All Together Now

SPEAKER_1 (0:00)

Hi, I'm Yohan Philippine, and I've got a hot take. One of the best things to come out of these last few eventful years is remote access to events. Red Hat Summit created an entire virtual content hub this year, so you can catch the highlights from the May event on your schedule without leaving your couch. For keynotes, technical sessions, and a whole lot more, register at no cost at red.ht forward slash on-demand. That's on-demand, one word.

See you there!

Saranya Barick (0:54)

It's the final scene of an epic horror movie. After grueling days of evading this monster, sacrificing herself and saving everyone she could, our hero has finally won. She collapses, exhausted, but relieved. She did it. It's over. But it's not really the end, is it? In the final, final scene, the camera turns toward the monster's lifeless face.

Snap open.

Evil does not stay dead. There's usually a sequel. And the big bad villain comes back bigger and badder than ever. That's why the further down the horror franchise you go, the more heroes have to level up and expand their team.

I'm Saranya Barak, and this is Command Line Heroes, an original podcast from Red Hat.

This season, we've been going face to face with some of the biggest monsters in tech, the viruses, Trojan horses, botnets, and ransomware that tried to destroy our digital lives. And we've learned that the more we move online, the larger the stakes get in these security battles. Everybody is being pulled into the fight. We're all part of the action, working to build a safer future. So in this episode for our season finale, we're looking at what that call to arms really means. How do we bring more voices, more people into security work? And why does it matter whether people with different backgrounds join that larger team? In other words, how does paying attention to every voice even in outsiders actually make things better for everyone?

Wietse Venema (3:07)

Satan was about awareness.

Saranya Barick (3:10)

Wietse Venema is a software engineer at Google. But back in the early 1990s, he was working on a new free tool called Satan. That stands for Security Administrator Tool for Analyzing Networks.

Nobody asked for Satan. It wasn't a company project or a government initiative. It was just a project driven by Venema and his friend Dan Farmer, who was then the security czar at Silicon Graphics. They had studied the new world of networked computers, and they felt they could build a tool that network needed.

Wietse Venema (3:48)

Just imagine that you have a bunch of computers that until recently were just stand alone. They were not connected with each other.

And certainly computers are networked together. Having access to one computer now means that you have access to a million computers. That's a lot of computers. That's a lot more than one.

Saranya Barick (4:08)

Those first networked computers were mostly at universities and large companies. And every institution might have a system administrator who handled a few security issues.

But protecting computers was often an afterthought. As we learned in our last episode, the first networked computers were full of security holes.

Wietse Venema (4:29)

The defenses of those computers were relatively weak.

Saranya Barick (4:35)

Hackers could use simple brute force attacks to guess passwords and break in.

Users were naive, and sometimes administrators weren't much better. What's worse, when one security team discovered a security flaw, they weren't sharing what they learned.

Wietse Venema (4:53)

Around that time, there was no disclosure of vulnerabilities, no process for doing that.

Saranya Barick (5:00)

In the early days of the Internet, you might do battle with a software bug or some new virus, but then you didn't pass on your solution or even report your problem. Everybody on the planet was tackling each security problem as though it were brand new.

So how do you change that system? How do you get people sharing information about all the known security issues they've come across? Enter Satan.

Wietse Venema (5:29)

People just didn't know that they had these problems on the network. So the purpose was to make an inventory of all the computers on your network and then probe with, I think, a dozen different vulnerability checks and report for all the computers all the problems that they had.

Saranya Barick (5:47)

A program that scans computers on a network for known security vulnerabilities and lets you know where they are. It even had a web interface, which was pretty slick at the time. There, system administrators could automate the process, easily scanning their system for security flaws. It also told you what kind of machines were being used and how they were connected.