To commemorate F-Secure’s 30th year of innovation, we’re profiling 30 of our fellows from our more than 25 offices around the globe.
F-Secure cyber security consultant Matti Aronen was always attracted to the offensive side of security. His affinity for hacking began with Eye of the Beholder. It was a game he would tinker with on his Amiga to get extra items and other benefits.
From there, he got into war games, in which players hack into computers specifically made to be vulnerable. He eventually went on to study computers. His interest in security paid off while working in software development. He would apply offensive techniques to his own applications to break them and then make them more secure.
Eventually, he realized the offensive side of security was where he belonged. He started working at F-Secure about a year and a half ago. Red teaming assignments now eat up most of his time.
“I’m responsible for planning and executing our physical intrusions. But I also hack their IT systems, their physical access controls, and of course their employees,” he explains. “Our customers pay us to find and exploit their weaknesses, and report to them about what we did, why we succeeded, what an attacker in our position could do, and most importantly, how to fix the problems.”
Matti’s job might sound exciting. Perhaps even glamorous. But be warned: going through trash comes with the territory. On the other hand, it requires a lot of quick thinking. “Adapt” is the one word he associates with his job.
His days are incredibly varied and can see him handle a wide variety of tasks, including but not limited to:
- performing open source intelligence (OSINT – going through publicly available material)
- creating fake badges, doing phishing campaigns
- gathering information from the customer intranet
- exploiting vulnerabilities
- elevating privileges in the customer infrastructure
- visiting customer sites to plan for the physical intrusions
- performing the said physical intrusions to drop network implants (basically backdoor devices that bypass security controls)
- constantly learning from F-Secure’s other cyber security professionals
Matti thinks that the idea of earning a living this way would surprise a lot of people. But what’s more surprising is how this affects your perception about what a successful day at the office actually involves.
“Several of us put our heads together in a recent project to combine information from our customers’ internal network (which we hacked into) with public sources to help us pinpoint a confidential physical location. The customer was pretty impressed we were able to find something so valuable with this approach. And I think moments like that really impacts customers and motivates them to improve their security, and that’s why we do red teaming.”
Matti’s career choice isn’t easy. But he likes it enough to constantly challenge himself by learning new things. And he recommends anyone interested in the offensive side of security keep that in mind.
“Never stop learning,” is his advice for potential red teamers. “You’ll need to constantly be learning new things or this job will tire you out, so you’d better love what you do.”
Check out our open positions if you want to join Matti and the hundreds of other great fellows fighting to keep internet users safe from online threats.
Categories