Orion's Quest: Navigating Cyber Wilderness - Tales of Modern Pentesting

Kevin Johnson, founder of a penetration testing firm, argues that testers should explain how attacks happened rather than only list findings. He opens by criticizing the habit of treating techniques as secret and reports that give raw issue counts without a narrative of what was tested and why it matters to the business.

The middle of the talk walks through several engagements. A membership organization's registration flow exposed personal records through a predictable numeric identifier that could be changed to pull other members' data, and nothing monitored that unauthenticated path. A military contractor's guest wireless captive portal led to command execution, then to the internal domain after a network consolidation had merged guest and private infrastructure. Physical tests covered walking through a hospital and a bank data center, and a phishing exercise showed that a copied internal contact often clicked first. A scanner account with broad rights was also shown to expose more than expected.

The closing section turns to defenders. Johnson argues that security teams should first examine their own behavior, such as unlocked workstations, unnecessary admin rights and their own susceptibility to social engineering, and that users often spot breaches before tools do. The practical takeaway is to test your own registration and login flows, review applications that were built internally and may have been overlooked, and write reports that explain real risk.