107: Alethe

Key takeaways

Mischievous curiosity and strategic thinking, demonstrated early in Jack Ricider’s story, are foundational traits for successful social engineering.
Personal backgrounds, including childhood experiences and personal challenges, can significantly influence skills in reading and manipulating people.
Participation in cybersecurity communities like DEF CON can be transformative, providing opportunities to learn, compete, and build confidence in social engineering skills.
Balancing family life with professional pursuits is possible with resilience and ingenuity, as exemplified by Alethe’s experience bringing her baby to DEF CON.
Effective social engineering relies heavily on preparation, research, and understanding human psychology, particularly principles of influence and trust-building.
Organizations should continuously educate their staff and perform simulated attacks to strengthen human defenses against social engineering threats.

Summary

Early Experiences and Mischief at the Renaissance Festival

The podcast begins with Jack Ricider sharing a humorous and daring story from his college days when he worked at the Renaissance Festival. Due to his boss forgetting to give him an employee pass, he had to sneak into the festival daily, studying security patterns and finding ways to evade guards, which he found exhilarating. He describes a playful deception that eventually led to him getting caught and handed an employee badge, highlighting early signs of his mischievous and clever nature that foreshadow his interest in security and social engineering.

Introduction to Alethe and Her Background

The episode then shifts focus to Alethe, a professional social engineer working for Critical Insight. She recounts her background, starting from her childhood in South Africa where her family’s volatile situation forced her to mature quickly. Her childhood involved manipulation and exploration, which developed her skills in reading people. She later moved to California, where her fascination with computers and hacking, inspired by movies like 'Hackers,' combined with her real-life experiences, guided her toward social engineering and cybersecurity.

Journey into Social Engineering and DEF CON

Alethe details her journey into the realm of social engineering, which culminated in her first attendance at DEF CON. She describes the excitement of discovering the social engineering village, the contest, and practicing live calls under high-pressure conditions. Her interest grew from watching others perform live social engineering attacks to participating herself, leveraging her intense preparation, strategic pretexts, and OSINT skills. Her participation and eventual victory in the social engineering Capture the Flag (SECTF) at DEF CON marked a turning point, inspiring her to pursue a career in cybersecurity focused on social engineering.

Balancing Motherhood and Competitive Hacking

Despite her success, Alethe faced personal challenges, including pregnancy and motherhood, which she creatively used to prepare for future competitions. She discusses her determination to enter the next DEF CON contest while pregnant, using maternity leave to hone her skills. Her dedication paid off when she placed third in her second competition, even bringing her three-month-old baby to DEF CON. This section underscores her resilience, balancing family life with her professional ambitions, and highlights her commitment to mastering social engineering.

Professional Career and Modern Social Engineering Practice

Alethe explains her transition into a cybersecurity career, starting her own consulting practice, and working at Critical Insight. Her focus areas include security awareness training, phishing simulations, and testing organizational defenses against social engineering attacks. She emphasizes the psychology behind social engineering, including the six principles of influence used by scammers and penetration testers. Her work involves simulating real-world attacks to improve organizational resilience, with a particular focus on phishing campaigns, both via email and vishing, that test and educate employees on security best practices.

Show notes

Alethe is a social engineer. Professionally she tries to trick people to give her passwords and access that she shouldn’t have. But her journey to this point is interesting and in this episode she tells us how she became a social engineer.

Follow Alethe on Twitter: https://twitter.com/AletheDenis