Lessons Learned:

• IDS says everyone is attacking you with everything they got all the time.
• A hacker, who just has to find a single vulnerability, has it easier than a security professional, who has to defend against all vulnerabilities all the time.
• Everyone with a website gets a “vulnerability assessment,” probably several per day. Whether you pay for the results or not is another matter.
• Use security obscurity to your advantage.
• Security solutions that work for smaller websites don’t necessarily scale for the larger ones.

This year you've been selected as one of the Top 25 CTO's according to InfoWorld. How does it feel to have your work recognized and being put head to head with other well known industry giants?

It’s an honor. “Surreal” is the best word I can use to describe being listed next to names from top companies like VeriSign, 3Com, Motorola, and Credit Suisse. And while I’m receiving a lot of the credit recently, which I appreciate, it’s really the result of years of tireless effort from many amazing people at WhiteHat Security and around the webappsec community. I was always fond of the quote by Sir Isaac Newton, “If I have been able to see further, it was only because I stood on the shoulders of giants.”

Has the award put a spotlight on WhiteHat Security?

It’s funny, I was just getting used to seeing our name in the press about every week or so, then this happened. Now it’s almost every day we’re mentioned and it’s actually been difficult for us to keep up with all the inbound interest in WhiteHat Sentinel. Part of the build up is of course press generated. But, most of the increase is simply due to the complexity and difficulty of Web application security and the need for easy-to-use vulnerability management services. We’re really excited about the future and we seem to be at the right spot at the right time.


With the constant evolution of threats, what kind of technology challenges does WhiteHat Security face?

It’s interesting. It’s not so much the new attacks or techniques that keep us on our toes, but the adoption of new Web development technologies such as Ajax, Flash, Java, etc. Websites using these technologies are really no more or less secure. But, what is more difficult is scanning for the vulnerabilities within them. Today’s Web pages share more similarities with running applications instead of traditional HTML documents. This makes “crawling” the website that much harder. By extension, the attack surface is more difficult to define, and as a result black box “fuzzing” is constantly challenged.