Vinnie Liu was only 17 years old when he landed his first job the National Security Agency (NSA). The year was 1999, and he worked onsignals intelligence gathering.
It was a formidable but typical start for Liu, now Bishop Fox CEO and co-founder. The NSA was looking for promising high school graduates with proven fluency in hacking and programming languages. Liu, then an incoming computer science majorwith apsychology minor at the University of Pennsylvania, spent two years commuting from Philadelphia to the NSA satellite office in Baltimore. His first year was focused on red-team hacking and the second on specialized tool development.
Working at the NSA really opened my eyes into how deep you can get, into how deep this rabbit hole can go," Liu says. "I had grown up with bulletin-board systems on the Internet. Cybersecurity wasnt even a term people used.
Thats about all he will say about his work at the NSA, except that it involved nation-state actors. But the experience left a lasting imprint.
It gave me a huge sense of being mission-driven, Liu says. Were missionaries, not mercenaries. Our mission, fundamentally, is to keep people safe both online and offline.
That mission ultimately manifested itself as Bishop Fox, an offensive security firm whose team of hackers pretend to be villains. In other words, they try every possible way to penetrate a clients security defenses, including adversary simulations and purple teaming (red teaming and advising the clients blue team at the same time).
But for all the criminal cunning that Bishop Fox staff need to employ, Liu thinks of the companys work in medical terms. Bishop Fox, he says, is the doctors doctor.
There are so many similarities between good health practice and security, he tells Dark Reading. You dont just prescribe pills and thats it. You dont eat healthy and exercise once and thats it.
This approach is a view into the two personal qualities underlying Lius success: his sense of purpose missionaries, not mercenaries and his palpable scorn for complacency. Lius brand of optimism is hard, even austere.
People in the industry have too pessimistic a view, he says. I dont even like the joke, 'Its not if you get hacked, but when.' Our whole philosophy is defending forward.
Career PathLike many successful tech firms, Bishop Fox has humble origins: the living room of a bachelor pad.
Liu had graduated from Penn in 2003, having focused on network security and adaptive intrusion detection services. He then joined Ernst & Young as a security consultant, performing penetration testing for Fortune 500 clients. Liu calls Ernst & Youngs Advanced Security Center a kind of NSA for the private sector.
Working with Liu at Ernst & Young was Francis Brown, now on Bishop Foxs board. Brown and Liu had lived on the same hall as freshmen at Penn, and both studied computer science. They were the only first-year students in their program who did not drop out within the year, Liu says. The two friends lived as housemates in Arizona, where as long as we could afford pizza and Internet, we were good to go.
Honeywell would eventually poach both men from Ernst & Young; Liu would lead Honeywells global penetration testing team, plus the teams of Honeywells various subsidiaries. The chance to build up Honeywells team was an exciting prospect, but turned out to be a limited opportunity: Once the team was built, the slower pace of work left Liu (and Brown) restless. Liu had outgrown the role; by 2005 he was speaking at conferences like Black Hat on how to bypass anti-forensic tools a skill he had been developing since his teens. Both Liu and Brown started moonlighting as independent security professionals.
Then one day, in 2006, Liu, Brown, and a third contributor sat in the living room and toyed with the idea of launching a security services startup.
We said, Why not? Liu remembers. We were really enjoying this.
From 2006 to 2009, we were a lifestyle company, says Liu, referring to the fact that the company was still kind of a hobby for them. In 2009 they switched to a professional mindset, and Bishop Fox was born. Liu and his partners set about recruiting the best talent they could find and attracting bigger and bigger-name clients. Their revenue rose, despite launching during the Great Recession.
It was also the Titan Rain era when a string of attacks believed to be the work of Chinese state-sponsored actors compromised a number of government agencies in the United States and United Kingdom and companies and government agencies were beginning to realize how vulnerable they really were. Binary analysis and incident-response forensics were suddenly in high demand. Liu was one of only a few hundred people in the United States who had any experience with both of these functions, and most of his peers had only worked with disk forensics.
We sucked at it back then! he laughs. Everyone did. We were playing catch-up with the people writing the viruses.
Fast-Forward to NowThese days Bishop Fox offers various assessment tests, including the comprehensive 4+1 methodology, in which several assessments and simulations are built around a central tabletop exercise. But all of the company's services involve continuous work with a clients developers, architects, and teams, rather than the waterfall style of performing one test here and another test there. Sometimes an assessment alone can take two months to complete.
This is not a let me just kick the tires kind of scan, Liu says. We look at code. We look at business logic issues. We like to find the hard problems, we always exploit, and were going to chase it down all the way.
Liu doesn't let clients rest on their brand-new tools or infrastructure either. Youve got to get the basics right," he says. "We teach them how to take a punch and keep going.
Twelve years later, the threats have grown, attackers have become more sophisticated, and defenders are changing how they approach security. Liu has observed security teams shift away from compliance-based security and toward ongoing, developmental security operations.
What does that mean for Bishop Fox?
Weve been very discreet, says Liu. I think its time to come out of our shell. Weve done good work with big name clients. Its time to go out into the world and talk, to bring good work to more people.
The landscape may have changed, but Lius mission hasnt: keeping people safe, online and off.
PERSONALITY BYTES
What is Vinnie Lius greatest success? This sounds terrible, but Im really proud of the people who have come through Bishop Fox. Some of our alumni have become CISOs at publicly traded companies. Recruiters will just hang up if they hear you work at Bishop Fox [because they know how hard it is to hire people away].
One thing his colleagues would never guess about him? I dance goofy, I sing loudly, roll on the ground, make faces. Ill do anything to make my kids laugh and smile.
His dream job if he worked in a different industry? Definitely something where I make things with my hands food for people, construction, etc.
Favorite thing to do in his spare time? My pandemic skill has been failing to grow things in my garden. The universe has somehow blighted the 32-square-feet of backyard where my garden lies.
Favorite book? Im a huge sci-fi/fantasy book nerd. The more space battles, wizards, and aliens, the better.
Here is the original post:
Vinnie Liu Has a Mission: Keeping People Safe Online and Offline - DARKReading
- NSA fears quantum computing surprise: 'If this black swan event happens, then we're really screwed' - Washington Times - March 27th, 2024 [March 27th, 2024]
- The NSA Warns That US Adversaries Free to Mine Private Data May Have an AI Edge - WIRED - March 27th, 2024 [March 27th, 2024]
- Five ways to implement zero-trust based on NSA's latest guidance - SC Media - March 27th, 2024 [March 27th, 2024]
- Intel analyst shared classified information on Discord, investigators say - The Washington Post - March 27th, 2024 [March 27th, 2024]
- Water Systems Vulnerable To Cyber Attacks, NSA And EPA Warn Governors - Forbes - March 27th, 2024 [March 27th, 2024]
- Amritpal Singhs mother, kin of other NSA detainees go on hunger strike, want them to be shifted to Punjab jail - The Tribune India - February 24th, 2024 [February 24th, 2024]
- Rob Joyce leaving NSA at the end of March - CyberScoop - February 24th, 2024 [February 24th, 2024]
- NSA cyber director to step down after 34 years of service - Nextgov/FCW - February 24th, 2024 [February 24th, 2024]
- Behind Khattar govts U-turn on NSA against farm leaders, fear of rural blowback, Congress gain - The Indian Express - February 24th, 2024 [February 24th, 2024]
- Payday dispute prompts maintenance worker walkout at NSA Naples - Stars and Stripes - February 24th, 2024 [February 24th, 2024]
- CISA, NSA, and FBI Warn of Chinese Cyber Hacking Army The Presidential Prayer Team - The Presidential Prayer Team - February 24th, 2024 [February 24th, 2024]
- Cyber Security Headlines: Microsoft takes another hit, Energy giant hit by ransomware, the NSA is secretly buying your ... - CISO Series - January 30th, 2024 [January 30th, 2024]
- India now cooperating with Nijjar probe: Canada's NSA - IndiaTimes - January 30th, 2024 [January 30th, 2024]
- Google, WhiteSnake, Outlook, NSA, Juniper, Jason Wood, and More SWN #358 - SC Media - January 30th, 2024 [January 30th, 2024]
- Readout of NSA Jake Sullivan's Meetings with PM Srettha and DPM/FM Parnpree - US Embassy in Thailand - USEmbassy.gov - January 30th, 2024 [January 30th, 2024]
- NSA Admits Secretly Buying Your Internet Browsing Data without Warrants - The Hacker News - January 30th, 2024 [January 30th, 2024]
- Readout of NSA Jake Sullivan's Meeting with CCP Politburo Member, Director of the Office of the Foreign Affairs ... - US Embassy & Consulates in... - January 30th, 2024 [January 30th, 2024]
- Former NSA Saint has a chance to become repeat Super Bowl champion - The Suffolk News-Herald - Suffolk News-Herald - January 30th, 2024 [January 30th, 2024]
- NSA is buying Americans internet browsing records without a warrant - TechCrunch - January 30th, 2024 [January 30th, 2024]
- As NSA buys up Americans' browser records, Uncle Sam is asked to simply knock it off - The Register - January 30th, 2024 [January 30th, 2024]
- NSA buys sensitive data on Americans without any court order - KJZZ - January 30th, 2024 [January 30th, 2024]
- NSA Veteran Teresa Shea Joins Board of Directors of Two Six Technologies - ExecutiveBiz - January 30th, 2024 [January 30th, 2024]
- How the FBI, NSA are preparing for deepfakes and misinformation issue ahead of 2024 elections - CNBC - January 14th, 2024 [January 14th, 2024]
- AI is helping US spies catch stealthy Chinese hacking ops, NSA official says - CyberScoop - January 14th, 2024 [January 14th, 2024]
- AI aids nation-state hackers but also helps US spies to find them, says NSA cyber director - TechCrunch - January 14th, 2024 [January 14th, 2024]
- NSA Director Paul Nakasone to Step Down in Early February - Bloomberg - January 14th, 2024 [January 14th, 2024]
- NSA says cybersecurity will gain many benefits with generative AI - ReadWrite - January 14th, 2024 [January 14th, 2024]
- FBI and NSA directors discuss their concerns about AI - WCBE 90.5 FM - January 14th, 2024 [January 14th, 2024]
- Looking back at 2023 with the NSA's Rob Joyce and Morgan Adamski - CyberScoop - January 14th, 2024 [January 14th, 2024]
- NSA: Benefits of generative AI in cyber security will outweigh the bad - ITPro - January 14th, 2024 [January 14th, 2024]
- AI Identified as Emerging Threat in Cyber Crime by NSA Director - CoinGape - January 14th, 2024 [January 14th, 2024]
- AI is helping China-backed hackers but it's also helping to hunt them down, NSA says - TechRadar - January 14th, 2024 [January 14th, 2024]
- Top 10 misconfigurations: An NSA checklist for CISOs - The Stack - October 20th, 2023 [October 20th, 2023]
- CISA and NSA Issues New Identity and Access Management Guidance for Vendors - TechRepublic - October 20th, 2023 [October 20th, 2023]
- How to Protect Against Evolving Phishing Attacks - National Security Agency - October 20th, 2023 [October 20th, 2023]
- NSA Shares Recommendations to Advance Device Security Within ... - National Security Agency - October 20th, 2023 [October 20th, 2023]
- Nansemond-Suffolk tennis falls to Norfolk Academy Thursday - The ... - Suffolk News-Herald - October 20th, 2023 [October 20th, 2023]
- NSA calls for a 'root and branch' review of Red Tractor - Farmers Guardian - October 20th, 2023 [October 20th, 2023]
- Israel's NSA warns of US intervention as Gaza conflict escalates - IndiaTimes - October 20th, 2023 [October 20th, 2023]
- The U.S. government is still in its Tumblr era. - Slate - October 20th, 2023 [October 20th, 2023]
- Biden's Cyber Command and NSA nominee seen as a pick for continuity - The Record from Recorded Future News - July 17th, 2023 [July 17th, 2023]
- 5 Reasons to Work for the NSA - ClearanceJobs - ClearanceJobs - July 17th, 2023 [July 17th, 2023]
- I will do my best as NSA: Ribadu promises - FRCN HQ - Federal Radio Corporation of Nigeria - July 17th, 2023 [July 17th, 2023]
- Plateau killings: Reps ask NSA to declare national emergency - TheCable - July 17th, 2023 [July 17th, 2023]
- 7th Deputy NSA Meeting of Colombo Security Conclave held in ... - ANI News - July 17th, 2023 [July 17th, 2023]
- Young shepherd from region wins NSA North Sheep trophy ... - Darlington and Stockton Times - July 17th, 2023 [July 17th, 2023]
- HBO film based on NSA leaker Reality Winner slated for May 29 ... - Military Times - May 18th, 2023 [May 18th, 2023]
- Tina Satter on why her NSA whistleblower film Reality is stranger than fiction - Financial Times - May 18th, 2023 [May 18th, 2023]
- Gen. Paul Nakasone Plans to Step Down as NSA Director ... - Executive Gov - May 18th, 2023 [May 18th, 2023]
- Readout of NSA Jake Sullivan's Meeting with CCP Politburo ... - US Embassy & Consulates in China - May 18th, 2023 [May 18th, 2023]
- Young sheep farmers to be given genetic boost by new NSA giveaway - The Scottish Farmer - May 18th, 2023 [May 18th, 2023]
- Sydney Sweeney wanted to be challenged by Reality: Its a different muscle playing someone who is real [Exclusive Video Interview] - Yahoo... - May 18th, 2023 [May 18th, 2023]
- Intercepted: The Biggest Whodunnit of the Century - The Intercept - May 18th, 2023 [May 18th, 2023]
- Personal injury + the No Surprises Act - Chiropractic Economics - May 18th, 2023 [May 18th, 2023]
- PM Narendra Modi e-inaugurating new office complexes of CBI at Shilong, Pune and Nagpur, commemorating the CBI diamond jubilee on Monday. Also seen... - April 4th, 2023 [April 4th, 2023]
- Special Collection Service - Wikipedia - March 31st, 2023 [March 31st, 2023]
- What is the NSA and how does it work? - SearchSecurity - February 5th, 2023 [February 5th, 2023]
- Watch: NSA Ajit Doval is Ambitious, Very Good at Sniffing Power and Being on the Right Side of itAS Dulat - The Wire - December 21st, 2022 [December 21st, 2022]
- Shockwaves win another championship, this time at the NSA Fresno Pilgrimfest - Lompoc Record - December 12th, 2022 [December 12th, 2022]
- EFCC secures forfeiture of N755m, luxury assets from ex-AGF, former aide to NSA The Nation Newspaper - The Nation Newspaper - November 23rd, 2022 [November 23rd, 2022]
- What is the National Security Agency? - Norwich University - October 25th, 2022 [October 25th, 2022]
- Cyber Security Today, Oct. 19, 2022 A warning from the NSA about nation-state attacks, and more - IT World Canada - October 21st, 2022 [October 21st, 2022]
- In the Alphabet Soup of Regulations, the NSA, GFE and AEOB Have Yet to Coalesce - RACmonitor - October 6th, 2022 [October 6th, 2022]
- Do not ignore any communication shared by NSCS, NSA: PM Modi to ministers - The Hindu - October 6th, 2022 [October 6th, 2022]
- NSA Announces Date of the National Cryptologic Museum Grand Opening - National Security Agency - October 2nd, 2022 [October 2nd, 2022]
- NSA and ACLU may face off in the Supreme Court over Wikipedia - Grid - October 2nd, 2022 [October 2nd, 2022]
- The NSA is Here to Help | Decipher - Duo Security - September 27th, 2022 [September 27th, 2022]
- Hollen, Raskin Join with NSA Bethesda Fire Fighters, IAFF Leaders to Highlight Progress on Efforts to Improve Base Conditions, Build New Facility |... - September 27th, 2022 [September 27th, 2022]
- CISA, FBI, NSA, Treasury, Cyber Command, and International Partners Release Advisory on Malicious Cyber Actors Affiliated with Iranian Government... - September 20th, 2022 [September 20th, 2022]
- NATFORCE: Buhari Finally Disbands Security Outfit After Senate Ignored NSA To Recognize Body The Whistler Newspaper - The Whistler Nigeria - September 20th, 2022 [September 20th, 2022]
- China Accuses NSA of Hacking Its Military Research University - VICE - September 9th, 2022 [September 9th, 2022]
- Behind the Toque: An Interview with NSA Noodle Bar Executive Chef Brooke Apfelbaum - greenpointers.com - September 9th, 2022 [September 9th, 2022]
- In the Garden: Tour gives Omahans a chance to see how a 'Bloom Box' works - Omaha World-Herald - September 9th, 2022 [September 9th, 2022]
- Three area teams pickup wins to start football season - The Suffolk News-Herald - Suffolk News-Herald - September 9th, 2022 [September 9th, 2022]
- NSA to reveal identities of big men behind oil theft in Nigeria Presidency - Daily Post Nigeria - August 22nd, 2022 [August 22nd, 2022]
- Former US Cyber Command and NSA chief makes the case for a cyber competition strategy | The Strategist - The Strategist - August 22nd, 2022 [August 22nd, 2022]
- Inaugural India-Central Asia NSA meeting to be held in December - WION - August 22nd, 2022 [August 22nd, 2022]
- Home | Open Source @ NSA - August 8th, 2022 [August 8th, 2022]
- Kennesaw State named top institution for cybersecurity outreach - Kennesaw State University - August 8th, 2022 [August 8th, 2022]
- US city of Boston to mark 75th anniversary of India's Independence with two-day extravaganza - NewsDrum - August 8th, 2022 [August 8th, 2022]