Tales From the Crypt... Analyst: The Afterlife

Jeff Man picks up his story where his earlier talks left off, following his path from the National Security Agency into the private sector during the early years of commercial internet security. He recounts how a small NSA group that performed authorized network testing gave him early experience with penetration work, and how the government-contractor world of the 1990s shaped methods later used across the industry. Along the way he describes the vulnerability scanners, intrusion detection products and war-dialing tools of that era, and the rapid pattern of firms being bought, merged and rebranded.

The middle of the talk covers his consulting years, including client engagements that uncovered weak passwords and misconfigured database servers, and his growing frustration when the same weaknesses reappeared months later. He argues that a penetration test is a narrow snapshot rather than proof of security, and that organizations need policy, process and executive buy-in. He then explains his move into PCI compliance work and how the standard's requirements place vulnerability management ahead of testing.

He closes with a set of recurring mistakes that users, executives and IT staff keep making, many of which he says persist decades later. In the question-and-answer session he is asked about career advice, which he answers by urging newcomers to find work they enjoy and stay curious, and about the value of penetration testing as an assurance tool.