Wellington
Three of Google's top internet security people are Kiwis - which on the law of averages ispunching way above our weight.
But there's a pretty good reason for them landing roles as the world's biggest search engine's(of just one of its roles) sheriffs, based in Zurich.
All three, Ben Hawkes, Darren Bilby ('Sham') and Morgan Marquis-Boire had worked at either
Ben Hawkes was essentially headhunted to Google after winning a competition “Google NativeCode” that exposed a number of security vulnerabilities. The company's HR department thencontacted Lateral Security's sales director Ratu Mason who quite unashamedly was able to say Hawkeswas a highly skilled operator who would be an absolute asset to any organisation. HelloZurich.
The fact that there are three NZrs in Google's goodies 'white hat' gang isn't surprising giventhis country's creative environment that encourages techies to look under software's covers.
Mason says there are a number of IT tools which can be run in New Zealand that are consideredillegal in Europe.
One example is Metasploit (no, sticK had never heard of it either), an open source platform thatprovides information and tools on system penetration - in other words a way of testingvulnerability.
These and other manual tools are used by security researchers to uncover vulnerabilities in alegitimate way and sometimes they get paid to find these holes. Both Microsoft and Google pay fortechies to find holes in their software in a legitimate way.
Mason says many organisations in this country let their IT people carry out vulnerability testingin the background, with managers either not understanding what’s being done or turning a blind eyeand hoping that the internet world is safe.
"The fact is, you need to discover things, you need to prod and poke," he says.
"It is always on the edge of legality; but the fact is that those guys who have gone to Googlehave done so because of their ability to push the boundaries and be creative at the edge."
The job of Google's security gurus is to "discover the next vulnerability, to be creative aboutthinking about them before someone else does."
An IT term called Zero-Day , arevulnerabilities within a system that can't be protected, mainly because they're newly discovered - anew virus with no cure for example.
Within Lateral Securities' daily work for its clients' systems, the company will often comeacross a Zero Day vulnerability. They will take this information to the original manufacturers ofthe services and software, pointing out the issue.
Mason regards this as being a responsibility to clients, "something we know about, but the restof the world doesn't."
Mason says this 'white hat' (read good guy) approach by NZ techies is partly a result of kiwis'have a go' culture.
"There's plenty of guys who will pull a PC apart in their garage, try to reverse engineersomething."
One example of this is the 'Kiwicon' event, recently heldfor the third time in Wellington. This year 350 IT individuals, "security nuts" as Mason calls them,attended, and such was the demand that numbers had to be restricted as tickets sold out in threedays.
"These people are enthusiasts, creative individuals," he says. "A lot don't know where to pointtheir attention, they're not comfortable to disclose their findings. This is an event where they canpoint their knowledge."