DevSec For Scale Podcast – OSINT and Security w/ Nick DiPasquale, Security Researcher

In this episode of the “DevSec for Scale” podcast, Jeremy Hess interviews Nick DiPasquale, a security professional with a background in system administration, systems engineering, and DevOps. Nick emphasizes that people remain the most common attack vector in security breaches, a challenge that persists despite technological advancements. He highlights the need for both technical and human-focused solutions to mitigate security risks effectively.

Nick shares his journey into the security field, driven by his passion for open source intelligence and the ability to gather actionable data from publicly available sources. He currently works at Benbrook, focusing on managed detection and response (MDR) and developing services to protect the human element beyond corporate environments. Nick underscores the importance of creating a security culture within organizations, emphasizing that security should be integrated into every aspect of the workflow without significantly inconveniencing employees.

During the discussion, Nick recounts a real-world example of a red team exercise where he successfully exploited publicly available information to gain unauthorized access to a target’s system. By crafting a personalized phishing email based on the target’s social media activity, he demonstrated how easily attackers can manipulate human behavior to breach security defenses. This case underscores the critical need for individuals and organizations to be vigilant about the information they share online.

To conclude, Nick offers valuable advice for younger companies and startups. He stresses the importance of adopting a security-first mindset from the beginning, integrating security practices into the development workflow and company culture. By doing so, organizations can avoid the pitfalls of trying to retrofit security measures later, which can be both challenging and disruptive. This proactive approach helps ensure that security becomes a foundational aspect of the company’s operations, ultimately protecting it from potential threats.