
32:32everything. While the physical layer is
32:35shared, overlay networks are built on
32:37top of it so we can restrict who has
32:39access to what. And that's how it all
32:42comes together in one complex system.
32:44I understand, so it's harder for an
32:46attacker to gain access because
32:48everything is so scattered.
32:51It’s like that other meme, where our
32:53DevOps are constantly changing
32:55everything, usually without
32:56documentation. An attacker who gets in
32:59and tries to hack us ends up in a
33:01completely unfamiliar cloud and gets
33:03lost in it.
33:03Got it. Even the employees themselves
33:05can't navigate it at that point.
33:07Exactly. That actually happens quite
33:09often, by the way. There you go. But
33:11the funniest thing is that there are
33:13probably cases where attackers
33:15understand the cloud infrastructure
33:16even better than the employees do. So,
33:21it depends on what you call a cloud—
33:24in our case, a public cloud is
33:25obviously a very large system. This
33:30includes a Security Operation Center
33:32with monitoring, and the correct
33:34collection of, let's say, security
33:36events from these nodes. This also
33:39includes correct Kubernetes control
33:41plane settings, and collecting audit
33:43policy logs from K8s to understand
33:45things. It also involves setting things
33:48up so that some user workload cannot
33:50just break in. It also involves certain
33:53, well, let's say, additional isolation
33:55mechanisms so that our user data can in
33:58no way interact with each other.
34:01This is probably incredibly expensive
34:03to maintain, but we will touch on this
34:05issue later. What types of attacks
34:08exist? DDoS, phishing. What is actually
34:11relevant today? I actually just gave a
34:14talk recently and spoke about the main
34:16trends. So, the most, well, probably
34:19painful trend that many have
34:21encountered, especially large ones, and
34:23I encounter it too, is DDoS attacks.
34:26Yeah. And right now my own wonderful
34:28provider is getting DDoS-ed. They
34:31turned on a geo-block. I can't get to
34:33my VPN servers, nor
34:35I understand what you're talking about.
34:36Just wonderful.
34:37VPN. And the guys won't even let other
34:40providers into their building. Tsk, tsk
34:42, tsk. Yeah. And, accordingly, yes,
34:46DDoS attacks are very widespread, there
34:49is also a lot of phishing. It is the
34:52most common way to get into a system. A
34:55very common way is misconfiguration.
34:59Actually, there are a lot of
35:00misconfiguration attacks, when we have,
35:02for example, a certain system and at
35:04some point, the maintenance personnel
35:07made a configuration error, and some
35:09database became available on the open
35:11internet without authorization. There
35:15are special sites like Shodan, robots
35:17that scan everything, the database is
35:19quickly found, data is pulled out of it
35:21, even though they simply made a
35:23mistake by announcing networks they
35:25shouldn't have. Well, maybe they just
35:30misconfigured the cluster somewhere.
35:33And people found the flaw.
35:36We looked, for example, if you put a
35:38virtual machine out in the clearnet
35:39with something like "test-test," in
35:41about 20 minutes they start
35:43brute-forcing you, they get in, and it
35:45all begins. So yes, that's also an
35:47example of misconfiguration, some
35:49default credentials on a virtual
35:51machine or exposed resources. Something
35:54else that happened often at one of my
35:56jobs. We see our IPS—that's "
36:01Intrusion Prevention System." Yeah. So
36:05the intrusion detection system is
36:07screaming, we look, we are getting
36:10hammered, and we are, like, a bank. So
36:12we start investigating and see
36:14completely unfamiliar IP addresses in
36:16our infrastructure. It turns out it was
36:18the DevOps team. They were making a new
36:19prod and the guy didn't want to have to
36:21go through us. He set up a proxy there,
36:23bypassed security controls, and exposed
36:24it to the internet. And now we’re
36:26getting hammered by requests.
36:27Yeah. And
36:28and so we call him up, like, what is
36:30this?
36:30And he wasn’t fired,
36:32he ended up quitting on his own later.
36:33I heard a story like that too, is it
36:35true or not? Also someone working at a
36:37bank, and they work with VPNs there too
36:39. The software is banned, right? So,
36:41anyway, this
36:43Yes, the software isn't banned, but
36:44using VPNs to bypass restrictions is,
36:46people are working.
36:48And he forgot to turn it off. And there
36:49, the security system triggered again
36:51because someone logged in from the
36:53Netherlands or somewhere, they started
36:55making a fuss, and it turned out the
36:56guy forgot to turn it off and he was
36:58actually fired for it. So, could that
37:00happen, or is that just a story?
37:02No, I think that could happen. It
37:04totally depends on the regulatory
37:06documents and, well, some kind of
37:08information security policy; if there
37:10was major damage, I think it could lead
37:13to serious legal action. Well, that’s
37:17why you need to make it so the user
37:19ideally can't do it, rather than just
37:21doing educational work in places where
37:23it's forbidden. Why can't you do that
37:27so they don't forget? Yeah, well, just
37:29implementing some measures like that.
37:31There are a lot of stories like that.
37:32I was actually surprised that they use
37:34bypasses in large organizations too. I
37:36even saw a girl on TikTok who works at
37:38a major bank, and she’s talking about
37:40her day. I open my laptop, turn on the
37:42VPN, and start working. So that
37:44surprised me too. Although,
37:45yeah. What’s the problem here?
37:47We are all told— "I'm not as much of
37:48an expert as you"—that VPNs are bad,
37:50that it's hacking, that you can get
37:52hacked and have your data stolen.
37:53No, no, that's not quite right. A VPN
37:56is actually a Virtual Private Network,
37:58in essence. And any organization has
38:01resources that are exposed to the
38:03outside. Well, for example,
38:04internet-facing resources, that is,
38:06those visible on the public internet.
38:09There are hidden resources that
38:10shouldn't be exposed. A VPN essentially
38:13allows you to create an overlay network
38:15on top of an existing one, like a
38:17different one that connects
38:19like a local network across different
38:21remote sites. And essentially, a VPN is
38:24the main tool for work, meaning
38:26development and dev environments should
38:28happen within a VPN; they shouldn't be
38:31exposed. Things like staging, I don't
38:33know, test or demo servers, internal
38:35infrastructure servers—they should
38:38never be exposed. Moreover, RCEs are
38:40periodically found in GitLab itself, so
38:43keeping GitLab open and constantly
38:46monitoring it is, well, difficult. I
38:48know companies that had their GitLab
38:50exposed to the internet like that, and
38:52they got encrypted by ransomware. Cool,
38:54see? I
38:55because in GitLab, well, yes, and in
38:57many places, like in Exchange,
38:58vulnerabilities are constantly being
39:00found, and elsewhere too. Therefore,
39:02the scope of what is exposed must be
39:04strictly controlled, while everything
39:06else should be hidden behind a VPN. And
39:10VPNs are not a bad thing. I mean, they
39:12are all different. It’s a technology
39:15that is just like a hammer—a tool you
39:17can use to do repairs or, well, hit
39:19someone with it, but the hammer itself
39:22isn't bad.
39:22Listen, that's cool, really cool.
39:24You've explained VPNs to me in a
39:26totally different way, and I've started
39:27looking at them differently. I never...
39:29I was just curious. They say, "At the
39:31bank, we run a VPN," and I, as a layman
39:33, think, "But we’re told VPNs are..."
39:35And I wonder how they run a VPN at a
39:37bank. See?
39:38Well, people talk about VPNs for
39:39bypassing blocks. That’s a bit
39:41different. I mean, a VPN is
39:42specifically for accessing corporate
39:43private resources. There shouldn't be
39:45any direct access to those.
39:46So, it turns out to be a slightly
39:47different VPN. It's not the same VPN
39:49used to access ChatGPT; you can't
39:51really call it a different VPN. It’s
39:53a technology that simply allows you to
39:55connect several machines together into
39:57a virtual private network. And how you
39:59end up using this virtual private
40:00network? You can use it in different
40:02ways. So, in the case of accessing
40:04ChatGPT,
40:05you just go...well, in essence, you
40:07send a request from your server, but
40:09rather from the one you are connected
40:11to. It talks to ChatGPT and just
40:13forwards it to you through the tunnel.
40:15But you communicate with your private
40:17infrastructure, which you don't want to
40:18show to the outside world, in exactly
40:20the same way. So, all organizations
40:22that have some form of remote work, or,
40:24well, I mean large ones, they all work
40:27through a VPN. A VPN is just a
40:29technology, a protocol.
40:30Cool. Thank you. It’s been really
40:32useful. So, in the end, how are they
40:34hacking people now—is phishing the
40:37main thing? Ah,
40:38Phishing, misconfigurations, meaning
40:41somewhere, I don't know, they
40:43reconfigured something, removed
40:45authorization, added a handle—an API
40:47endpoint, essentially—but didn't add
40:50protection, got through it, ran
40:52something, set up a proxy, or did
40:54something else. And lately, attacks
40:57through—well, supply chain attacks—
40:59everyone uses libraries, everyone uses
41:02some kind of commercial software. The
41:05SolarWinds case, yes, showed how guys
41:07essentially poisoned the development
41:09pipeline and added a backdoor to it,
41:11and this could be the case with many
41:13things. And we’re seeing this happen
41:16often recently, even with maintainers
41:18of large libraries, where people waited
41:21years to gain access just to add some
41:23kind of backdoor and distribute it to
41:25everyone. So, that's another entry
41:28point. And, in principle, using
41:31third-party dependencies can lead to
41:33some sad consequences, for example,
41:36Log4j, where it was possible to perform
41:38Remote Code Execution, i.e., executing
41:41code remotely, just by forming a
41:43specific required command. So the
41:46attacker didn't even need to gain
41:48access inside; they just sent it to the
41:50part of the web application that faces
41:52outward. If there was a vector to reach
41:56that library, they could already
41:58execute code inside your private
42:00segment.
42:01I really liked your podcast, and I want
42:03to clarify something too. You were
42:06saying that people dress up in employee
42:08uniforms, come in with ladders, and
42:10plug in flash drives. I was like, it's
42:12like in some movie. How can I just walk
42:15in somewhere in a uniform? How can I
42:17extract data if I’m just wearing a
42:19uniform? I mean, I'd have to access the
42:22equipment, it’s just interesting that
42:24people steal data like that.
42:26That's not exactly what I was talking
42:28about in the context of theft. There is
42:30something called Red Teaming, and there
42:32are organizations, meaning there’s
42:34penetration testing, which is more
42:36about testing the infrastructure or a
42:38product—some specific scope. And then
42:40there’s what's like a penetration
42:41test of the organization. You can hire
42:44a company, or a company—for example,
42:46we have our own dedicated teams—that
42:49specifically engages in various attacks
42:51on you to see how the company reacts,
42:53how the Blue Team inside the company
42:55responds. And there can be completely
42:58different methods here. Well, if
43:00there's an opportunity to physically
43:02break through, get to the server room,
43:04pull out drives, or execute code.
43:05Wait, how? I don’t even see it that
43:08way; it’s just brute force.
43:09All right. It’s negotiated with the
43:11client, but for example, clients are
43:13often willing to go for it—meaning,
43:15they don't necessarily need to steal
43:17actual data, I mean, just plugging in a
43:19flash drive or running a specific
43:20program is enough. Basically, that’s
43:24enough to prove you can impact the
43:26system, and what the company wants to
43:28test isn't just the security of one
43:30specific site, but how the entire
43:32security system works as a whole. You
43:37know, there was that great show, you
43:39can look at that, Mr. Robot, where they
43:41were dropping flash drives loaded with
43:43malware. You reminded me of that show,
43:45you know.
43:46Yeah, yeah, yeah. Well, essentially,
43:48that’s exactly what these guys are
43:50doing. Testing how well the guards work
43:52, how well they monitor the cameras, if
43:54people can break in, what happens, and
43:56whether people are actually locking
43:58their computers. Whenever I see an
44:00unlocked computer, I immediately want
44:02to......post in some group chat, "beer
44:04for everyone, pizza for everyone." Oh
44:06yeah. Actually, I was recently on a
44:08Sapsan train, and a guy sat next to me,
44:11he stood up, his laptop was unlocked,
44:13and he just walked away. I was like, "
44:15No, don't write anything, don't do it,
44:17people won't get it, you're not a
44:19security professional here." Right.
44:22It’s like a secret shopper checking
44:24how security works, only it's a secret
44:26hacker. A secret shop—a secret hacker
44:29.
44:30Yeah, and some really funny stories can
44:32come out of that. Super. Tell me, what
44:37are Ops? The......it's basically
44:40exploitation, only the exploitation...
44:43...of labor.
44:44Exploitation of labor.
44:45No, well, back in the day, we had a
44:47development team, people writing
44:49software and deployment manuals, and
44:51then there was an operations team that
44:54deployed and maintained everything. And
44:57that wasn't very convenient because
44:59developers don't like writing
45:01documentation and aren't good at it.
45:03Maybe they aren't good at it, and then
45:04they don't like it. I don't know which
45:06one it is. Long story short, they don't
45:08like either, very often. And well,
45:10we've all run into guides where
45:12you’re sitting there, and by the
45:13third step, everything is totally
45:15different and nothing works. Everything
45:18was resolved from the moment the DevOps
45:20culture and methodology emerged,
45:22meaning when everything was merged into
45:24one team, where developers worked
45:26side-by-side with the people who would
45:28later deploy it, and you could just ask
45:30, "How did you write it like this? What
45:33were you trying to show here?"
45:35In that way, a certain repeatability
45:37and uniformity was essentially
45:39established. It’s not like in the old
45:42days, I remember sometimes we needed to
45:44deploy the same thing, but we just
45:46couldn't. We had to travel somewhere, I
45:49don't know, to Serpukhov to see a
45:51client, just so we could build and
45:53deploy that exact same code on some
45:55guy's computer to prove that everything
45:57was fine. Whereas for us, it simply
46:00wouldn't work at all, or, for example,
46:02it would build something else entirely.
46:04And that was partially resolved. In
46:06other words, it became partially more
46:08convenient, faster, and simpler. Guys
46:10started creating different environments
46:12for programmers. It’s not like
46:14you’re creating folders with
46:15different numbers or keeping several
46:17versions somewhere; conflicts with
46:19libraries disappeared due to
46:20containerization, because everything is
46:22now packed into containers. Essentially
46:25, you can now juggle all of this
46:27however you want. All of this
46:29immediately began to be supported by
46:31automation. Security Sc appeared, yes,
46:34DevSecOps, where we write various tests
46:36. Also, we now have Continuous
46:39Integration and Continuous Delivery,
46:41where in small atomic cycles we
46:43complete a piece again and again,
46:45pushed the code, it passed checks,
46:47reviews, tests, was rolled out, pushed
46:50the same thing.
46:51No, well, there are still separate
46:53testers, of course. This can be
46:55interpreted in any way you want.
46:56Basically, it’s just a certain kind
46:58of culture. Who are white hat hackers
47:05and black hat hackers? White hat
47:08hackers are the guys who decided
47:10to participate, this,
47:12so to speak, to take part in this
47:14movement, but they work on, let's say,
47:17the light side. Meaning they use their
47:21abilities and skills to improve company
47:23security, to search for their weak
47:25spots and data transmission issues.
47:29Well, for a reward. Yes, they are hired
47:31,
47:31hired. There are actual companies. We
47:33are white hat hackers there. How do
47:35they look for them? Oh, there are
47:38companies that specialize in pentesting
47:40, and there are bug hunters who
47:42approach companies for bug bounties.
47:44By the way, for our viewers, sorry for
47:46the interruption, about bug bounties. I
47:48honestly didn't know what that was. I
47:49saw it on your podcast, and I
47:51absolutely loved it. Tell the viewers
47:53what a bug bounty is and if it's
47:54possible to make a living from it. Well
47:57, a company that is confident in its
47:59security and has likely reached a
48:02certain stage of technological maturity
48:04can say, "Guys, look, here's a scope;
48:06if you find something there, we'll pay
48:09you a cash reward." There are many
48:13so-called white-hat hackers who look
48:15for various vulnerabilities. If they
48:17find one, they go to the company,
48:18report the vulnerability via the bug
48:20bounty program, and receive a cash
48:22reward.
48:23Can you actually make money from it?
48:24Like, can you make a full-time job out
48:26of it?
48:27I don't think you can right now. Back
48:30when Western platforms were available,
48:32the payouts were much more interesting
48:34and lucrative. Back then, I think you
48:37could live off it. Now, it's more of a
48:39side gig. I mean, I attend events for
48:41bug bounty hunters. I'm not saying it's
48:43like that for everyone. There are
48:45talented people in the industry, but we
48:47probably shouldn't harbor any illusions
48:49. I mean, the truly talented ones are
48:51few and far between. For the rest,
48:54it’s probably more of a side hustle,
48:56so it's hard to call it a primary
48:58source of income. Although there are
49:01exceptions.
49:02So, bug bounty hunters are white-hat
49:04hackers, but for some reason, I
49:06associate them with testers. But, of
49:08course, it's more technically focused
49:10too.
49:11These are people with actual hacking
49:13skills. Exactly. It's clear that
49:17white-hats use their skills for good.
49:20Black-hat hackers use them for harm.
49:22They leak company data, sell it,
49:24encrypt it, and resell it. Uh,
49:28by the way, I said something silly
49:30about testers because they usually look
49:32for visual bugs. They
49:34aren't exactly just that either. It's
49:35much more complicated. It's clear that
49:38in the old days, testers did things
49:40manually, looking at things visually.
49:42They looked at that stuff. Now, a lot
49:44of attention is paid to things like
49:46automated tests. These are people who
49:48program tests, so it's already much
49:50closer to DevOps and SecOps. Plus, they
49:55have pipelines, everything is deployed
49:57to tests, and it's all automatically
49:59verified. Also, even if you take manual
50:04QA, those who check things by hand,
50:06there is a trend right now to teach
50:08security to testers. They’re checking
50:11things anyway, while they’re at it,
50:13they’ll poke around with Burp,
50:14something there
50:15check for some SQL injections,
50:17and they’ll be able to work through
50:19all of that. So, it’s interesting to
50:21them. And
50:22well, it turns out testing is changing
50:24to some extent now and new functions
50:26are being added for them.
50:27I wouldn’t say it’s changing right
50:29this second. It has already changed.
50:31Uh-huh. Perhaps it hasn’t reached
50:33every company yet, but I’m often told
50:35, "Lesha, you see some other world, you
50:37work in large companies, you should
50:39basically, well, get out of the city
50:41and see what’s happening around you."
50:43Right. But from what I see, there is a
50:46big, well, it’s a high-paying
50:48profession, they’re called
50:49auto-testers. And the ones who do it,
50:52well, they are essentially programming.
50:54The next question. What common mistakes
50:57do you see companies making with their
50:59security? They neglect security.
51:02That’s probably the most common
51:03mistake I’ve encountered. Like, "We
51:05haven’t been hacked in five years,""
51:07and we’re probably not interesting to
51:09anyone." No, you just haven't been
51:12found. As soon as you are found,
51:15you’ll go down immediately and lose
51:17all your data. This has changed
51:19especially, well, since the start of
51:212022, when the number of attacks grew
51:23significantly. And a common mistake,
51:27the second common mistake, is that, for
51:29example, they try, well, like, "I heard
51:32that secure development is needed," and
51:34you come to work at a company, but they
51:36don’t really have a perimeter, and,
51:38well, you can do whatever you want.
51:42You’re like telling the management: "
51:44Look, maybe let's put up a little fence
51:46, right, make sure no one sneaks in,
51:48that they don't drag our cows out of
51:50the pen, and then we’ll think about
51:53how to improve milk production;
51:54otherwise, we're improving milk
51:56production and automating things, but
51:58we have no cows left—they've all been
52:00dragged away." And sometimes this
52:04rejection happens, that, "It’s all
52:06fine as it is." That is also the second
52:08common mistake. The third common
52:11mistake is that even if they roughly
52:13understand what needs to be done, they
52:15try to perfect just one thing. Like, "
52:18Now we’ll install SAST, we’ll find
52:20everything." Meanwhile, we have RDP
52:23with weak passwords and such. So, all
52:26of this makes no sense. You can build,
52:29I don’t know, super application
52:31security practices, secure development,
52:33something else. Well, there’s no
52:36point in that if someone just breaks in
52:39and steals all your databases through a
52:41compromised endpoint because no
52:42attention was paid to endpoint security
52:45or infrastructure security. I have a
52:48perfect example of that. I once started
52:50a job, they gave me a virtual machine,
52:52and the root password was "qwerty123".
52:54I thought, "Well, that's not great."
52:57You might think a hacker wouldn't guess
52:58it's that easy.
52:59Actually, that's not true. There are
53:02brute-force tools, and
53:03there are all kinds of dark forums.
53:05I've found manuals there, for example,
53:07from one of the ransomware groups,
53:09describing how to hack this. Basically,
53:14they just look for these entry points
53:16with weak passwords, log in with that
53:19password, and that's it. A huge part of
53:25attacks is built on "pass-the-hash" and
53:27similar methods, used to recover the
53:29administrator password, relying on the
53:31fact that the admin uses the same
53:33password everywhere.
53:35Uh-huh.
53:36So, we get the password here. Yeah. We
53:39log into where the backups are kept,
53:41for instance. The administrator
53:42password is likely the same. We encrypt
53:44everything we want. I mean, we encrypt
53:46the backups in the system. And in the
53:48end, the company is left with nothing.
53:52I have a notification on my Mac's
53:54screen saying that 80 of my passwords
53:55have been leaked. It recommends I
53:59change them.
54:00And that means those passwords
54:02have been leaked
54:03and appear in databases. So if you take
54:05some password lists, there's a high
54:07probability that your password will be
54:09there. And if that password is there,
54:11it means attackers could use it next
54:13time. They sometimes use dumb brute
54:16force, like sequential guessing, but we
54:18all know that's inefficient. Usually,
54:21there are lists like the top 100, the
54:24top 10,000, or the top 100,000 most
54:27popular passwords. There are the most
54:31popular ones like "qwerty123," and
54:33there is an attack called "password
54:35spraying." That's where you don't
54:37sequentially guess for one user, but
54:39rather spray one password across the
54:41entire infrastructure, just in case
54:43someone somewhere
54:44messed up and didn't change the default
54:46password. That can happen, too. This
54:49can become an easy entry point. At the
54:52same time, you have to understand that
54:54this can happen in the moment; even if
54:56you have policies in place and
54:57everything is fine, there’s still a
54:59window when a machine is being created
55:01where they can still get through that
55:03little hole. Listen, which companies
55:05actually need security? Maybe a company
55:08just thinks, "I'm small, nobody needs
55:10me."
55:11Here,
55:11in my understanding, that's some kind
55:13of corporation. Like Wildberries or MTS
55:15, whereas if it's a small business,
55:18then
55:18security is needed by companies that
55:20have something to lose.
55:22Uh-huh.
55:24Those that have something to steal,
55:26those whose work can be stopped,
55:27causing them to suffer losses. Does
55:30this threaten small businesses? Yes, in
55:32principle, yes, it does. Imagine you
55:35are shipping some goods, and everything
55:37gets blocked for a week. You need to
55:40eat, but no money is coming in. Plus,
55:43there are all sorts of potential fines
55:45for breach of contract and everything
55:47else. Another example, I don't know,
55:50say you have a photography studio. And
55:53your site gets taken down too. That
55:55means during that time you lose
55:57potential clients. Your customers turn
56:01away from you; they go to your site,
56:03and it shows something ugly or some
56:04slogans or something else. Well, that's
56:08not very pleasant either. Therefore,
56:11you need to understand that security is
56:13not a final state, like, "That's it,
56:16we're secure now." That's not the case.
56:20Security is a certain balance. Why do
56:22we need security? So that the cost of a
56:25hack is higher than the value of the
56:27assets. Uh-huh.
56:30And it's clear why it was mentioned
56:31that it seems like security is just
56:33more visible for corporations. Why?
56:35Because the assets of a large
56:36corporation are much greater.
56:38They are visible to everyone. And to
56:41protect them, you obviously need a much
56:43greater volume of security, but some
56:45basic digital hygiene, even for an
56:48individual entrepreneur or
56:49self-employed person—using decent
56:52passwords, password managers, not
56:54posting sensitive data unnecessarily,
56:56and not opening unnecessary ports—
56:58will be, to some extent, enough. They
57:02simply face different threats. For a
57:05global corporation, it's a serious
57:07group of hackers who will sit and
57:09develop targeted attacks. For some very
57:12small business, you shouldn't get
57:14burned by school kids. I mean, those
57:18script kiddies, they don't really
57:20understand the technical aspects of
57:22security and hacking, but they have
57:24simple scripts they use to poke around
57:26and search. You shouldn't fall for
57:29people like that. I also liked your
57:31point on the podcast that many people
57:33think an information security
57:34specialist does nothing. So, a site
57:36runs for 2–3 years, the service isn't
57:38broken or touched, and then suddenly it
57:40gets hacked, and people say, "Security
57:42team, you did a bad job," and so on.
57:44But the fact that for two years nobody
57:46touched you, didn't DDoS you—well,
57:48you can’t protect against everything,
57:50and these hacks are constantly evolving
57:52. That’s also an interesting point,
57:53people say: "A security pro's work
57:55isn't visible, but it's actually there;
57:56you aren't being touched, you aren't
57:57being hacked, and you're working in
57:59peace." And that this work cannot be
58:00touched. Well, in this
58:02it’s a slightly misguided notion, I
58:04think. Although, I have met people who
58:07don't understand how to derive
58:09satisfaction from that and see their
58:11own work. It’s not just that, well,
58:13the site is working and that’s it,
58:15right? For example, a lot of attacks
58:17happen on companies. You see, for
58:19instance, a DDoS attack coming at you,
58:21and you watch to see if you’re coping
58:24or not; you see, for example, some kind
58:26of intrusion into your network, how
58:28quickly you reacted and kicked the
58:30adversary out; you participate in
58:32incident analysis or some kind of
58:34response. You look at the results of
58:36pentests and, for example, see that
58:38last time they breached your company,
58:40but you did the work internally, closed
58:42the holes, and this time, for example,
58:44they couldn't get as deep. That is
58:46exactly the result of the work. It’s
58:48just that, perhaps, in entry-level
58:51positions, this impact isn't entirely
58:53clear, but that is a manager's task. To
58:55explain to, I don't know, an intern, a
58:57junior, you know, to those guys, that
58:59you’re doing a small piece and it
59:01seems to you like it's some kind of
59:03nonsense. In reality, this small piece
59:05will fit into this larger piece
59:07together with your colleagues. Then it
59:09will fit into a piece from the
59:10neighboring department. And, as a whole
59:12, we will get this large piece where
59:14they couldn't break through. And this
59:16is, among other things, your merit and
59:18your victory.
59:19Uh-huh.
59:19And a manager must be able to convey
59:21what is being done and why, and what
59:23its place is in the company's global
59:25security. That little square that a
59:27person made, it will occupy its place
59:29so that they understand: "Look,
59:31everyone else is going down under DDoS
59:33attacks, but we are still standing.""I
59:36did that, too." Or, I don't know,
59:38everyone is getting hacked and
59:39encrypted, but we weren't.
59:41Well, yeah. So the work is visible.
59:44Yeah, here, teamwork is probably
59:46what’s most important, because
59:47security—especially in a large
59:49company—is something they don’t
59:51really teach us at universities. Well,
59:54or maybe they do now, but they
59:56certainly didn’t back then. In other
59:57words, it’s about teamwork; no matter
1:00:00how skilled a specialist you are, you
1:00:02can’t do it all alone. I mean, you
1:00:04need infrastructure, you’ve got
1:00:07Kubernetes, cloud infrastructure,
1:00:09Application Security, web stuff,
1:00:11DevSecOps, SOC, Incident Response, and
1:00:14all of that has to work as a unified
1:00:17team. I mean, people.
1:00:18How do you choose that team? If a
1:00:21company is looking for someone to
1:00:22handle information security, how do
1:00:24they choose? Because, for example, when
1:00:27I was researching this on YouTube,
1:00:29everyone talks about info-sec, but
1:00:31there are many—not necessarily
1:00:33charlatans—who basically can't
1:00:35protect anything. How is a company
1:00:37supposed to choose?
1:00:38That’s a tough question, probably.
1:00:41That’s exactly when companies should
1:00:43get a consultation or hire a specialist
1:00:45who has already proven their
1:00:47effectiveness to help them pick a lead
1:00:48who can build things from the ground up
1:00:50. This is a frequent scenario. It
1:00:54happens that people are invited to help
1:00:56with interviewing or to help hire
1:00:57someone. And that’s because companies
1:01:00don’t understand, you know, who they
1:01:01should be looking for. And even if they
1:01:03do find someone, they don’t
1:01:05understand if the person actually knows
1:01:07what they’re talking about. So, it
1:01:10makes sense to start building with a
1:01:12CISO, for example, if it’s a large
1:01:15company; for a smaller one, it’s
1:01:17probably enough to have one or two good
1:01:19security specialists who can form a
1:01:21roadmap, highlight risks, and
1:01:23understand what the business's pain
1:01:25points are and what they absolutely
1:01:27don't want to happen to their business.
1:01:29I mean, it’s clear that there can be
1:01:31many threats. We could, I don’t know,
1:01:34get encrypted, or have our source code
1:01:36leaked, or have our systems hit with a
1:01:38DDoS attack, making the site go down.
1:01:40But here is what’s most important:
1:01:42the business says, "Damn, we’re
1:01:43developing such unique know-how here."
1:01:45If our competitors find out about it,
1:01:47well, essentially that’s it, our
1:01:49startup is dead.
1:01:51Dead. And that is the very event we
1:01:53must never allow to happen; sure, the
1:01:55site might go down, we’ll learn from
1:01:58that later, for example. Yes, well,
1:02:00something else might happen, for
1:02:01instance, they might encrypt files, we
1:02:03make backups, that's fine, but they
1:02:05won't steal this know-how. That is the
1:02:07most important thing. But for others,
1:02:08it's the opposite, for example, a bank.
1:02:10A bank that isn't working is a dead
1:02:12bank. Let them steal it. We will
1:02:13compensate the money, we have the funds
1:02:16. A person takes out their phone and
1:02:17opens their banking app. If they can't
1:02:19get in, we lose huge amounts of money,
1:02:22much more than we would compensate one
1:02:24person whose money was stolen. Let it
1:02:26be set up so that everything works
1:02:28under any circumstances.
1:02:29That's cool, you mentioned a risk map.
1:02:32So, someone should come in and write
1:02:34you a risk map of where you can be
1:02:36hacked.
1:02:37Well, it's not exactly a risk map;
1:02:39it’s just clear that there are
1:02:41certain trends and a clear threat
1:02:43landscape that exists right now. You
1:02:45need to understand what from that
1:02:46applies to your business. You don't
1:02:48need to protect yourself from
1:02:49everything. That's exactly the kind of
1:02:51understanding you need to build with
1:02:52the business. Meaning, what are they
1:02:54most afraid of? And start gradually
1:02:56from there. Accordingly, once the most
1:02:57critical needs are met, we move on to
1:02:59the slightly less critical ones, and
1:03:01keep moving forward like that. A
1:03:02segment for simpler questions. How do
1:03:05you protect your site if it’s,
1:03:06let’s say, on WordPress or Bitrix?
1:03:08How do you feel about websites on CMS
1:03:11platforms in general? I barely work
1:03:14with CMS platforms at all, but...
1:03:16Well, maybe you've heard some stories.
1:03:18What is your opinion, or...
1:03:19Well, I’ve heard stories about
1:03:21WordPress. It's from my younger days,
1:03:23that it’s a very leaky, bad thing.
1:03:27Regarding website protection, there are
1:03:29certain best practices for development.
1:03:32It's not just a matter of clicking a
1:03:34button here or there and everything is
1:03:35fine. It’s a huge scope of tasks.
1:03:39It’s clear that your site has,
1:03:41essentially, both a frontend and a
1:03:43backend. You have your frontend
1:03:45vulnerabilities and your backend
1:03:46vulnerabilities. Frontend
1:03:49vulnerabilities are mostly related to
1:03:51improper interpretation or injection of
1:03:54JavaScript code into a site page,
1:03:56various DOM injections, XSS injections
1:03:58in one form or another. As for the
1:04:03backend, that’s stuff like code
1:04:06execution, IDORs, path traversals,
1:04:09various SQL injections, and SSRF. And
1:04:13the communication between your
1:04:14client-side and backend must be
1:04:16encrypted. Your JavaScript, for example
1:04:19, shouldn't be able to access cookies.
1:04:21So, I keep hearing a lot about
1:04:22JavaScript, that many things get broken
1:04:24through it.
1:04:25Well, the entire frontend is JavaScript
1:04:27. I mean, we don't really have
1:04:28alternatives; well, WebAssembly is
1:04:29emerging, but it still has to be called
1:04:31via JavaScript. Basically, we have
1:04:32nothing besides JavaScript. What
1:04:34exactly do we have on the market now?
1:04:36There's, uh, who is it, Facebook, uh, I
1:04:38don't remember who else. Just these
1:04:41major companies. Some came up with
1:04:42React, others with Vue, others with
1:04:44something else. That's basically what's
1:04:46on the market. It’s all JavaScript.
1:04:49And JavaScript, well, since it's the
1:04:51only language that works this way and
1:04:53is currently used in browsers on the
1:04:55client side, you have to work with it.
1:04:57Uh-huh.
1:04:59It gets even more fun, because
1:05:00there’s also backend JavaScript.
1:05:03Uh-huh.
1:05:05And there, cross-site scripting allows
1:05:07you to inject JavaScript code into a
1:05:09page. Right, to pull out cookies,
1:05:13or to steal credit card details if
1:05:15you're entering anything. In the case
1:05:17of a JS backend, that becomes remote
1:05:19code execution on the backend, where
1:05:20you can do whatever you want.
1:05:22Uh-huh.
1:05:22Then there are things like cross-site
1:05:24request forgery, right? Like, if I copy
1:05:27and duplicate a link to send 100 rubles
1:05:29. to someone else, you need to protect
1:05:31against that. So there's a lot, like
1:05:36how to handle cookies, how to configure
1:05:38CORS, how to work with data, how to
1:05:41process it, how to ensure no extra
1:05:43characters slip in, like filtering
1:05:45everything.
1:05:48No, everything you're saying is true. I
1:05:51remember after 2022, a huge number of
1:05:53my sites were hacked through the ACF
1:05:56plugin. We talk about needing to do
1:05:59this and that, but they just took a
1:06:01plugin, hacked it, and that was it.
1:06:04They hung news banners on my sites, and
1:06:06I had to fix all of that in a rush.
1:06:08Well, that's probably one of the
1:06:10biggest downsides, because there are
1:06:12constant problems with WordPress.
1:06:14Honestly, I try to stay away from it
1:06:16entirely.
1:06:17It's like what you said: why is a
1:06:19MacBook considered more secure and
1:06:21Windows less secure? WordPress is
1:06:24mainstream, and people are constantly
1:06:25doing things to it. There are, for
1:06:27example, less popular engines, and very
1:06:29few people hack them, few people even
1:06:31know about them.
1:06:32There is one more fundamental problem:
1:06:35these plugins are mostly not controlled
1:06:37by anyone. So, I could easily make a
1:06:39malicious plugin.
1:06:40they are also often pirated,
1:06:41or, well, I make a malicious plugin,
1:06:44and people download and use it. Or a
1:06:46vulnerable plugin, through which it
1:06:48will be easier for me to hack.
1:06:50Well, that's why you need to buy from
1:06:52official sources.
1:06:53So, it's basically a whole science.
1:06:56Meaning there is no simple solution.
1:06:59Next question. Uh, tell me, what's the
1:07:01state of security at large companies,
1:07:03large organizations with thousands of
1:07:06employees, how is it organized—whole
1:07:08departments, outsourced staff, or
1:07:10in-house, how does it work?
1:07:12It varies depending on the company.
1:07:14There are companies that use
1:07:15outsourcing. Well, if we're talking
1:07:18about, say, Russian Big Tech, they
1:07:20mostly try to keep in-house employees.
1:07:23Yes, these are whole departments, and,
1:07:26moreover, departments with different
1:07:28focuses. There are teams that manage
1:07:32infrastructure security, scan the
1:07:34perimeter and the interior, scan the
1:07:36web part, manually check things during
1:07:39creation—teams of pen-testers, secure
1:07:41development, Security Operation Centers
1:07:43, there can be a huge number of teams.
1:07:50And it's clear that processes are being
1:07:52built, right—how software is put into
1:07:54production, what checks need to be
1:07:56passed, let's look at the design review
1:07:58to make sure everything is good in
1:08:00terms of architecture so you don't have
1:08:02to redo it later. Then come, for
1:08:06example, some product pen-tests, an
1:08:09assessment, where a specialist will sit
1:08:11and poke around, see what might be
1:08:13there, and identify patterns in the
1:08:15product's development. An endpoint is
1:08:18added—oop, reassessment, let them
1:08:20check if they forgot authorization on
1:08:22that endpoint, or if something else was
1:08:24added—a parameter—oop, reassess
1:08:26again, plus all that surrounding
1:08:28infrastructure and, let's say, the
1:08:30team's technical debt regarding
1:08:31vulnerabilities.
1:08:33Further, this can all be spiced up with
1:08:35some bug bounties, and vulnerabilities
1:08:37from bug bounties as well. And that is
1:08:40the paradigm the team lives in.
1:08:42Uh-huh. Cool. My next question. What do
1:08:46you need to know to become an
1:08:47information security engineer? And is a
1:08:49higher education degree necessary?
1:08:51Right now, in my opinion, a higher
1:08:53education degree is not needed. Uh, No,
1:08:56well, how should I say, I'm not going
1:08:59to say it doesn't have its benefits.
1:09:01Moreover, when I was studying back then
1:09:03, it lagged behind quite a bit. Now,
1:09:06I'm even being invited to top
1:09:07universities to give lectures myself,
1:09:10perhaps. The level there is higher now,
1:09:14and they provide more, let's say,
1:09:16up-to-date knowledge from active
1:09:18specialists. But I see fewer and fewer
1:09:21limitations; a person can come without
1:09:23a degree and work if they really
1:09:25understand and know something. So I
1:09:29wouldn't call that some kind of main
1:09:31point. If you have an education, good;
1:09:33if not, well, it's not a big deal.
1:09:35Regarding what you need to know, it
1:09:37probably
1:09:37depends on where to even start. It
1:09:39probably depends a bit on the
1:09:41specialization, meaning it depends on
1:09:42where you want to go and what you like
1:09:44more. Well, it's clear that if we take
1:09:48application security, then these are,
1:09:50well, some basic skills, right, the
1:09:52ability to work with at least one
1:09:54programming language, because you'll
1:09:56have to look at code. For example, the
1:09:58language "Goshka" is popular now.
1:10:00Wait, haven't you heard?
1:10:02The Go language.
1:10:03Oh, Goshka, Go, yes. Go. Go. Yes. Yes.
1:10:06I was at a conference recently. on 1C,
1:10:09and they are doing automation in Golang
1:10:11. Well, they were talking about it
1:10:13there, I was even surprised. Because
1:10:16you'll have to look at code, and you'll
1:10:18have to validate vulnerabilities and
1:10:19something else there. So, knowing, well
1:10:21, probably just Golang won't be enough.
1:10:24It's JS, too; it's clear that there is
1:10:26also a frontend part, so, well, JS and
1:10:28Go, but what else besides JS? Kotlin, I
1:10:31don't know, JS, Swift, for example. No,
1:10:33JS Swift is probably wrong, it would
1:10:36just be Swift, not a backend on Swift.
1:10:40In short, just pick something popular
1:10:42right now where they are hiring a lot
1:10:44of developers, take JS for browsers,
1:10:47and understand how vulnerabilities work
1:10:49. You need to understand, for example,
1:10:53some processes, how to set up
1:10:55interaction, know how to exploit, well,
1:10:57to some extent, yes, so not at a
1:10:59pentester's level, but at least be able
1:11:01to reproduce them for AppSec, for
1:11:03example. Such knowledge is critical.
1:11:05And it's clear that there should be
1:11:07general knowledge, like what protocols
1:11:10exist, right, what HTTP and HTTPS are,
1:11:12how that works, how, I don't know, what
1:11:14you can do with cookies, what flags
1:11:17there are. Well, these are the parts
1:11:20that concern, let's say, the
1:11:21client-side. For example, if we talk
1:11:26about the SOC, then you can also get
1:11:28into the SOC on the front line. So,
1:11:31there are many, let's say, log
1:11:33collectors spread across the systems.
1:11:36These logs collect system events, and
1:11:39these system events fall into the SIEM,
1:11:41and the SIEM correlates them depending
1:11:43on the rules. If something bad happens
1:11:46in its view, an alert basically pops up
1:11:48for such a specialist, and they must
1:11:50react to it. Well, it's clear the guys
1:11:52are given some playbooks on what to do.
1:11:54Meaning, if a person doesn't understand
1:11:56what's happening or can't figure it out
1:11:58, they pass it to the next tier.
1:11:59Uh-huh. So that a more experienced
1:12:01specialist can take over, and so the
1:12:03senior expert doesn't have to sift
1:12:05through the entire incoming flow, but
1:12:07only deal with what the guys really
1:12:08can't handle. There. And, accordingly,
1:12:11if something really is happening, they
1:12:13provide some kind of reaction, alert
1:12:15the team, or initiate incident response
1:12:17. So it's a bit different here, right?
1:12:20That is, you need—if it's a Windows
1:12:22infrastructure—an understanding of
1:12:24Windows events, an understanding of
1:12:26Linux events, an understanding of, uh,
1:12:29the most basic syscalls, yes. So we
1:12:32look at what is happening, and we need
1:12:34some work experience, some experience
1:12:36administering these systems, to
1:12:38understand where a program should or
1:12:40shouldn't be going. Like, for instance,
1:12:43if something is touching......etc/
1:12:45shadow, and something is being appended
1:12:47there. Well, something probably went
1:12:49wrong. Because that's where Linux
1:12:51stores user password hashes.
1:12:52How much time does it take to get the
1:12:54hang of it? I, for example, don't have
1:12:56the kind of experience you do. You
1:12:57shared your background, and it's very
1:12:59interesting. You’ve been doing all
1:13:01this since you were a kid. If I want to
1:13:04try it out, how long do you think I'd
1:13:06need to reach a level where I could
1:13:08look for a job?
1:13:11Ah, well......study time.
1:13:13Ah, listen, it's hard to say. For
1:13:17instance, I take on interns, they come
1:13:19in, and they can answer some things
1:13:21about Linux. And applying it to my
1:13:24specifics, like when I was hiring for
1:13:26IR and now when I'm hiring for my SOC.
1:13:28A guy might be able to tell me
1:13:30something about Linux, privilege
1:13:32escalation, I don't know, reverse
1:13:34shells, and just, you know, basic......
1:13:37Linux usage. He knows a bit, maybe
1:13:40heard about containers or isolation
1:13:42mechanisms, and knows something about
1:13:44vulnerabilities, can at least explain
1:13:46how some of them work. I think that's,
1:13:50well, enough for an intern. Not just
1:13:54enough, I mean, I'll explain, there’s
1:13:56probably a slight nuance here. Both
1:13:58times, the guys who came to me were
1:14:00first-year students, so, you know, they
1:14:02were 18 years old and in their first
1:14:04year. So it's good that he learned it
1:14:05on his own and that he understands this
1:14:07. Overall, we can probably provide him
1:14:10with the foundation for growth and the
1:14:12knowledge that will help tie it all
1:14:14together. Obviously, the requirements
1:14:17for an intern or a senior student will
1:14:19be different and higher, depending on
1:14:21what they've covered. Then again, in
1:14:26university they learn a programming
1:14:27language, so they should know how to
1:14:29code and understand basic system
1:14:31architecture. The conclusion is that
1:14:35the entry barrier is higher, like I
1:14:37mentioned in that podcast about 1C. In
1:14:401C, you can basically study for six
1:14:43months and then get a job and earn a
1:14:45decent salary. Here, as I understand it
1:14:48, the entry is more difficult because
1:14:50you need to know Linux, you need to
1:14:52know vulnerabilities, and only then do
1:14:54you start getting into it.
1:14:55Listen, no, I don't think so—well,
1:14:58again, uh,
1:14:59well, you have to know Linux, too, I
1:15:01can't deny that.
1:15:02I studied a long time ago, but it seems
1:15:04to me that
1:15:05when you hire people, you see young
1:15:07guys now, how do you actually hire them
1:15:09, how do you onboard them? How are they
1:15:12generally? When you were a student
1:15:15versus the guys today, is there a
1:15:16difference, or are they all just as
1:15:18driven as you were?
1:15:19No, well, it's clear they are all
1:15:21completely different. Some come in
1:15:23asking, "Where do I click to get 400 k/
1:15:26sec?"
1:15:27That's exactly what I wanted to dig
1:15:29into a bit more. I, I don't know what
1:15:32to recommend, really, when they come
1:15:33like that.
1:15:34They come like that,
1:15:35yeah. But for them, I don't know what
1:15:37to recommend. But in general, I have
1:15:40seen people switch from other—well, I
1:15:43mean from a related IT field, for
1:15:45example, to security or something else.
1:15:48And for a time, I was mentoring. In my
1:15:51opinion, six months is a good amount of
1:15:53time to prepare. I think you could even
1:15:55prepare much more seriously in six
1:15:57months.
1:15:58Uh-huh. I'm also curious, in one
1:16:01interview you said that a person is the
1:16:03weakest link. How do you train them?
1:16:06Well, to ensure a person isn't the
1:16:08weakest link. Do you hold conversations
1:16:13so they understand what they can and
1:16:15can't do, or does it have to come from
1:16:17the company itself? Does it not depend
1:16:20on the employee being the weakest link?
1:16:22Is it specifically about how the
1:16:23company builds its security?
1:16:25It doesn’t depend on the employee, it
1:16:27depends on the employee. As a security
1:16:30specialist, I can build a ton of
1:16:32barriers and fences, but it makes no
1:16:34sense if my employee just gives away
1:16:36all their passwords, credentials, or
1:16:38runs something from their laptop or
1:16:40even runs something at work on...
1:16:45on the server, of course. I mean,
1:16:47you have to understand that, yes,
1:16:49indeed, the human is the weakest link.
1:16:51Why? Because they can be easily hacked.
1:16:58It's quite easy to hack a person. Take
1:17:00any emergency situation. Like how
1:17:02scammers operate at night, or somewhere
1:17:04urgently, or early in the morning. That
1:17:08is, when a person isn't really in their
1:17:10flow and needs to act quickly, they
1:17:12might make the wrong decision. The same
1:17:15thing can happen at work. Everyone has
1:17:17life problems, kids, a stressful day,
1:17:20or something else. So the first task is
1:17:23, yes, to automate as much as possible,
1:17:25so that a person doesn't have to worry
1:17:27about it, and there's less chance for
1:17:29them to make a mistake. So they only
1:17:33handle high-performance tasks where
1:17:35they are absolutely necessary. There
1:17:38you go. Second, security is about
1:17:40transforming the company into a secure
1:17:42entity, not just an individual or a
1:17:45security team, but the whole company.
1:17:48Basically, you have to measure by the
1:17:50weakest person. And this is a very
1:17:52large set of tasks. This includes
1:17:55things like training phishing
1:17:56simulations and communication. Why did
1:18:00people click the links, what was wrong
1:18:02with this email, let's look, here you
1:18:04see...
1:18:04it's
1:18:06not MTS, or whatever, but some MTC, and
1:18:09you went and clicked the link. And,
1:18:12naturally, this is...well, especially
1:18:15regarding vulnerabilities, we track
1:18:17trends, for example, if the guys are
1:18:19making the same mistakes, or which
1:18:21mistakes happen most often. We go to
1:18:24the team and communicate, "Hey guys,
1:18:26sorry." That's it.
1:18:27By the way, have you fallen for
1:18:28anything recently? Like, you know, "
1:18:30Darn,
1:18:31I don't think so."
1:18:32Like, "Man, I really got scammed."
1:18:34Hasn't happened. Got it?
1:18:36I have a great advantage. I don't read
1:18:38my email, so all those phishing letters
1:18:40miss me, and I only see the post-mortem
1:18:42in the chat later. Ah,
1:18:45well, anyway, there are many vectors.
1:18:48You really need to focus on people.
1:18:51Someone in accounting needs to
1:18:53understand where they can enter their
1:18:55passwords; a company owner doesn't
1:18:56necessarily have to be an IT specialist
1:18:59, they don't need to be. Meaning they
1:19:01should understand not to just plug in
1:19:03every flash drive they see or give away
1:19:05their passwords. A lot of things are
1:19:07happening in Telegram right now. It’s
1:19:08simply layering itself over our
1:19:10ordinary spheres of life. Like things
1:19:12being written in Telegram, for example,
1:19:13by someone pretending to be a director
1:19:15from a past job. Well, the task is
1:19:16probably to teach people to recognize
1:19:18such situations. There was a time when
1:19:19they used to call saying, "Oh, I’ve
1:19:21been in an accident, send money
1:19:22urgently." And people sent it. So, it
1:19:24should be part of a person’s mindset,
1:19:26it comes from psychology. The more
1:19:28developed the intelligence, the more,
1:19:31well, a creature—not necessarily an
1:19:33animal, a human—the more they play in
1:19:35childhood. I mean, those animals that
1:19:37are born, and, like, immediately go to
1:19:39eat, like some ungulates—they don’t
1:19:42really have, well, games...horses have
1:19:44games, I’ve seen them in others, but
1:19:46fewer. So they don't play, they go
1:19:48straight to being, what, adults, right?
1:19:50But kittens, puppies, children—they
1:19:53play, and why? To actually develop
1:19:55these complex patterns. They try out
1:19:59various, what’s the right word, they
1:20:01try on different roles and test them
1:20:03out. They carry them into adult life.
1:20:07And those roles didn't exist back then.
1:20:09So back then they were breaking down.
1:20:10And the point here is probably for
1:20:12people to try this on, understand it,
1:20:14and play it out. So that next time they
1:20:16get a call, they can say: "I don't even
1:20:18have a son, how could he be in an
1:20:20accident?"
1:20:21I’m more afraid of this part. Well, I
1:20:23have a question later about social
1:20:25engineering too, but before I lose my
1:20:27train of thought, what if it’s not
1:20:29just phones, but later, as you said,
1:20:31they start showing up at your door in
1:20:33costumes with ladders to manipulate you
1:20:35further. And that’s where...
1:20:38That exists, that does exist. Well, I
1:20:40think it will be easier to catch those
1:20:42people. Plus, a generation will grow up
1:20:46that was born, let's say, in the
1:20:48digital era. Those who have had phones
1:20:51and everything else since childhood.
1:20:52Although I see young people falling for
1:20:54it too. Like that recent case with the
1:20:56girl, where scammers called her. But
1:20:59for now, in my opinion, from my
1:21:01perspective, I see that it’s still
1:21:03the older generation, right:
1:21:05someone’s parents, grandparents, who
1:21:07aren't used to this, who, well, perhaps
1:21:10are more trusting toward scammers. And
1:21:13they are the ones suffering the most. I
1:21:15don’t know what happened recently.
1:21:19Someone came along, a good person, and
1:21:21set up various self-bans on loans,
1:21:23really fighting against these phone
1:21:25spam calls.
1:21:28I actually saw it on your Telegram and
1:21:30did it right away. It takes about two
1:21:32minutes,
1:21:32right? And most importantly, do it for
1:21:34all your parents, grandparents, which
1:21:36I already did for all my parents, right
1:21:38?
1:21:38Because, well, it’s unlikely your
1:21:40grandmother is going to go and take out
1:21:41a loan. If she needs money, she’ll
1:21:43turn to you, right. So set up this
1:21:45block so that it’s impossible to
1:21:47transfer money. Now banks have various
1:21:49options, like requiring confirmation
1:21:51from multiple people to transfer money.
1:21:53We are moving toward that, but very
1:21:54slowly. All of this could have been
1:21:56done five years ago. I don’t
1:21:57understand why we tolerated all these
1:21:59spam calls for so long, all of this.
1:22:00And we also need to start punishing
1:22:02these various spam calls much more
1:22:04severely.
1:22:04Oh, it’s just awful. You just don't
1:22:06pick up the phone because of it. When
1:22:08someone really wants to call you, they
1:22:09can't get through. I don’t even
1:22:11answer the phone anymore. I was once on
1:22:13vacation. And, well, I couldn't pick up
1:22:15the phone because of roaming. I had
1:22:17about thirty incoming calls in, I
1:22:19don’t know, 10 or 12 days, and I
1:22:20didn't lose anything at all.
1:22:22We just need to start fining these
1:22:24survey companies and banks for all that
1:22:26stuff. They must have introduced some
1:22:28kind of law, right?
1:22:29They did. Well, I think it’s likely
1:22:31more complicated, but still, yes,
1:22:33it seems like we are heading in the
1:22:34right direction now and it will
1:22:36probably get a bit easier. And what we
1:22:38need more of, what is missing in this
1:22:39case, is explanatory work, so that
1:22:41someone talks to every person, because
1:22:43like now in banks, they call them and
1:22:45ask: "Are you sure you want to do this?
1:22:47Is this definitely it? Are you sure
1:22:48you're not talking to scammers or
1:22:50something else?"
1:22:51My next question. What technologies do
1:22:54you consider the most relevant in
1:22:56cybersecurity and information security
1:22:58right now? The newest ones?
1:23:00Right now, again, there is, let's say,
1:23:02automation and aggregation of
1:23:04everything. And that manual labor is
1:23:07being phased out. Oh, it’s not
1:23:09completely excluded, but it is being
1:23:11added. I mean, back when I started my
1:23:15career in security, it didn’t really
1:23:17exist. There was, like, statistical
1:23:21analysis, but you’d get some report
1:23:23and you had to interpret it manually.
1:23:25Now we see something completely
1:23:27different. You run it, you get some
1:23:29alerts, you upload them. It simplifies
1:23:32life and makes it, like, it allows the
1:23:38specialist to focus on other tasks
1:23:39where higher-skilled work is actually
1:23:41required. We see the same thing with
1:23:45tests, we see it with behavioral
1:23:47analysis, right? Mechanisms that allow
1:23:50you to understand that, say, a user
1:23:52always interacted with a web
1:23:53application this way, but now something
1:23:56has gone wrong. Well, a simple example.
1:23:58I pick up my phone, I go in, I don’t
1:24:00know, to check my balance, transfer
1:24:03money to my mom. If, looking at my
1:24:04behavior, I picked up the phone, went
1:24:06into the bank app, and didn't reach the
1:24:09balance page for one reason or another,
1:24:11it means they’ve done something wrong
1:24:13. It means it’s a buggy update, since
1:24:15users, for example, aren’t getting
1:24:17through.
1:24:18Uh-huh.
1:24:18And then there’s timely reaction. If
1:24:23we take security again, it’s all
1:24:25aimed at increasing the time required
1:24:27for an attack and decreasing the
1:24:29reaction time.
1:24:33Meaning your reaction should be much
1:24:35faster than the time the attack takes,
1:24:37so you have time to fend it all off.
1:24:40Accordingly, it’s about systems for
1:24:42correlating results, various
1:24:44interpretations of these logs, their
1:24:46interconnection, intrusion detection—
1:24:49all of this is being modernized. Now
1:24:52everyone is trying to shove artificial
1:24:54intelligence in everywhere too.
1:24:55Sometimes it’s justified, sometimes
1:24:57it isn’t. You have to look into it.
1:24:59But on the whole, it’s pretty cool. I
1:25:02mean, back when I worked at the bank,
1:25:05for instance, we had this IDS, an
1:25:06intrusion detection system, which would
1:25:09, say, spend a month learning how you
1:25:11work within the infrastructure. And
1:25:15based on that behavior, seeing
1:25:17deviations from it, it would raise some
1:25:19alerts. I mean, like, people usually
1:25:21connect via these specific ports, or
1:25:23something else, but if a service starts
1:25:25up on completely different ports, it
1:25:26sees that this wasn't in the behavior,
1:25:28meaning something went wrong.
1:25:30Uh-huh. So it’s analysis—you think
1:25:32the newest thing right now is analysis
1:25:34and
1:25:34Ah, well, of course, the results
1:25:36provided
1:25:36who should react, a human or artificial
1:25:38intelligence? Ah,
1:25:39it can be both ways. I mean, what's the
1:25:41point? There's IDS detection, which
1:25:44triggers an alarm, and a human then has
1:25:46to interpret it. There's prevention,
1:25:49which, for instance, blocks it outright
1:25:51, and then you have to figure it out,
1:25:53and if it's legitimate activity, allow
1:25:55it to continue. Question: do you use
1:25:59neural networks in your work?
1:26:01No.
1:26:01Why?
1:26:03Explain. Are you against all of this,
1:26:05or do you not believe in it? It's just
1:26:09that the basic information that neural
1:26:11networks can give me now, I received
1:26:13many years ago, and for the more
1:26:15advanced research I'm doing now, neural
1:26:17networks aren't capable yet. Ah, yeah,
1:26:21I've tried doing some automations.
1:26:23Automate this for me. I don't want to
1:26:25go in there 1,500 times anymore. Do
1:26:27this thing for me there.
1:26:28No, well, some things like that, yes, I
1:26:31mean, I have an upcoming DevOps talk,
1:26:33dedicated to secrets and handling them
1:26:36with Vault. So I went to a neural
1:26:39network, poked around, saw what it
1:26:41shows and produces, closed it, and,
1:26:43well, no. I mean, let's be objective, a
1:26:47neural network can write code like a
1:26:50junior, probably. Well, maybe like a
1:26:55junior plus, but there's a lot it won't
1:26:57be able to do in the specific way you
1:26:59need.
1:27:00Plus, it also makes mistakes. I've
1:27:03personally run into that a few times
1:27:05myself.
1:27:05Regarding security use cases, there's
1:27:08probably another problem, that
1:27:09everything hinges on the availability
1:27:11of datasets, which aren't that numerous
1:27:13, especially when it comes to security.
1:27:16So a model must be trained on a huge
1:27:18amount of data. Uh-huh. People just
1:27:20don't have a huge amount of data in
1:27:22general.
1:27:23Have you used DeepSeek or not? There's
1:27:25a claim that it's better than ChatGPT,
1:27:27and they trained it specifically on
1:27:29verified information, and whatever
1:27:31information was missing, they added it.
1:27:33Well, again, a simple example. One
1:27:36could, for instance, recognize, I don't
1:27:38know, vulnerabilities in code, but we
1:27:41don't see such a product yet. We see
1:27:44ones that help recognize false
1:27:45positives at some rate, but why don't
1:27:47we see that? You need a huge amount of
1:27:50data for a neural network to learn.
1:27:51Where do you get it?
1:27:52Uh-huh.
1:27:53So, to load them up in huge amounts.
1:27:55Where would you even download it from?
1:27:56I mean, there is some software. They
1:27:58aren't going to just post all their
1:28:00lifetime vulnerability reports for you.
1:28:01You need a lot of such software, a lot
1:28:03of those vulnerability reports, which
1:28:05you don't have. And accordingly, yes,
1:28:06this neural network can do something.
1:28:09Is it 100%effective? No.
1:28:11Uh-huh. Well, there is another thing.
1:28:13That's AI agents. Like, you write out a
1:28:15scenario and use them for that too. But
1:28:17again, this is mostly for some kind of
1:28:19automation.
1:28:19Well, and again, all those fine-tuning
1:28:22neural networks, what else? Fine-tuning
1:28:24a neural network, go ahead. That,
1:28:26what's it called, dataset poisoning. I
1:28:28can fine-tune it incorrectly, label the
1:28:30report wrong or something else, and it
1:28:32will start training in the wrong
1:28:34direction, not the one the developers
1:28:36intended. I think, well, it will
1:28:39properly take shape a bit later, when
1:28:41they start producing much better
1:28:43results, because right now such data
1:28:45doesn't exist. And these models
1:28:48themselves need to be improved.
1:28:51I see. Next question. What is CI/CD and
1:28:54how does it work? Explain it simply,
1:28:56because I’ve looked at quite a lot of
1:28:58information. Yeah.
1:29:00CI/CD is a build and deployment
1:29:02container; it's essentially a remote
1:29:04automated system that builds your code
1:29:06on its own and deploys it somewhere,
1:29:08allowing you to do this many times
1:29:10iteratively.
1:29:11Uh-huh.
1:29:12And to test different versions and
1:29:14things like that. Essentially, it's
1:29:17some kind of remote service. A
1:29:20developer writes code, checks it
1:29:22locally, pushes it there, and it all
1:29:24gets built, tested, deployed for tests,
1:29:26and deployed to a staging environment,
1:29:28where the developer checks not just
1:29:30their own piece, but the product as a
1:29:32whole, to see how it feels and works.
1:29:35And then, after some time, the end
1:29:37users receive it in the form of, say, a
1:29:39new backend.
1:29:40Uh-huh. And what are containers? How do
1:29:43they work? Containers. Here is how
1:29:47containers work. In fact, it's a sort
1:29:50of, well, to make it simple for the
1:29:52listeners, an isolated system where we
1:29:54can run some software or third-party
1:29:56libraries, avoiding dependency issues
1:29:59—where my system has one version of a
1:30:01library and the software requires
1:30:03another—to clear out all that mess.
1:30:06And in fact, containers use Linux
1:30:08isolation mechanisms to create this
1:30:10kind of virtual isolated environment
1:30:13where we can run the container. It’s
1:30:16very convenient because it's
1:30:17lightweight. There is no guest kernel
1:30:19like in virtual machines. So, it only
1:30:21contains what is necessary: the
1:30:22dependencies and the software. Well,
1:30:24the dependencies for the software to
1:30:26run, and the software itself. And since
1:30:28it's all already packed into a
1:30:29container, it’s not like the binary
1:30:31works for Pete but doesn't for Vasya
1:30:32because they have slightly different
1:30:34systems. The container will be uniform;
1:30:36essentially, you can just hand it over
1:30:38to a friend. There. And it will work
1:30:41for both Vasya and Pete. When I was
1:30:45preparing for your podcast, I read a
1:30:47lot of comments saying containers
1:30:49aren't that secure. By
1:30:52default, they are not secure. You need
1:30:54to know how to prepare containers
1:30:55properly. I probably have a ton of
1:30:59materials on that on my channel.
1:31:04The question is, we touched on social
1:31:06engineering a little bit. What are the
1:31:08new threats in general? See, we
1:31:10explained it briefly, so in your
1:31:12opinion, what is important for people
1:31:14to know right now?
1:31:16Things like fakes, voice fakes. We see
1:31:19cases where they've swapped
1:31:20deepfakes are just out of this world
1:31:22right now. I saw them take "The Boy's
1:31:25Word," I'm not a fan, I'm just saying
1:31:27it surprised me. They took American
1:31:30actors, like Spider-Man, and put him in
1:31:32the lead role. I mean, it was just so
1:31:34realistic. It's just incredible. Well,
1:31:37in fact, the essence is the same, but
1:31:39the wrapper is new, right? We see
1:31:43people restoring bank accounts in
1:31:45someone else's name using voice, or
1:31:47impersonating others, pretending to be
1:31:50a manager; necessity is the mother of
1:31:52invention. So all these emerging
1:31:57technologies, like any tool, are used
1:31:59for good tasks in some places and for
1:32:01these kinds of things in others.
1:32:04Uh-huh. Okay. I have this question:
1:32:06what would you be doing if it weren't
1:32:08for information security? I don't know,
1:32:10maybe a musician or something else.
1:32:12That's
1:32:13a good question. Well, no, I am a
1:32:15musician myself, and in my youth, I
1:32:18played in a band, but I probably would
1:32:20have stopped doing that quickly because
1:32:22a musician has to eat. There. I don't
1:32:26know, maybe I would have programmed or
1:32:28developed. I mean,
1:32:29well, information security is more or
1:32:31less related to that. If you were to
1:32:33take that away,
1:32:35well, I don't know, probably something
1:32:37in engineering. That's close to me.
1:32:40Uh-huh.
1:32:40Maybe construction, by the way. Like
1:32:42an architect of houses. Not a security
1:32:44architect, but an architect of houses.
1:32:46I have a next question. Do you have any
1:32:48hobbies?
1:32:49Yes. And
1:32:50what do you actually do?
1:32:52In your free time from work.
1:32:54What time?
1:32:55Free time from work.
1:32:57Well, that happens. Oh, no, actually,
1:32:59lately I've been traveling and riding
1:33:02around.
1:33:03Tell me about it, what's it like, where
1:33:05?
1:33:06In the winter, I went snowboarding in
1:33:08Dombay. Well,
1:33:10it's beautiful there,
1:33:11right? I really liked it. I went riding
1:33:13at Golden Valley, near St. Petersburg.
1:33:15Uh-huh.
1:33:16Somewhere else, too. I do a lot of
1:33:17speaking and traveling. Right now, in
1:33:19April, I’ll be speaking in Kazakhstan
1:33:22. I’ll fly to Almaty
1:33:23to speak. I haven't been there, for
1:33:25instance. Uh, and it just so happens
1:33:27that I’m traveling a lot; I was in
1:33:29Ufa recently. Before that, I was in
1:33:31cities like Izhevsk and Ulyanovsk.
1:33:33Ulyanovsk has recently become something
1:33:36of a startup capital. Not that—well,
1:33:38that’s a stretch, but lately a lot of
1:33:39startup conferences have been held
1:33:41specifically in Ulyanovsk for some
1:33:43reason.
1:33:43Yes, in many cities; for example, one
1:33:46time, well, Ulyanovsk provided space at
1:33:48a university for a conference, things
1:33:51like that. Oh, it was a pretty decent
1:33:54conference, everything was good, but
1:33:56for instance, I once went to Nizhny
1:33:59Novgorod, their local DevConf, and it
1:34:01was really cool. They also had the
1:34:05university provide an assembly hall and
1:34:07several rooms, they invited me to speak
1:34:09, invited other cool people, there were
1:34:12workshops, you could even sit and break
1:34:14things. And I think the students came
1:34:16with pleasure. And you could talk in
1:34:19person. It's cool that universities are
1:34:23helping out, so to speak, investing in
1:34:26it. Well, for a university, it's no big
1:34:29deal if, say, on a weekend, people come
1:34:32in and essentially use the auditorium,
1:34:35but for a, well, not small group like
1:34:37that, it's probably an issue, right? I
1:34:39mean, when you have more than 20 people
1:34:42, you can't just rent a bar, you need a
1:34:44venue, you rent it, yes, that costs
1:34:47money, and you want some
1:34:48cool guys to come. So, it's moving
1:34:52forward in many places. It's just that,
1:34:54perhaps, it's more pronounced in some
1:34:56places, like Moscow or elsewhere, and
1:34:59in some places slightly less pronounced
1:35:01,
1:35:02or maybe it's still
1:35:03in its infancy, but overall, the trend
1:35:05is there.
1:35:06Well, in general, you speak at
1:35:09conferences, travel, relax, play the
1:35:11drums.
1:35:12Well, drums, guitar, bass. I used to,
1:35:15but lately I’ve dropped it, I was
1:35:17doing Thai boxing. Do you ever
1:35:19experience burnout?
1:35:20Yes.
1:35:21Like, everything's tedious, I don't
1:35:23want to do anything. How are you coping
1:35:24?
1:35:25It doesn’t exactly work like you just
1:35:27wake up one day and…My next podcast
1:35:29is coming out on the channel soon.
1:35:31It’s a massive podcast about burnout,
1:35:33featuring a professional
1:35:34psychotherapist. That's cool.
1:35:36There will be a lot of stuff—it was
1:35:38our longest podcast, we filmed for 4.2
1:35:41hours straight.
1:35:42We haven’t been filming for that long
1:35:43, and we’re already getting a bit
1:35:44tired after four hours. So, anyway,
1:35:47well, in short, everything turned out
1:35:49great back then. It was after a full
1:35:51workday, and we analyzed why it
1:35:53actually happens. I think that with age
1:35:56—well, not so much age, but with
1:35:58experience—you start to sense that
1:36:00moment. It’s not like you wake up one
1:36:02morning and think, "That's it, I'm
1:36:03burnt out." It’s more like everything
1:36:05gradually gets harder and harder. And
1:36:08it’s crucial to increase your rest
1:36:09when the workload increases. You have
1:36:13to maintain a balance with things like
1:36:16travel, new experiences, physical
1:36:18activity, and so on. And over time, you
1:36:22learn to feel it. You realize that,
1:36:25okay, I can push through for a week,
1:36:28for example. Then you see it continuing
1:36:31, and at some point, you realize that
1:36:33if it keeps going this way, it’ll be
1:36:35tough. So you go to management and talk
1:36:39it over, saying, "We can push hard for
1:36:41another week, but then I need a
1:36:43vacation or some time off."
1:36:45Fortunately, management is
1:36:47understanding these days.
1:36:48Well, of course. As an employer, it’s
1:36:52not in my interest to have someone join
1:36:54, burn out in three or four months,
1:36:56tell us to get lost, and quit. I really
1:37:00want to build a healthy atmosphere in
1:37:02the team and a healthy balance. I
1:37:05don’t deny there are nuances,
1:37:07incidents, hacks, or other issues that
1:37:10pop up. And it should probably be built
1:37:14on a certain level of loyalty;
1:37:16sometimes I, as an employer, have
1:37:18problems, and people stay a bit late to
1:37:20help. Besides, it’s encouraged these
1:37:22days, and everything is paid for. It's
1:37:25not like back when I started working,
1:37:27where there was just this cult of
1:37:29overworking. I mean, it was technically
1:37:32paid, but when your base salary is
1:37:3420,000, those overtime hours don't
1:37:36really mean much. And obviously, there
1:37:38needs to be loyalty toward the
1:37:40employees as well. Everyone has, you
1:37:42know, pets, kids, parents, their own
1:37:44problems, illnesses, vacations. So,
1:37:47some kind of balance has to be
1:37:48maintained.
1:37:49You probably even have to force some
1:37:50guys to go on vacation and rest,
1:37:52because some people say: "Nah, nah, I
1:37:53don't need to." And with some guys, yes
1:37:56, you probably need to watch the
1:37:58atmosphere in the team, because, well,
1:38:00okay, if a person burns out, but it
1:38:02could end in much more serious health
1:38:04problems for them.
1:38:07100%. I have one last closing question.
1:38:10Do you have a dream?
1:38:11A dream? Yes, I do.
1:38:13What is it?
1:38:15Right now, I'm planning, I want to
1:38:17create a new level of training in
1:38:19Russia
1:38:20in information security. And what does
1:38:22"new level" mean? One that doesn't
1:38:24exist yet. It's a different quality of
1:38:28materials, so that specialists will
1:38:30emerge with different—well, not just
1:38:32different skills, but with a much
1:38:34greater understanding of information
1:38:36security and much deeper knowledge, so
1:38:38that it will be, uh, let's say, worthy,
1:38:45something that...
1:38:46Aren't you afraid that it won't be
1:38:48appreciated? That you'll make it too
1:38:50complex, that you'll overdo it?
1:38:52Probably not, because in some sense
1:38:55I’m also—well, I mean, I have
1:38:57webinars I do, right? No, well, I do
1:39:00get feedback from time to time that
1:39:02it's too difficult. I think I've
1:39:04already figured out to some extent
1:39:06Even—sorry for interrupting, please
1:39:07forgive me, you're going to write in
1:39:09the comments again that I keep
1:39:11interrupting. I'm a potential, you know
1:39:13, your student, maybe, I'm interested
1:39:15in this. Information security. I'm
1:39:18really interested in it. I started
1:39:20digging into this topic and stumbled
1:39:22upon some of your conferences. I didn't
1:39:24understand everything at all. Uh...
1:39:26You're a bit—it's not your audience,
1:39:28no. You started with the wrong content.
1:39:30I mean, you're taking some speech at a
1:39:32conference where
1:39:33the conference is not for beginners.
1:39:35People like me come there, and we
1:39:37exchange experience. So the entry
1:39:39threshold is high, especially since at
1:39:41every conference, well, there's this
1:39:43gradation. And my latest talks, they're
1:39:46all hardcore. So that’s already
1:39:47I even told you about your podcast, I
1:39:49was on the podcast, I didn't understand
1:39:51anything at all.
1:39:51Well, if it was Seccode, then yeah,
1:39:53probably. It depends on which podcast
1:39:55you're talking about. I just have
1:39:56several different lines. If you take
1:39:58the series of podcasts like "Making
1:40:00Home Lab Production," where we go
1:40:01slowly, like "Hey guys, look, this is
1:40:03virtualization, this is how it works."
1:40:05That's it. Well, I didn't have much
1:40:07time lately, so I paused the releases.
1:40:09I’ll continue now. We’ll go through
1:40:11Git, write a Telegram bot, pack it into
1:40:13a container, and keep moving forward
1:40:15step by step. You’ll be given it
1:40:16step-by-step from the moment when
1:40:18you’re typing, you need to write in
1:40:20TG: "Guys, this is from here to there
1:40:21for beginners."
1:40:22And from, I think, through
1:40:24Or maybe film some video,
1:40:25I don't think so, I'll film a video
1:40:27later. At the end of the year, I was
1:40:29summarizing things and posted various
1:40:30compilations. Yeah. I mean, it’s
1:40:32clear that my conferences and
1:40:33everything—well, students don't
1:40:34usually attend those conferences.
1:40:36People who go there are,
1:40:37yes, people just like you.
1:40:38Yes, just like me. And we discuss
1:40:40slightly different problems there. I
1:40:43have a series of webinars, for instance
1:40:45, there's one like "hacking websites,"
1:40:47where I show simply how and why
1:40:49vulnerabilities work. And I mean, from
1:40:51the very beginning, just go check it
1:40:53out. There’s a playlist called "
1:40:56Webinars," and there: introduction to
1:40:58Docker security, how escapes work, how
1:41:00to harden Docker, OWASP Top 10, how to
1:41:03exploit these vulnerabilities, how
1:41:05container monitoring works, why, an
1:41:07introduction to K8s, an introduction to
1:41:09security—that is exactly the
1:41:11foundation you should start with.
1:41:15That’s how I would put it. Yeah. And
1:41:17later, well, it’s clear that when you
1:41:19come to a talk where we spend 40
1:41:21minutes breaking CI/CD, and you don’t
1:41:23even know what CI/CD is, you’re just
1:41:25like, "well, it looks cool,"
1:41:27you don't see the point, it's just
1:41:28interesting. You want to build some
1:41:30kind of school, an online school, as I
1:41:32understand it, and I’m giving you
1:41:34feedback that it’s an interesting
1:41:35topic. And the main thing is that the
1:41:39youth—I’m already sounding like
1:41:41that—young guys don’t go down the
1:41:43wrong path, because with all these
1:41:45droppers and such, these hacking
1:41:47movements can lead them astray. But
1:41:51this way, you can at least guide the
1:41:53youth toward information security.
1:41:55That's the point.
1:42:00Well, I’d like to wrap up my podcast
1:42:02here. Thanks to Alexey for coming. It
1:42:05was very useful. Alexey, thank you once
1:42:08again.
1:42:08Thanks for having me.

About this transcript

This page contains the full transcript of Всё об информационной безопасности | Кибербезопасность | DevOps, CI/CD | Хакеры | Алексей Федулаев by КодАвтоматизации, generated from the public captions YouTube serves with the video. The transcript has 17,336 words across 2,817 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to choose a caption track available on the video.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, caption language selection, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.