Converge and BSides Detroit wrap-up

Last week, I headed to Detroit for a wonderful conference called Converge. It was quickly followed on Saturday by BSides. This is one of staple conferences every year. The crowd is great. The venue is top notch. The other speakers are fantastic. The organizers are awesome! And of course dueling coney dog restaurants. 

This year I got the opportunity to both speak and put on a workshop. The topic is the one I've been peddling all year, Social Engineering for the Blue Team. The talk went well enough. I had to transfer slides to our new company template and I missed some notes. The workshop went really well. I got some great feedback and found some refinements that need to be made. I only had six people in the workshop. Which worked out well, because I had a lot of back and forth and contributions from the crowd. I look forward to doing it again in the future.

I recorded one podcast interview and then did another conference interview that will come out this week. I'm going to try and do more podcast interviews while I'm conferences. Before I wanted to enjoy the conference and not worry about audio equipment and recording. That's a bit selfish, because I think I can record in-person with people. This would ideally lead to some better quality interviews and content. Shout out to Jesse who told me that he liked the new format. Thanks Jesse!

I'm playing with the format a bit so, I think this can slide in nicely. I plan to record some impromptu interviews where I just hit the record button and go. I think for the over-the-internet interviews I'll use my old format. I'll tweak it a bit. Ditch the old opening where I have the interviewee listen in. Instead I'll record an intro for each episode. This will allow me to give impressions of the interview and any promotional things. Still experimenting.

The conference went really well. I caught up with some friends and made some new ones in the process. If you missed it this year, I highly encourage you to check it out next year.

This blog post first appear on Exploring Information Security

Speaking and workshop update

BSides Nashville

I got picked up to do my Social Engineering for the Blue Team topic as a 25 minute talk. It's the last talk in the green room. Maybe I'll take that opportunity to see how long I talk before everyone leaves. Because it's in the green room, I'm going to try and give the talk a new twist.

I'll be at the conference as the photographer again. I've also been asked to help out with the resume and interview workshop. If you need help with your resume or interviewing stop by the workshop. I'm going to start preparing interview questions next week, which might make a good blog post.

Converge and BSides Detroit

The signup for my Social Engineering for the Blue Team workshop is up. It will be a four-hour workshop. Be sure to check out the other workshops. They're all fantastic and I wish I could go to all of them.

I've also been picked up as a speaker for the conference and we're in negotiations to do an Exploring Information Security panel. A year after I said I'd never speak twice at the same conference, I am now speaking three times. It's going to be awesome!

ShowMeCon

I'm back at ShowMeCon for my third year. This year I'll be doing a panel for the conference. Converge and ShowMeCon will be my first time hosting panels. I want to get it right while also making it something worth attending. The basic idea is to allow the audience to ask questions of the panel. Similar to what I do with guests on the podcast. It'll be an interesting experience and something I can pitch to other conferences.

 This blog post first appear on Exploring Information Security

Social Engineering for the Blue Team: My Story

This is an ongoing blog series, which touches on my upcoming speaking and workshops on Social Engineering for the Blue Team. My current schedule is as follows: BSides Indy, March 20, 2018; I am an alternate at BSides Nashville April 14, 2018; and I will be doing a workshop on the topic at Converge and BSides Detroit, May 10-12, 2018. I hope to see you there.

"You're a Rockstar."

These were the words uttered to me after turning in my two-week notice at a previous place of employment. I know infosec rockstars are looked down upon in social media circles. I took this as a compliment. These were words from our CIO. He followed that up with, "Everyone seems to like you." Which I took as another compliment. Both compliments made me feel extremely good, because compliments are few and far in between in our industry. That's a topic for another blog post. For this blog post the compliments started me down a path of self discovery.

I always seemed to have a knack for getting along with others. I never knew why, though, and I definitely didn't feel like I was doing anything special. My early years of life were filled with a lot of happiness and joy. I loved school up until about the fourth grade. I was good at it, but I also had a lot of fun with my classmates. It wasn't until I moved midway through fourth grade that I started to realize the mean side of kids. We moved to New Jersey.

My dad served in the Army for 20 years. I moved a lot. I averaged two and a half years in places. Thankfully, after fourth grade we moved again. This time to Kansas. I had a much better time in Kansas. Middle school was pretty good. I had friends. I also had some enemies that used to be friends. We moved back to New Jersey for eighth grade and half of high school. This is considered some of my darkest years. I had friends, but I was also picked on. A lot.

My pants were to tight. My glasses were too big. All I wanted to do was fit in. My mom bought me baggier pants and scheduled an eye appointment to get contacts. My grades slipped in an effort to be part of the in-crowd.  I moved my junior year of high school to Minnesota. I was picked on there for my baggy pants (remember JNCO jeans). I had girl friends, but in general I found talking to the opposite sex intimidating at first. While I missed out on the academic side of school, I was learning about human interaction.

I failed a lot at human interaction. That, eventually, led to me picking up David Deangelo's Double Your Dating series. This was after a six-month period in which: my girlfriend dumped me; my roommate bailed on me and left me with paying for a two-bedroom apartment; and a captain's mast for showing up an hour late to duty. Technically, I was supposed to go to captain's mast after three write ups. Being late was my first one and something everyone did when they only had a few weeks left at a duty station. In this case I was being made an example of by the new commanding officer. Still I had failed, because I wasn't viewed as a good sailor. Something need to change.

Studying Deangelo's content I realized that I wasn't just learning interaction with women, but people in general. I was getting self-improvement tips and techniques. I picked up (on the recommendation of Deangelo) Feel The Fear And Do It Anyway by Dr. Susan Jeffers. This was the turning point. I started honing my soft skills. I did this for life quality reasons. After I was told I was a rockstar and people seemed to like me, I started to understand how. This was just a few years ago. Last year I read Social Engineering: The Art of Human Hacking by Chris Hadnagy and it opened my eyes to the how.

I've excelled at my roles party due to my technical prowess, but mostly due to my ability to build strong relationships with people. I see that as the key to my success in building security programs, processes, and improving the security culture of an organization. My current role has me sitting with developers. I am successful there because of the relationships I've built. Leadership wants to hire me away from the security team. The developers are making good security decisions without my input.

We talk about the talent shortage quite a bit in our field. A lot of solutions start with improving security programs in school and mentoring juniors in our field. I think those are good solutions. It will take time for those solutions to be fully realized in our industry. I also, don't have much influence there. Where I do have influence is in the better relationship realm. I think if we can interact better with other departments we can make strong improvements in security.

That's why I've put together this content. I'm really excited about the idea. I've had a lot of success with it and I think others will too. More to come.

This blog post first appear on Exploring Information Security.

Converge and BSides Detroit talks and slides

I had a great time at Converge and BSides Detroit.

This was my third attempt at going and I'm happy I finally got the opportunity to do so. The last two years I've had to cancel my plans due to life reasons. I did two talks this year. One at Converge and one at BSides. Both are linked below along with the slides for both talks.

How to kick start an application security program - Converge Detroit

I've given this talk at three other BSides prior to Converge. I feel like this is my best presentation of the talk so far. I will be giving it again at ShowMeCon in June.

Slides

The AppSec Starter Kit - BSides Detroit

This was my first time giving this talk. I thought it went well for it's first attempt. It still needs polish. It will probably be a while before I give this talk again at a security conference. I made this talk to present at developer conferences. It hasn't been picked up, yet. I'm hopeful it will for some talks later this year.

Slides

This blog post first appeared on Exploring Information Security.