This week, Zac chats with Nick Delewski. Nick is a Principle Security Consultant at MedSec (https://www.medsec.com/) specializing in medical device testing. Zac and Nick talk about the current state of medical device testing and cybersecurity regulation, Nick's favorite tools including a microwave oven (see below), and get a story from Nick about the most physical danger he has ever been in on a penetration test!
Blade RF: https://www.nuand.com/bladerf-1/
Dragon OS: https://cemaxecuter.com/
Microwave Oven: https://amzn.to/4dW3EW2 LOL
Episode Summary
In Episode 14 of War Stories, host Zac Davis talks with Nick Delewski, Principal Security Consultant at MedSec, where he specializes in medical device security testing. They cover his winding path into offensive security, the state of medical device and OT security, safe RF testing, and the PCI engagement where he walked out of a data center into an evacuated building.
Nick's first brush with security came in the bulletin board days, when a downloaded screensaver taught him about computer viruses. He started college in mechanical engineering, worked the student help desk to pay his way, learned Active Directory and domain trusts managing multiple domains, and spent time on the blue team in financial services before moving into red teaming at Core BTS, where he stepped into the role John Baek left behind (hear John in Episode 12). Today he tests medical devices, where security delays can affect patient care, and talks about using Faraday cages so RF testing stays within the rules.
His war story is a PCI penetration test at a busy warehouse with an on-site data center. Nick worked his way to credentials that proved access to the cardholder data environment, then stepped out of the data center to find the normally loud warehouse completely empty, with red and blue strobe lights flashing down the hall. A forklift had sheared a natural gas main, the fire department could not find the shutoff, and Nick had spent roughly three hours testing in a building filling with gas.
In This Episode
- Nick Delewski's path from bulletin boards and the help desk to red teaming
- Medical device security testing and why delays can affect patient care
- Operational technology (OT) security and legacy systems
- Using Faraday cages for safe, compliant RF and wireless testing
- A PCI penetration test that ended with an evacuated warehouse
Is Your Cardholder Data Environment Really Isolated?
SEVN-X runs PCI and internal penetration tests and red team engagements that show whether segmentation holds up against a real attacker. Read our guide to what PCI DSS is and is not, or talk with our team about scoping a test for your organization.
