Cybersecurity Mentors Podcast · Cybersecurity Mentors

35 Years in Cybersecurity: Randy Marchany’s Biggest Lessons

·1 hr·1 clip

How a 1991 hacking incident led to creating the SANS cybersecurity curriculum

Randy Marchini talks with Jon Hoyt and Steve Higureta. He introduces himself as CISO at Virginia Tech in Blacksburg, Virginia. He says he has held the job for 15 years and will retire from the role in July. The conversation looks back at how he and Ron got pulled into security through a SANS call for proposals. They realized they could talk about what had happened to them, even if they did not yet think of themselves as experts. The story then shifts back to an early-Internet incident from 1991. Marchini describes seeing a login at 4 in the morning and sending a joke about the vampire club. The attacker stayed persistent, and the team kept rebuilding systems only to see the logins return. They found the `crack` password-guessing program out on the net and ran it against their user IDs. In that era, Unix password hashes lived in `/etc/passwd`, so copied files could be cracked offline. Once they identified user IDs, fresh login attempts showed up about 48 hours later with the old password. That pointed to the method: the intruder copied the `/etc/passwd` file, ran `crack` on it, and came back with valid credentials. The cleanup took about two and a half months. The attack route also passed through an MIT machine that was intentionally left open as a service on the Internet, which the attacker in Oregon used to pivot into other systems. The episode turns that history into a lesson about persistence, old infrastructure, and how a small weakness can become a long cleanup.

As heard by us

A veteran CISO turns early break-ins into durable security lessons.

Randy Marchini reads as a CISO shaped by the work, not by theory: 15 years at Virginia Tech, retirement coming in July, and a career marked by early break-ins, copied Unix password files, and the 1991 password-cracking era.

Read the full review in PlayNext →

Why you'd press play

Want a veteran CISO's plain talk on how security work wears on you?

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Cybersecurity Mentors Podcast