Who is John Chirillo? How did you gain interest in computer security?

Like most computer enthusiasts I began my career early on. At twelve years old I wrote a game entitled Dragon's Tomb. This program was published for the Color Computer (COCO) System market. During the next five years I wrote several other software packages including, The Lost Treasure (a game writing tutorial), Multimanger (an accounting, inventory and financial management software suite), Sorcery (an RPG adventure), PC Notes (GUI teaching math from Algebra to Calculus), Falcon's Quest I and II (a graphical, Diction-intensive adventure) and Genius (a complete windows-based point-and-click operating system).

From there I went on to attain certifications in numerous programming languages and entered the field as a consultant. I began working for companies performing numerous functions such as LAN/WAN design, implementation and troubleshooting, and developed a specialization in security and analysis. During this period I acquired internetworking and networking certifications including those of Cisco, Intel, Compaq, and CISSP, among others. To that end I authored and coauthored books including Hack Attacks Revealed, Hack Attacks Denied, Hack Attacks Encyclopedia, Networking Lab Practice Kit, Storage Security and Hack Attacks Testing.

Do you have any favorite security tools?


Yes, with regard to my favorite *NIX tools I most often use Nmap, hping and Nessus. On the subject of Windows-compatible security tools I use TigerSuite, a custom build of snmpwalk and most of the tools you can download at foundstone.com.

How long did it take you to write "Hack Attacks Testing: How to Conduct Your Own Security Audit" and what was it like?

I put together the manuscript for HAT in about 10 weeks. The editors at John Wiley & Sons and I felt that among available InfoSec books there hadn't been much coverage on conducting security audits from a fundamental perspective. Albeit the presentation of tools and step-by-step techniques in the book mostly target security neophytes and managers, I found it enjoyable to rebuild my multi-OS TigerBox, target systems and compile the tools. In hindsight, however, I would like to have been permitted a much higher page count to include another 30 or so additional security tools.

What do you see as the major problems in online security today?