This hacker wears white

He could have conquered the world with his superhuman powers, but Clark Kent chose to be on the good side, beckoning his Superman alter ego to defend the weak.

The so called “white hat” hackers of the IT world, like the Metropolis Man of Steel, could also have turned bad and joined the havoc wreaking dominion of IT’s dark side; instead, they use their technical flair helping companies strengthen their defenses against malicious attacks.

Twenty-three-year-old Paul Haas’s job title is “security engineer” but simply put, he is a hacker by profession. He hacks into corporate systems and seeks out vulnerabilities that can be exploited. But he does it as a service and with the knowledge and permission of the subject company.

“Using the knowledge I gained through research and vulnerability gathering, I prepare a report that itemizes the risks of each of those vulnerabilities and the priorities in terms of what should be fixed first,” explains Haas, who works at Redspin, a security consulting firm in Carpinteria, Calif.

Haas has only been with Redspin less than a year, but he’s no stranger to IT security. During his undergraduate studies at the University of California Santa Barbara (UCSB), Haas got involved and worked at the university’s computer security research lab, alongside various post-graduate researchers.

At 22, he was one of the youngest and the only undergraduate among a team of IT researchers that won at last year’s Def Con Capture the Flag contest.

Capture the Flag is a hacking competition where each team is given a set of computer systems with built in security. The object is to break into as many of these computers as possible within a prescribed time period.

Haas says winning Def Con was one of the best things that happened to him. “Once you compete with a really good team, you can actually say that in an instant…that’s the highlight of my career.”

Shortly after winning Def Con, Haas earned his Bachelor’s Degree in Computer Science and worked for Redspin. His accomplishment at the hacking event may have helped put Haas on the radar of potential employers like Redspin, but it was his research background that added trustworthiness to his credentials, says Redspin’s president John Abraham.

Abraham admits Def Con is not typically the place where his company would look for candidates, but when he heard about Haas’s work at the university research lab he knew Haas was working on the good side.