Interview with John Chirillo, author of "Hack Attacks Testing: How to Conduct Your Own Security Audit"
by Mirko Zorz - Friday, 4 April 2003.
Who is John Chirillo? How did you gain interest in computer security?

Like most computer enthusiasts I began my career early on. At twelve years old I wrote a game entitled Dragon's Tomb. This program was published for the Color Computer (COCO) System market. During the next five years I wrote several other software packages including, The Lost Treasure (a game writing tutorial), Multimanger (an accounting, inventory and financial management software suite), Sorcery (an RPG adventure), PC Notes (GUI teaching math from Algebra to Calculus), Falcon's Quest I and II (a graphical, Diction-intensive adventure) and Genius (a complete windows-based point-and-click operating system).

From there I went on to attain certifications in numerous programming languages and entered the field as a consultant. I began working for companies performing numerous functions such as LAN/WAN design, implementation and troubleshooting, and developed a specialization in security and analysis. During this period I acquired internetworking and networking certifications including those of Cisco, Intel, Compaq, and CISSP, among others. To that end I authored and coauthored books including Hack Attacks Revealed, Hack Attacks Denied, Hack Attacks Encyclopedia, Networking Lab Practice Kit, Storage Security and Hack Attacks Testing.

Do you have any favorite security tools?

Yes, with regard to my favorite *NIX tools I most often use Nmap, hping and Nessus. On the subject of Windows-compatible security tools I use TigerSuite, a custom build of snmpwalk and most of the tools you can download at

How long did it take you to write "Hack Attacks Testing: How to Conduct Your Own Security Audit" and what was it like?

I put together the manuscript for HAT in about 10 weeks. The editors at John Wiley & Sons and I felt that among available InfoSec books there hadn't been much coverage on conducting security audits from a fundamental perspective. Albeit the presentation of tools and step-by-step techniques in the book mostly target security neophytes and managers, I found it enjoyable to rebuild my multi-OS TigerBox, target systems and compile the tools. In hindsight, however, I would like to have been permitted a much higher page count to include another 30 or so additional security tools.

What do you see as the major problems in online security today?


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Mon, Feb 8th