How Semgrep's Cris Thomas sees the industry-hacker divide

The online cybersecurity community is a vital force when it comes to identifying and closing vulnerabilities in software and systems. However, many organizations seem determined to keep that community at arm’s length—even if the latter’s work can help keep tech stacks secure.

Cris Thomas, security advocate at cybersecurity company Semgrep, told IT Brew that this tension is a longstanding one.

Thomas entered the cybersecurity scene via L0pht Heavy Industries, an early hacker collective. In 1998, Thomas, and his L0pht colleagues testified in front of Congress about the younger internet’s vulnerabilities.

Since then, Thomas has worked in cybersecurity roles for companies like IBM, Tenable, and Trustwave, while also serving as a white hat hacker and cybersecurity pundit.

Let’s start at the beginning. Thomas’s earliest memories of working with technology include building flashlights from old cell batteries, some wire, and a lightbulb so he could read at night. Back then, his reading choices included Little House on the Prairie or the Hardy Boys series. From there, he plunged into tech and speculative-fiction literature such as Stand on Zanzibar, Zero Day, The Cuckoo’s Egg, and more.

Obviously, Thomas’s reading list has changed. But some things have largely stayed the same for the broader cybersecurity community.

In the 80s and 90s, Thomas said, “a lot of people were hidden behind their keyboards, and so you would have folks who were looking for found families…looking for a subculture to belong to.” While some people on the fringe of the mainstream sought solace in punk music or other subcultures, Thomas and others found themselves picking apart vulnerabilities in infrastructure.

“I see a much more accepting culture today, at least in the community,” he said. “As far as the industry goes, industry’s always been industry, and industry likes to sell to industry. And anything that’s sort of different sometimes gets frowned upon.”

Community service. According to Thomas, parts of the cybersecurity industry have an issue with including the broader cyber community in its defensive workflows.

“It’s definitely an issue that’s been ongoing for a while; we have some companies that don’t want to have anything to do with the community at all, and because they’re afraid of the hacker label,” Thomas said. “I think that industry as a whole would be better served if they were more ingrained with the community; and the community, of course, gets the benefit of more jobs.”

For companies that embrace the cybersecurity community, there’s the added benefit of that community’s collective knowledge.

“Some of the best security operations that I’ve been involved in have had multiple community participants in them,” Thomas said. “Sometimes companies shy away from community participants, and I think that’s wrong, I don’t think you’re getting the best value for your dollar, you’re not getting the best value for your people.”