Job diary: I’m a ‘white hat’ hacker. Here’s what my job is like, and 5 things I think everyone should do to protect their personal information.

• Frank Villani is a 53-year-old information security specialist based in New Jersey who’s worked in information technology for 24 years and IT security for 12 years.
• He’s a ‘white hat’ hacker, someone who works on the inside of an organization to protect its internet systems from ‘black hat’ hackers who want to violate computer security for personal gain.
• For personal security measures, Villani says you should change your passwords every 45 days, be careful using public ATMs, pay in cash or credit cards at gas stations, and avoid using public WiFi unless it asks for credentials or consent.
• This is his story, as told to freelance writer Jenny Powers.
• Visit Business Insider’s homepage for more stories.

My name is Frank Villani. In a nutshell, my job is to test what those of us in the industry refer to as IOT — ’the internet of things’ that encapsulates anything connected to the internet. These things range from Amazon’s Alexa and video doorbells to cloud computing and software to make sure they are secure.

Often I do this by replicating the actions of a malicious hacker in order to seek countermeasures to secure a system. A lot of what I do is painting pictures of what could happen and evaluating the risks that are involved if it does.

I’m what you’d call a ‘white hat’ hacker.

I work for a company in New Jersey where my job is to protect the organization as well as its assets and clients. I’m not looking for gain or notoriety or popularity. It’s more like a treasure hunt for me; in the end, if I get it right, I did my job, so I pat myself on the back and move on.

‘Gray hat’ hackers may violate ethical standards but they don’t have any malicious intent. It’s the ‘black hat’ hackers everyone is most familiar from television and film. These are the guys that maliciously violate computer security for personal gain. They are out to ruin reputations and take money, like recently when Garmin was compromised. 

My days range from creating systems to try and catch people attempting to compromise our systems, compliance patching — the process of deploying software updates to help resolve critical security flaws or vulnerabilities that could be exploited by attackers — and ‘dumpster diving’ which refers to retrieving information that could be used to carry out an attack on a computer network such as Post-its with passwords written on them, or a client’s credit card number on a slip of paper. I also conduct internal audits, and even retrieve company laptops that people have left lying around the office.

I'm 53, and have worked in information technology for 24 years and IT security for 12. 

Initially, I got my CISA (Certified Information Systems Auditor) certification which needs to be recertified every three years as well as my CISM (Certified Information Security Manager) Certification, a four-hour exam that required three years on the job, one year in IT, and eight months of study. Both certifications are from ISACA, the Information Systems Audit and Control Association, a global association focused on IT governance. My credentials require me to follow local and federal law/policy as the first priority and then company policy. I'm going for my Risk Certification next. 

Prior to life in IT, I worked in the hospitality and retail industries. In the 1990s, computers were popping up in lots of businesses, and as the new kid fresh out of college, I was the one that always got tossed the technology work since no one wanted to deal with it. I remember working at the Holiday Inn and handling the setup for new hotel reservations at the time. We were transitioning from the old green-screen terminals to Windows 95. I spent a good amount of time showing my older colleagues how to use a mouse. 

Prior to my even considering a career in IT, I was 23 years old and working as an assistant manager at Walgreens when I managed to catch a cigarette smuggling scam at the store. I did by shoulder-surfing the cashier's part of the scheme, meaning I was discreetly looking over their shoulder to obtain information of what they were up to. I also reviewed the transactions they were falsifying, monitored their body language, and took notes which led to their arrest. I was given the Loss Prevention Employee of the Year Award by the company's regional manager. 

Later on, when I worked in IT, I was alerted through the company system that a contractor working for me was visiting porn sites. I checked it out and my curiosity kicked in and I began digging. It turns out this individual was using one of my test servers to buy government badges and uniforms on Etsy. Upon further investigation, I found he kept photos of NYC-NJ bridges and reservoirs hidden inside a few nested folders and was also looking at vehicle rental options. This was all post 9/11, and he wound up being deported by the FBI. 

People don't realize how much personal information they share. 

I can hack someone on social media in about five minutes using the information they share. It's kind of a combination of social engineering and old school lock-picking. I could post on my social media outlets that I got a puppy and I need some ideas for dog's names and ask what people named their dogs. Do you know how many people use their pet's name as their password, and now I have access to that? 

There are so many ways hackers can gain access to your personal information and wreak havoc on your life. 

Here are a few common ploys to be on the lookout for:

1. Do not use public WiFi unless it asks for credentials or consent.

Let's say you're in line at the bank, and while you're waiting you decide to log onto your banking app to check your balance. You log on to the WiFi to access your bank account and you see a WiFi server with the name of your bank on it. You use it because you imagine your bank server is safe. Guess what? Unless that server asked for your credentials or consent, it's likely a trap. It could be me, Frank, sitting in my car having created a fake server using your bank's name to gain entry into your account. 

2. Be aware of your surroundings.

Hackers take advantage of places where people let their guard down. One common trap is positioning a mirror over the ATM, which allows them to see your pin number and access your account, so always look around for anything suspicious before entering your pin number.

It's also common for hackers to add skimmers on gas station credit card portals which steal your information, so to protect yourself always pay by credit card instead of using a debit card, especially for gas and gas station conveniences.

3. Be alert when using your credit card in public places.

These days phone cameras are able to zoom in from 15 feet away, so be careful and don't leave your credit card laying on the table at the restaurant or at a cashier's station, where someone can snap a photo of your card and then zoom in to steal the card number. 

4. Change your password every 45 days.

The biggest mistake people make is getting comfortable and keeping their passwords the same for long periods of time. You should really change your password every 45 days and set passphrases instead of passwords because they are harder to hack. Also, do not use any password saver apps because they can all be compromised.

The safest way to maintain a list of your passwords is to create a password-protected Excel spreadsheet. Just remember not to print it out because you don't know whose hands it could wind up in. 

5. Be aware of your line of access.

If you use payment apps like Venmo, PayPal, and Zelle, it's important you're aware of how many access points to your bank account exist. Tie those apps to your credit card rather than your bank account and then be sure to regularly monitor the cards for any fraudulent activity. 

6. Don't easily give up your permissions.

Every app from Angry Birds to TikTok asks users to agree to permissions which in effect can waive your right to privacy on things like location, camera, and microphone. Be aware of what permissions you're granting and avoid dangerous permission groups like these, where you're essentially giving permission for a company to gain access of your whereabouts, images, and conversations.