Interview with Jeremiah Grossman, CTO of WhiteHat Security
by Mirko Zorz - Monday, 24 September 2007.
Jeremiah Grossman founded WhiteHat Security in 2001. Prior to WhiteHat, he was an Information Security Officer at Yahoo! responsible for performing security reviews on the company's hundreds of websites.

Jeremiah is a world-renowned leader in web security and frequent speaker at the Blackhat Briefings, NASA, Air Force and Technology Conference, Washington Software Alliance, ISSA, ISACA and Defcon. He is a founder of the website Security Consortium (WASC) and the Open website Security Project (OWASP), as well as a contributing member of the Center for Internet Security Apache Benchmark Group.

Let's start with an easy one. How did you get interested in Web security?

Most of my technology background originates from Web development. Iíve created many websites, coded in several server-side (Perl, C, Java) and client-side (JavaScript, Flash, Java) languages, studied HTTP extensively, toyed with every major Web browser since Mosaic, and am very familiar with Apache and MySQL. But, it really wasnít until the summer of 1999 that I took an active interest in Web security. The mainstream media published several articles stating that the Web wasnít secure (nothing new here), but the big guys had (Yahoo, Amazon, eBay, etc.) fixed the problem (They did!? How!?). To satisfy my curiosity, I proceeded to hack into my own Yahoo! Mail account and quietly reported my results back to them. A few emails later, Yahoo! offered me a position as ďThe Hacker Yahoo.Ē And the rest, as they say, is history.

What are the most important lessons that you learned while working as the Information Security Officer at Yahoo? I'm sure many security professionals wonder what working at such a large company entails.

Yahoo! was/is big, really big. Itís so big itís hard to wrap your mind around: at the time, my best count was roughly 600 websites, 17,000 publicly facing Web servers, and 120 million users. Working for Yahoo!, or being responsible for the security of any popular website, is trial by fire. Think about the fact that there are more than 1 billion people across the globe with access to your website all the time, and a certain percentage (we thought 1%) is malicious. As demanding as this type of job is, the experience is also extremely rewarding and highly recommended for anyone in website security. Without having been in that role, itís difficult to appreciate which security strategies actually work, versus the ones that technically should, but donít.


How to keep your contactless payments secure

Posted on 19 September 2014.  |  Fraudsters can pickpocket a victimís financial data using low-cost electronics that can fit into a rucksack. Here are the top security threats you should be aware of if youíre using a RF-based card, along with our top safety tips to keep your payments secure.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.


Mon, Sep 22nd