Does your company need ethical hacking?

MANILA, Philippines – Did you know that there is such a thing as ethical hacking? “An ethical hacker is someone who knows the craft of a hacker but uses it for good,” says Third Librea, a partner at P&A Grant Thornton, one of the leading audit, tax, advisory and outsourcing firms in the Philippines.

“That’s something we do,” says Librea, the firm’s head of advisory services and chief information officer. “Our clients engage us, and we try to penetrate their computer system in order to evaluate its security and find out vulnerabilities which could be exploited by a malicious hacker.

 “We mimic the malicious hacker, using the same methods and techniques to do the penetration testing,” Librea explains. “It can be external, done outside the company, or internal, which is done inside the company.”

There has been a growing demand for this type of service lately. Many of the clients are banks as well as multinationals with offices here. “It’s a very connected world,” Librea says. “Those who have a lot of systems connected to the Internet must test their system every so often.

“Before, in traditional business consulting, auditors were like policemen,”  Librea adds. “But not anymore. Now we are more of consultants rather than fault finders. Essentially, we are problem solvers.”

In the area of fraud and forensics, the firm developed a system called ProActive, a whistleblowing system that is designed to safeguard the anonymity of a whistleblower. “A study from the association of certified fraud examiners showed that most fraud activities are captured through tips,” Librea relates. “The issue with whistleblowing is anonymity. How do you ensure anonymity? So people may know something anomalous (is going on) but they don’t tell because there is no way to protect their anonymity. There is no guarantee that it’s not going to come back to them. That is the issue there. ProActive addresses this concern.”

ProActive uses an anonymous reporting system that essentially protects the whistleblower. The system is web-based, allowing anyone at any time to make a report. The website is subscribed to by companies. “A whistleblowing system aids an organization in upholding transparency and effective communication,” Librea notes. “It not only protects the company and its employees but the clients as well. It’s a flexible system and the categories that can be reported are limitless.”

A new set of services that the firm is offering is the Human Capital Services. In their many years of consulting, doing systems and processes, they realized that the root cause of many issues and problems are the people. “So we are developing offerings around human capital. Primarily, we’re starting with capability and training programs. Eventually, we want to push things such as competency models and hiring plans,” Librea says. “We help you develop your most valuable resource: your people.”  

In an article titled “Evolving Today’s Dinosaurs,” Librea wrote: “I believe freer markets and globalization, advances in technology and rapid urbanization have created a situation where individuals, particularly knowledge workers in urban areas, are spoiled for choices and they have almost limitless opportunities for self-actualization. You, the dinosaur, are seeing this change unfold before your eyes and are still likely trying to comprehend the changes as they happen.”

Librea observes that knowledge workers today have more expectations and apply these in their work. “Employees will no longer perform work for its own sake and without justification. For your organization to survive, it needs to be deliberate in the articulation of its common values and purpose.” He concludes that today’s knowledge workers, the millennials, must be given “the freedom to choose how to get the work done.”

“I think I am very lucky to have been born at a time when we did not have all these gadgets yet, but we were there when they came out,” says Librea, who was born in 1975. “I am not caught off-guard by these changes. At the same time, I am still aware of how it was before.” Librea remembers climbing trees as a kid on a relative’s farm in Baras, something kids these days no longer do. He has two boys of his own — Franco Luis, seven years old, and Vito Emil, three years old.  “They are in front of their gadgets all the time. They cannot survive without it. It’s like electricity for them.”

But Librea also admits to being a geek. He had his own personal computer when he was in grade four. “I was programming right away,” he relates. “I developed a payroll and inventory system for my mom’s garments business at age 10. That system was sold to her friends, so I was selling software as early as age 10.”

The eldest of three children of Celia Javier Santos and Emiliano Librea, Jr., Third had a privileged childhood. “I remember when I was in third grade, I saw something about a piano competition which I wanted to join, although I did not know how to play the piano,” he relates. His mother bought him a piano and got a teacher to teach him so he could read notes.

With a bachelor’s degree in business administration and accountancy from UP Diliman, his first job was at P&A in 1990. There he met his wife, Kaye, who, like him, is also a CPA. Librea is also a certified information system auditor, certified in risk and information systems control and possesses a certification in risk management assurance. He currently serves on the board of trustees of ISACA Manila. He took up IT project management at the AIM and is currently a participant in Grant Thornton’s Senior Leadership Program at the Said Business School of the University of Oxford.

“My parents never prescribed a course for me to take in college,” Librea adds. He could have taken up law or medicine, but accountancy seemed a practical course to take. “There were still no courses in IT at that time,” he says. Times have definitely changed.

As published in The Philippine Star, dated 3 October 2016