Hacking the System with Sarah Hume - Insights from a Senior Penetration Tester

The Journey of a Cybersecurity Expert

Sarah Hume's path to becoming a senior penetration tester at Security Risk Advisors is as unique as it is inspiring. Born to engineer parents, Sarah humorously claims her origin story began with her birth announcement, which read like a software upgrade notification. Despite an initial disinterest in computers, a push from her father led her to attend a cybersecurity camp in South Dakota. This experience sparked her interest and set her on the path to where she is today.

Daily Life of a Penetration Tester

Today, Sarah's role involves rigorous penetration testing and specializing in TIC (Trusted Internet Connections) assessments. Most of her days are spent conducting purple team exercises, where she collaborates with both the offensive and defensive sides to enhance security measures. Her self-proclaimed title, 'Purple Queen,' although used humorously, underscores her expertise and passion for this area.

Favorite Tools of the Trade

When asked about her favorite tools for penetration testing, Sarah highlights Impacket, a collection of Python classes for working with network protocols. Impacket is versatile enough that one could potentially conduct an entire pen test using just this suite. Among its many utilities, SecretsDump stands out for Sarah due to the thrill of retrieving hash values during tests.

A Memorable Penetration Testing Story

Sarah shares an intriguing tale from one of her physical penetration tests. Tasked with assessing the security of an office with unexpectedly high security measures—including man traps and armed guards—she attempted various strategies to breach security. Posing as a job applicant was one approach she tried after realizing direct methods wouldn't work due to their tight security.

Despite thorough preparations and assuming multiple pretexts during her infiltration attempt, each step was closely monitored by vigilant security personnel. The situation turned serendipitous when Sarah engaged in conversation with Megan (a name picked from LinkedIn), who believed Sarah was there for an interview. This interaction showcased not only the challenges faced during physical penetration tests but also highlighted how social engineering plays a crucial role.

Interestingly, after what seemed like failed attempts at breaching security through conventional means, Megan reached out via LinkedIn offering Sarah a job based on their interaction—which speaks volumes about Sarah's adaptability and skill in managing real-time social interactions under pressure.

Conclusion - Lessons from the Field

Sarah Hume's experiences underline several key aspects of cybersecurity practices:

• The Importance of Continuous Learning: Staying updated with tools like Impacket is crucial for effective penetration testing.
• Adaptability in High-Stress Situations: Successfully navigating through high-security environments requires quick thinking and adaptability.
• The Role of Social Engineering: Often overlooked, social engineering can be pivotal in testing security systems' resilience against human error or manipulation.

Listeners can tune in to more such enlightening stories on 'War Stories', powered by Cyber Coffee—perfectly engineered for those who hack through day and night.

Article created from: https://youtu.be/8t730VoLMHI?si=XNFhlekVISpgrSVe