2024 Security Presentation Topic: Threat Modeling

I have been accepted to speak at two conferences this year: ShowMeCon in St Louis, MO, and the Palmetto Cyber Summit 2024 in Columbia, SC. I’m super excited to be speaking again in 2024. In 2023 I spoke on API security. This year it will be on threat modeling. Threat modeling is one of those the recommendations I’ve made in just about every talk I’ve given over the years. I figured it was time to dive deeper in.

As I prepare for the conference I will be blogging about threat modeling to help get my thoughts together. The abstract and outline are below. I’m waiting on a response for one other conference in the Spring. I will be submitting to other conferences later on this year as their CFPs open up. If you have a suggested conference please leave a comment below or reach out.

Abstract

Threat modeling is a critical process that helps organizations identify and mitigate potential security threats in the early stages of projects or when a legacy application is discovered with little to no documentation. This presentation aims to serve as a comprehensive introduction to the wonderful galaxy of Threat Modeling.

We will explore the fundamental questions: What is threat modeling? Why is it crucial for cybersecurity? How can it be integrated into your development and IT processes effectively? Why do I feel like I'm in preschool again?

This presentation will provide you with a structured approach to threat modeling, demystifying the process and breaking it down into manageable steps. We will discuss various methodologies and tools available for threat modeling.

Grab your towel and join us for "The Security Hitchhiker's Guide to Threat Modeling." Leave with a clear understanding of how to embark on your threat modeling journey.

Outline

• Introduction

• Why this talk?

• What is Threat Modeling?

• The Basics of Threat Modeling

• Key concepts and terminology

• The threat modeling process

• Identifying assets and data flows

• Establishing the security profile

• Identifying potential threats

• Assessing vulnerabilities

• Prioritizing risks

• Methodologies and Approaches

• Overview of common threat modeling methodologies

• STRIDE

• DREAD

• OCTAVE

• Attack Trees

• Pros and cons

• Choosing the right methodology

• Tools and Resources

• Demonstrations and examples 

• Best Practices and Tips

• Conclusion

This post first appeared on Exploring Information Security.

Favorite moments from ShowMeCon

The latest episode of the Exploring Information Security podcast is out. Check out Episode 171, What is ShowMeCon 2024?

I have been told I’ll be speaking at ShowMeCon 2024, which I’m super excited about because it’s a great conference that is a nice change of pace from the other conferences in the industry. The people that attend are the biggest draw. Not just the organizers and the friends I’ve made in the St. Louis area but also the attendees. They’re attentive and ask really great questions.

The conference hits that sweet spot between hacker and local chapter conference. There’s lots of great hacking personalities and talks but it also has that professional business feel. You won’t have to worry about logistics such as caffeine or food. You can just focus on the content the conference has to offer. The content is great with well known speakers such as Kevin Johnson and Jayson E. Street and lesser known ones like me! Here are some of my favorite moments from past ShowMeCon iterations.

St. Charles and St. Louis

The venue and location are fantastic. The conference is held in the Ameristar Casino Resort and Spa. The conference center is spacious and well setup. They have breakfast, lunch, and a happy and dinner. The rooms are fantastic. St Charles is a great spot to hang out and St. Louis has a lot of really great free options for family such as the zoo. The pool is a popular spot with the biggest draw being the music underwater! This is the best venue and location I’ve been to for a conference.

Speaking at showmecon

I was shocked when I went to the podium at ShowMeCon for the first time to present on How to Build a Home Lab. There were way too many people in that room for my talk. It was absolutely packed and it went really well. I even got a great laugh from the crowd which is always a great feeling for a presenter. I heard the next year when I was brought back that I had a lot of really great feedback on the talk which surprised me but it’s something I’ve always remembered and appreciated being told. I did an application security talk that I don’t remember much about. My last year there I was invited to do an Exploring Information Security panel which was great and had a lot of great interaction from the crowd.

Dave Does a talk with a guitar

One of my favorite talks from the conference is when Dave got on stage for a talk with his guitar. As he mentioned on the podcast, he did that because his talk wasn’t ready but he needed to do something so he got up on the stage with his guitar. It was a really great improvised talk on security with a guitar. Dave is a pretty good musician.

Malort

Very few people like the taste of Jeppson’s Malört. Made in Chicago it is one of the most vile things you will ever taste. Johnny Xmas, another speaker at the conference, brought a bottle to share in the speaker room. These were the results:

Hope to see you at ShowMeCon 2024!

This post first appeared on Exploring Information Security.

New Years Resolutions: Taking small steps past January 31st

Not really a security topic but imagine I’m using a building a security program analogy.

I’m not a New Years resolution guy. I think January 1 is an arbitrary date and if that I’m going to make changes that stick I need to start now rather than later. I’ve started new habits in the middle of the year and on December 20th. I’ve found that I tend to be more successful when I just start. Three years ago I got a Whoop in November 2020 and it’s been tremendous for habit changes I want to make. It tracks my sleep and strain for the day using a heart rate, respiratory rate, blood oxygen, and stress levels. I fill out a journal every morning on the habits and activities that affect my recovery. I’ve discovered valuable insights that have allowed me to make adjustments for the betterment of my health.

This is one of the things to remember when making changes to your life. It’s not one month and done. It’s a journey. The Whoop has helped with my journey because it provides me the data I need to make more targeted adjustments. It wasn’t something that happened over night or even in a month and I’ve been working on some of my vices for over three years. It took my seven years to quit smoking in my 20s. I did that with small steps.

It’s the same thing for any habit change. It requires small progressive steps. Some people can quit cold turkey or make drastic changes. Good for them! I’m not one of those people, unfortunately. For me it’s small changes that help me make life changing habits. There’s been set backs. A lot of setbacks!

If you’ve set a New Years Resolution that’s great! Making changes is hard. I would advice patience and the acceptance that there will be set backs. If there is a setback work to get back on track. If you keep plugging away it you’ll get better and be healthier for it. Health is very important not only for yourself but also for your career.

This blog post first appeared on Exploring Information Security.

Tips to help build strong relationships inside and outside of work

I love the saying from Manager Tools.

“There are three types of power? Technical power, role power, and relationship power. Relationship power is 75% of the power in an organization”

I quote it a lot to people when I’m having discussions about organizations.

Building relationships with people internally is what has allowed me to be successful in my career. We cannot do it all on our own. The techniques for building relationships apply both internally to a company as well as outside of the company at networking events. Her are some of the things I have done to build strong relationships inside and outside an organization.

How to build relationships

Ask questions

The number one thing I use to build relationships is ask questions. Then I follow that up by actively listening to the answer and asking more questions.

People’s favorite subject is themselves. Getting them to talk about themselves makes them feel good. If you are asking the questions you are the reason for that feeling. People will pick up if you’re being inauthentic, so it really helps if the questions are coming from a genuine curiosity. Look at them and hear what they’re saying and ask follow up questions to what they have just said.

When I first started doing this it was pretty hard. I liked to interject my own commentary. As I worked on it it eventually became easier. It is okay to interject here and there but talking less and listening more overall will help endear you to people quicker.

This was the tool I found most effective working with developers. Code is a developer’s baby. They create it. They nurture it. They get frustrated when it doesn’t pass tests. They may have dropped it once or twice. It’s their baby though and coming in and calling it ugly (even if it is ugly) isn’t going to make many friends.

This is where questions help. Developers lit up when you show an interest in their code (baby) and they will tell you everything about it. This helped me understand the code better. Why it was written the way it was written and allowed me to have tough conversations with them when it was causing problems. I had built that trust and they knew I was only trying to help them make the best code possible.

Spend time together

When you spend time together there’s a bonding that occurs. This builds trust and allows for people to get to know each other better. I’ll go to lunch with people if asked or I’ll ask others if they are interested in going to lunch. It’s a great way to just have a normal conversation outside of work. Asking questions gives insight into the person.

If money is tight, this can be done at work. If there’s an open spot a table ask to join (asking questions again ;). If it isn’t often people will tell you to pull up a chair and join them anyway. Worst case look for someone else to sit with. People that are sitting by themselves usually won’t mind company.

stay in touch

Make sure to stay in contact with people. This became harder with the pandemic and everyone working from home. Often I would reach out to them if we hadn’t chatted in a while and I was in a meeting with them. I’d shoot them a quick IM saying hi and asking how they were doing.

The Allen Curve is a study from the 1970s that described as distance increased between engineers communication became less frequent. If you are wondering why CEOs want people in the office it’s because of The Allen Curve (a future blog post).

Image courtesy Clutch.co

I’m surprised at how many people are not familiar with this idea. Regardless, as distance increase communication decreases. It makes sense. When you were in school you stayed in contact with your classmates more often. As people moved the communication between people became less frequent. You may have experienced this during the pandemic with coworkers. The person you got coffee with every morning and chatted about work or real world events you no longer communicate with on a regular basis. I’ve seen this apply with people just switching floors or moving to a different part of the building. The distance doesn’t need to be far for communication to drastically decrease.

If you are back in the office walking around can be a good way to stay in touch, as well as get a little exercise and a break from the computer. Working remotely is tougher. That’s why I set up reminders to connect with people every so often. This can be a week, month, months, or several months.

Reciprocity

Give without expecting something in return. First, this is a great feeling to just give without expecting something in return. Letting go of the return also helps with any frustration or anger that might occur from not getting something back. This can feel difficult because we all would like to think people will return the favor but it is something that can be practiced. Most people will want to return the favor. It might not be immediate but it will come at some point. Some people won’t return the favor. Either way we learn something about that person. Be careful to identify what people consider a favor because we’ll all have different ideas.

The five love languages is a great resource to read and understand. Some people just want help with their work. Others will want gifts or money compensation. Others will want praise. Understanding what drives people will help better understand what they may give in return.

I enjoy helping others and would rather someone help me than give me a gift. I would often look into help desk tickets for others and try to push them along if I could. This was a small effort for me but paid off when I needed something from these same people. Often, because I had helped them they would return the favor.

Be yourself

Be genuine and authentic. People can tell if you’re just there to get something out of them. If someone determines another person has or is trying to manipulate them the relationship is toast. Be who you are and don’t try to be someone else. You can work to make positive changes in your behavior and habits but ultimately we’re all who we are. I’ve struggled with being myself. I want everyone to like me but that just isn’t possible. I’ve tried being someone else for people and it doesn’t work. I have improved how I interact with people but ultimately I have to still be true to myself and accept that I won’t connect with everyone.

Easy to start habits

Two techniques I like to tell people to start with is using people’s name and saying thank you. Again, people are their favorite subject and hearing there name is a good feeling. You’ll have to identify what and how people liked to be called. Don’t just shorten people’s names because some people like being called by their first name. Some people like using their middle name or nickname. It is also a great way to start a conversation.

Say, “Thank you!” This is so easy to do and one of the least used techniques in the workplace. Say thank you to people for their work. Say thank you for getting you something. Say thank you for sharing their insights. It’s so easy to do and something people don’t hear enough.

Summary

Relationships are a very powerful thing. They can help advance a career and they can help get a job. To build a strong relationship, make it about the other person. Ask questions and spend time with them. Give without expecting something in return. This can feel very difficult because we are very transactional and want to get what’s rightfully ours. Most people will return the favor. The ones that don’t you will still learning something about them.

Finally, Be yourself and start small. Be who you are but realize you can make improvements to your behavior and habits. One of those can be by using people’s name and saying “Thank you!” for something they’ve done. Gratitude is a powerful thing and makes you and the other person feel good.

How do you go about building good relationships with people? Leave a comment below.

Resources

If you want to learn more about social engineering check out my GitHub page, Social Engineering for the Blue Team. You can also click on Social Engineering page or reach out to me directly with any questions you may have.

Social Engineering - Deep Dive

Contact

This blog post first appeared on Exploring Information Security.

Why Taking a Break is Important

Because we all need opportunities to recharge our brain. Even Bill Gates took a week off twice a year to recharge. I like to take a week in the spring and one in the fall just for myself to recharge. I usually play golf and video games during that week. I’ve found I’m stressed leading up to that week and recharged after the week. This is outside of family trips and vacations which can add a crinkle to taking time off if paid leave is limited. I’ve been fortunate to work at companies where I have quite a bit of time off and I can work from anywhere so I can maximize the time-off when I get there.

At one point I thought some friends and other people I knew who seemed to work all the time were different but eventually they burned out too. I do think tolerances are different and some people need less time away from others but we all eventually do need some time to unplug. And this isn’t going on vacation and answering emails or responding to alerts. It’s getting away completely. This was recently reaffirmed to me in my current role at an incident response company.

Notifications are the devil. Leaving notifications on is very much death by a thousand notifications. In my current role I’ve had email and multiple IMs on at the start. I’ve since reeled that in to just IM notifications and direct mentions specifically because no time of day or weekend was safe. Each notifications requires brain energy. It’s like running a car if you leave it on even in park it will run out of gas. That’s why turning off the car and in this case notification saves some of that energy for when I need to make a trip.

As a leader I need to be conscious of it because I impact a lot more people at work. I remember delivering a performance review to someone in January and they were a little surprised at the exceeding expectations review I gave them. They told me that at the end of the year they were wondering what they had done wrong to tick me off. As I reflected I realized I was burnt out during that time. While I tried to put on a nothing wrong is face and I don’t yell at people it was still pretty clear to the people that reported to me (and probably those that didn’t) that I was in a fowl mood.

I also need to be watching out for my directs and ensuring they’re in the best state mentally. Again, some people are better at it than others, so identifying the people that need to be told to go on paid leave is important. People earlier in their career are usually the ones that will work until they have some sort of breakdown. I know I was and to a certain point I still am based on what happened as a manager. Coming from a military background and getting into the private sector I expected to be told when to go home sick and when to go on leave. By the way if you’re sick go away and if you’re in an office go home.

I had 60 days of leave available when I left the Navy. Now I did take that as terminal leave and enjoyed my last two months of service playing World of Warcraft: The Burning Crusade but it highlights that I really wasn’t taking time for myself. As we get older there are more and more stresses added to our life and career. Starting a family or having family members to take care of takes it’s toll. As we advance in our careers we get better at what we do and gain wisdom from our experiences but new problems like politics and health problems start to creep into our world. It’s more important than ever to make sure we are taking breaks to ensure we’re performing at our best.

This blog post first appear on Exploring Information Security.

Meeting Dug Song - some guy who started up Duo Security

Recently at misecCON I had the pleasure of meeting Dug Song at the speakers dinner. He was the opening key note and I was the after lunch presenter on API security. When he walked in I had no idea who he was outside of being the keynote speaker. As I was scooting down to make room for him I got the sense that the guy sitting next to me was disappointed. I asked him as much and he confirmed that he would love to be sitting next to Dug and that he might fanboy a bit over me.

Something you should know about me is that I’m a bit oblivious at times. I try to treat everyone the same whether they’re a new person in the field or a rock star. And by rock start I mean a literal rock star. I’ve sat at dinner across from Neil Fallon from Clutch and had a genuinely pleasant conversation. Dug and Neil are people too and they wouldn’t be sitting with me for dinner if they weren’t down to earth.

I’m writing about this because I’ve recently started reading “The Daily Laws” by Robert Greene and I think today’s entry fits perfectly, “Assume You’re Misjudging the People Around You.” It’s a great reminder not to jump to conclusions about people. Throughout my career I’ve had people I thought were mentors suddenly stop communicating with me. I’ve also meet people that didn’t leave a great impression on me come around later in my career and make a great impression. You just never know in your career which is why it’s important to remain humble and not make assumptions about the people you meet.

What I loved about my interaction with Doug was he seemed to foster this mindset. He was very gracious and patient when I asked questions about whether he knew about MiSec (he’s the founder of the Song Foundation) and if he had ever been in startup (Duo). He also tried to steer the conversation away from him asked questions of the others sitting around him at the table. We had some great conversations about a lot of different things inside and outside of security.

Networking is huge for anyone in a career. Go out and meet people but avoid making assumptions about people. Give everyone an opportunity because you might end up finding a really great person to connect with.

This blog post first appear on Exploring Information Security.

MISSECON thoughts and impressions

Prior to the pandemic misecCON (the conference formerly known as Converge/BSides Detroit) was the last conference in my schedule for the year. Post pandemic I’m happy to see it back because it’s such a great conference. The conference was moved out of Detroit to Lansing, Michigan. I really like the location. It has that DerbyCon type of feel with the hotel as it’s central location. There’s plenty of food and after conference options for people to explore and experience. This version was only one day so time exploring was limited but what I did get to explore was great.

The conference had over 170 people show up so it wasn’t overwhelming but plenty of good conversations with attendees and great presentations to attend. I also really enjoyed the capture the flag (CTF) and even hopped in with a team for a short period of time. The venue was in the Double Tree Hotel Lansing and I was very pleased with the accommodations and rooms at the hotel. For lunch I went to Weston’s Kewpee Sandwich Shop and had a burger that had been sold for the last 90 years. A burger that’s been sold for 90 years is quite delicious. I like to get away from the conference and have lunch with friends as a break from the conference. For the record, the conference provided lunch also looked delicious. Not all conference provide a solid lunch so that’s a huge plus for this conference.

The after party was also great. It was at a place called the Lansing Shuffle which used to be an old farmers’ market on the river. We had a small section of the vibrant scene which included music and plenty of food options. The food provided was very good and the open bar had lots of options.

The rebirth of the conference is encouraging. The location is fantastic and has opportunity for growth into a bigger space which I think it will. I’ve heard there are bigger plans for next year with additions like workshops and other activities. I can’t wait to come back again in 2024.

This blog post first appear on Exploring Information Security

Reflections on InfoSec Nashville 2023 and BSides Augusta

Recently I attended InfoSec Nashville and BSides Augusta.

InfoSec Nashville 2023

Despite calling Nashville home since 2016, I only recently attended my first ISSA InfoSec Nashville conference. My expectations were exceeded by the event, especially with the opening keynote delivered by Robert Herjavec from "Shark Tank." While I'm not a regular viewer of the show and was initially unfamiliar with Robert, his speech was captivating. As the owner of a security company, his journey from a war-torn country to Canada, and eventually to starring in a hit U.S. TV show, is nothing short of inspirational. He shared intriguing insights into the future of security, particularly the idea of eliminating tier 1, a concept I'm still mulling over since there will always be a need for an initial level of defense.

Unlike at most conferences, I attended several talks at this one. Besides the opening, I was present for the afternoon keynote and a few other sessions before delivering my own at the day's end. The afternoon keynote resonated with me deeply, advocating for the hiring of entry-level professionals. The industry's skewed focus on seeking senior-level experts, as evidenced by LinkedIn job postings and the concerning average security professional age of 35, signals an unsustainable top-heavy structure.

However, hiring at the entry level isn't a panacea. Management must prepare a structured plan for these newcomers. I've seen many organizations lack this foresight, opting for senior professionals in the hope of minimizing their need for involvement. That doesn’t mean all entry level people are the answer. Maintaining a balance is crucial since many young professionals seek mentorship, a dynamic hard to foster in an environment composed solely of entry-level individuals.

The sessions I attended were enlightening, one on vulnerability management at a healthcare company stood out. Having developed a similar program for a mid-sized business, it was fascinating to compare approaches and scales, particularly seeing a dedicated team in action as opposed to one juggling multiple responsibilities.

The conference was overall a rewarding experience. It provided opportunities to connect with a diverse group of professionals and rekindle ties with acquaintances around Nashville.

BSides Augusta

As alluded to earlier, my conference strategy usually involves a "HallwayCon" approach, prioritizing networking and learning through impromptu conversations. This tactic led me to attend just one planned talk, aside from my own, at BSides Augusta. This event is a highlight on my annual calendar, coinciding nicely with a family visit to Columbia, SC, after the proceedings. What sets it apart is not just its impressive scale—with pre-pandemic registrations hitting 1,200 and around 800 attendees this year—but its distinct blue team focus, a nod to Augusta, GA's status as home to the Army's Cyber Command.

At a past ISSA meetup, I was taken aback when I was told attendees included members from the NSA, CIA, and Cyber Command —a moment that made me suddenly conscious of the powered on phone in my pocket.

I was extremely satisfied with the reception of my talk, now available on YouTube. My final presentation of this presentation will be at misecCON next month, where I'll have a full hour—a luxury compared to the concise 20-25 minutes at Augusta. While, like any presenter, I appreciate more time, I also value the challenge of a shorter format. It compels me to condense my speech to only the most crucial points, and enhance the chance of my talk being accepted.

The conference was, as expected, impeccably organized, and I cherished the catch-ups and new connections made. I’m eagerly anticipating next year's gathering!

Edited with the help of ChatGPT

This blog post first appear on Exploring Information Security

Adjusting to a new job

I’ve been meaning to write blog posts on a regular basis. That’s unfortunately fell to the wayside as I adjusted to my new job as Director Advisor Services as Antigen. I was going to give this as an update but this is a great opportunity to discuss switching jobs within the information security field. I’ve switched jobs within security three times now. Here are a few things I’ve learned.

Observe for three months

I’ve found the most effective thing to do coming into a new role is to speak as little as possible. There’s usually a lot to learn. Listening and asking questions helps to learn the environment and figure out where to help out. I shoot for three months but I’m usually contributing much earlier than that because someone is asking me to help or I volunteer to take on some work that I know will help the organization.

Volunteering can help show initiative and a willingness to contribute to the team and organization. These aren’t the fun tasks either. They’re usually the boring tedious tasks but they’re an opportunity to learn and contribute. Also be prepared to get a “no” when volunteering and that’s okay too.

NO organization has it figured out

From onboarding to performance reviews it’s rare to have an efficient and effective onboarding process. The responsibility is on the manager but most will push it off to Human Resources (HR) which is unfortunate because what you need is different from what others in different departments need. Be prepared to sit around and find stuff to fill the time.

I’ve had more candidates start to ask me about my 30-60-90 day plan for starting. I think it’s a great question. Most managers in my experience don’t have this or they’ll have something but never follow through. Not to say there aren’t organizations that have it figured it out. Most of them are a top 500 company on the stock exchange.

GETTING INTO A NEW ROUTINE TAKES TIME

I am no longer in an 8-5 job. The incident response (IR) space is filled with lots of weird hours including evenings and weekends. After having a schedule with some or no IR work, I now have a job where I am 365/24/7. That’s not to say I don’t have time-off. I just have to adjust my hours.

This can be great as I can run errands, workout, golf, and play video games during the day as long as my work is done. The work is just another incident around the corner. I need to make sure to have my boundaries and communicate that with others. That’s very different from an 8-5 where I’m expected to be in the office. Adjusting to that has taken time.

REMOTE VS OFFICE

There’s a lot more sitting around with remote work. If you’re in an office there’s usually someone to talk to or start working with. Being remote everyone is heads down and the manager usually has lots of other meetings going on. Good managers will block as much time on their calendar so they can get you up and running.

Working remote it’s really important to ask a lot of questions and invites to anything going on. Not everyone is going to remember to add you to things. Ideally there’s things lined up to do. If not, don’t stress over it. Do what’s available and then either walk away or work on a passion project.

SUMMARY

Starting a new job can be exciting and stressful at the same time. Looking back at the above patience is a big factor. I like to tell people that I start to get my bearings at three months. At six months I kind of feel like I know what I’m doing. At a year I’m finally comfortable.

Have a questions or want to share your experience? Hit the comment section below.

This blog post first appear on Exploring Information Security

Speaking Engagements Fall 2023

I’ve gotten my last letter back on a submitted CFP. I will be speaking three more times this year before looking ahead to 2024. Here are the conferences I will be at for the rest of the year. The topic I’ll be speaking on is API security. I’ll put the abstract below.

Infosec Nashville 2023 - September 26-27 - First time for me. I’m excited to go to a local event.

BSides Augusta - October 7 - I’ve been going to this conference since 2014. This is one of my favorite yearly events to attend. Yes, it’s a bit out there but it’s one of the biggest BSides in the world. For those curious Army Cyber Command is located in the area. It’s a very blue team focused conference.

MISECCON - November 17 - MISEC is one of the most talented local user groups in the country. This is a rebirth of Detroit Convergence and BSides conferences post pandemic. This is another one of my favorite conferences.

Title: The Security Hitchhiker's Guide to API Security

Abstract: API security is so hot right now! Organizations don’t fully understand APIs, how to find them, and secure them. This can feel scary. Don’t Panic. Grab your towel and join me on a meme adventure to explore the API galaxy. We’ll cover the history of APIs. Why people now suddenly care about them and why they’re such a hot topic. We’ll go over some ways to identify APIs within an environment. We’ll cover how API security is different and how to start securing them. We’ll review the API security tooling landscape. Finally, we’ll review resources to get your towel wrapped around API security and answer the ultimate API questions.

This blog post first appear on Exploring Information Security

Information security is a journey not a destination

It’s actually two journeys or two parts.

Part one: Getting into Infosec

This is where the journey begins. Usually with a desire (or need) to get into the information security. Sometimes you didn’t even know you were on the path. Which was my case. I joined IT because it seemed interesting and did a pretty good job of paying the bills.

I’ve been thinking about this more, because I’m going through the hiring process for a junior level position. I’ve noticed a variety of backgrounds of people trying to get in. Some people are coming from the military, others college, and yet others from working in IT. The junior positions don’t require security experience, it does however require some kind of college or IT experience.

Another observation I have is that, the candidates that are sticking out are involved in the infosec community and taking advantage of the many free resources. There are conferences, forums, slack channels, podcasts, blog posts, capture the flag events, videos, VulnHub, Hack the Box, bug bounty programs, and much more. Being involved in those things is very important because once you get in…

Part two: Being in Infosec

You have to utilize all those resources to keep up with the field. It’s been called a cat and mouse game between attackers and defenders. Technology is in a constant state of advancement and enhancements and with it comes new security challenges. A few weeks ago four vulnerabilities got dropped over a four day period that required me to understand the vulnerability. I had to understand how it is exploited and how we can mitigate it. I used blog posts, podcasts, Twitter, Google, and reached out to some people.

That last one is particularly important. The others are found on Google. Getting to know people requires putting yourself out there. Overcoming nervousness and anxiety to meet some new people. The benefit is two fold: you can ping ideas off people and you’ll increase your chances of finding opportunities within infosec. The perfect first job in infosec is rare. By perfect I mean a place to grow and advance. Even if you find a good organization there may not be a chance to advance or move up.

Below are a some links to help look for conference and other events in the area. I like BSides events because they have a low bar to entry. Usually $10-30 bucks for a day of talks, networking opportunities, and food. If that’s too much volunteer. It’s a great way to help out the community (reflects well on a resume) and be in a position that requires interaction. I only interacted with a few people at my first event as an attendee. As I continued to go to events my interactions with different people and the same people increased. How quickly this happens depends on how many events are attended.

These events also don’t require you to be in the field. You can start building your knowledge and opportunities before you get into the field.

Resources

Meetup.com - Good place to find local user groups in your area

Infose-conferences.com - Pick your state and any adjacent state you’re willing to travel to

This blog post first appear on Exploring Information Security

Management is a shift in mindset

If you ever go into management in the infosec field (or really any field) get ready for a huge shift in mindset.

Finishing the Exploring Information Security podcasts was a great decision for me. I would love to still be doing it, however, it’s just not valuable for me as a manager right now. I am no longer thinking about the latest happenings in infosec. I am still paying attention to what’s going. It’s just that my performance is largely reliant on the people that report to me. That means managing workloads, removing blockers, providing feedback, making decisions, and metrics.

It’s been a shift for me, even though I knew it was coming. I have to delegate or else I get to caught in the day-to-day operations. It’s not efficient for me as a manager. I’ve seen others get promoted into management and struggle. Largely because they still wanted to do the technical things and get paid as a manager. That’s just not possible based on the role. I’ve always wanted to go into management. I find the challenge in how do I get the most of the people that report to me. How do you make someone as productive as possible.

Oh, it’s also about politics. If you can’t, “play” the political game you will struggle as a manager. To get things done as security professionals requires building relationships with other departments. We in security have a big stick. Using that stick to get things done has the effect of making people not like you. Instead I like to build relationships using the techniques of social engineering. It’s much more effective and people tend to like you afterwards.

A resource that helped me prepare for a management role is Manager Tools. It’s a great tool for figuring out how to be an effective management. They’ve been around for several years with lots of topics to dive into. Even if you’re not interested in management they have the Career Tools podcast, which focuses on career advice. There’s resume, interviewing, how to ask for a raise, and much more. The hosts are very direct and to the points, which will rub some people the wrong way. They have data to back up their recommendations, though. I can confirm that using their techniques has helped me shift into management and become a better professional. The most beneficial being how to write a resume and interviewing.

Prior to listening to the Career Tools podcast, I struggled writing resumes and interview. This despite going to seminars and reading books on how to do both. At one point it took me 15 months to find a new opportunity. After listening to the podcast I increased my job offers dramatically and eventually found my current opportunity that I hope to retire from.

I’m hoping to document my experiences in future blog posts. While I’m not as focused on the technical infosec things, maybe I can contribute from the career advice of things.

this blog post first appear on Exploring Information Security

Some thoughts on infosec and social media

The more I dig into #infosec the more I find that the really good people aren't people you've heard about on Twitter.

— Timothy De Block (@TimothyDeBlock) January 29, 2019

I posted the thought above on Twitter a couple nights ago.

Rereading it, I feel I need to expand upon my idea, because there are a couple motivators for the tweet. First, the tweet was not worded very well. It comes off as saying that people on Twitter are not as good as those not on Twitter. This wasn’t my intention. I think there are really good people both on and off Twitter. The idea is more about myself and evaluating whether or not I’d be a better infosec person if I were to stay off Twitter.

A majority of the people I work with on the security team are not on Twitter. All of them are really good at what they do. I know there are more of those types of people, because I’ve worked with others who are really good at what they do. Twitter is a very small subset of the people within the infosec field. I think it’s important that what is said and done on Twitter doesn’t necessarily reflect on the entire industry. I was also watching a YouTube video at the time of a buddy of mine who has a Twitter account, but doesn’t tweet a lot. He’s really smart and is doing some pretty amazing things in the field. I’ve wondered if I need to be spending more time being productive and less time on Twitter.

Twitter being just a small part of Twitter is also why I was a bit disappointed to hear that this year is DerbyCon’s last. I like to go to DerbyCon. I have a good time and I catch up with friends and make new ones. There’s a lot of positives to the conference. Unfortunately, there is also some drama, which gets amplified by Twitter. It’s draining on the conference organizers. I get it and I don’t have any ill feelings towards their decision. It’s their conference.

What I think it highlights to me is that sometimes we need to step out of our own little bubble and look around. Twitter, and social media, is our own little world. We create it and curate it to our beliefs and preferences. It can certainly be a useful tool for information, but it can also create our own bubble that consumes and drowns us.

Things that get our attention the most are on social media are controversial. It’s frustrating and depressing. I take solace in the fact that there’s a larger world with the those things but also a lot more good.

This blog post first appear on Exploring Information Security

How to increase your chances of breaking into infosec

Get involved with the infosec community. That’s it. I’ll elaborate.

The best way to get hired for a security role is to know someone. The key part of that sentence is the, “know someone” part. That requires getting out there and doing things within the community. That can be a variety of things:

• Contributing to open source projects.

• Become an active member of a niche community in the field (OMG the slack channels out there). Writing a blog post.

• Producing a podcast.

• Attend a conference.

• Shooting pictures at a conference.

• Volunteer at a conference.

• Speak at a conference.

These are all the things I’ve done. I also see people doing things like:

• Twitch streaming.

• Writing a book.

• YouTube channels.

• Singing.

Find something you’re really passionate about (not infosec) and bring it to the field. For me it started with photography. I’ve always liked taking photography. I have a media arts degree and took some photography courses (so I kind of not what I’m doing). I reached out to a BSides organizer to see if they’d be okay with me coming and shooting some pictures at the conference. That one contribution, eventually led me to my current place of employment (and I absolutely love what I’m doing).

It was BSides Nashville. One of the organizers works at the place I’m currently employed. They were looking for an AppSec guy, so told her AppSec guys. I luckily knew one of those AppSec guys and as a matter of fact had just started an OWASP Chapter with that AppSec guy. You never freaking know when things will connect for an opportunity*.

* I met my wife, because we saw someone we knew on the highway at 80 MPH. A story for another time.

Prior to that I would look for a job via online postings. At one point it took me 15 months to find a new job. I got into security via a job posting, so there is a path that way. It’s just not the most efficient. I got my next security role, because I had helped start a monthly local user group meetup. The CISO was looking for a few good security people. That local user group has gotten several other opportunities. Mostly because of who you know; partly because it looks really good on a resume. It looks like you’re engaged.

Everyone has a different path. What increases the chances is getting out there. Contributing without expecting anything in return. Showing that you can provide value to someone else. What are your strengths and passions? Now bring that to the infosec field.

This blog post first appear on Exploring Information Security

Pen and paper are your most important tools in IT

I put out a tweet earlier today that seems to have resonated with people.

Pro tip for those in a junior IT position: Have a notepad and pen ready for notes during meetings and when someone is showing you how to do something.

— Timothy De Block (@TimothyDeBlock) August 30, 2018

The tweet was a result from a conversation I had with someone in IT. They were asking me about a decision made in a meeting they were not only in, but also setup. I was a little flabbergasted that he was asking me about what decision was made. "You didn't take notes?" was my first thought.

One of the best (if not the best) tips I've been given in IT, is to bring pen and paper. The idea being to write down instructions or jot ideas or action items or decisions in meetings.

Many years ago, shortly after landing my network administrator gig, I was being shown how to administer one of the many tools we have. As we started going through the tool, the senior in the room asked me why I didn't have a pen and paper. I didn't have an answer. I was then asked how I was expected to remember the instructions. Since then I've gone through hundreds of notebooks. At one point I had them categorized between instructions, troubleshooting, investigations, and a variety of other topics. I don't think there's a true way to take notes. Whatever is found to be the most effective.

For me, it's about step-by-step instructions, follow-up questions, and action items. For follow-up questions, I circle them so I need to go back. For action items, I use a rectangle. Step-by-step instructions are transferred to our documentation repository. Everything else is for remembering context or decisions later.

I take a notepad and two pens to every meeting. I leave my laptop at my desk unless I need to run a meeting. This is two-fold. I don't want to be distracted by the computer and writing things down is more effective for memory retention than typing. I bring two pens in case someone forgot their pen (makes a good impression) or one of mine explodes or stops working.

It's one of the most effective things you can do on a daily basis. If you want to dive into why it's important I recommend Career Tools A Notebook And A Pen episode. They also have several other's on how to take notes. It's what helped me refine my approach.

 This blog post first appear on Exploring Information Security

ShowMeCon wrap-up and what's ahead

I know. I know. It's been two weeks since ShowMeCon. I've been busy! Within hours the neighbors wanted to hang out (I brought the St. Louis beer). The next day, I had a big case of the don't give a shits. I didn't get a podcast ready for that night's release.

I went to work Monday expecting to head home and work on some stuff (like get a podcast out). Instead I was informed the development team I work with was heading to Nashville Sounds game, because some people were in from out of town and I was invited. I went. Tuesday, I played soccer for two and half hours, because I like pain (I didn't regain full functionality of my legs until Saturday). Wednesday was a social night, because those same people were in town (yay!). I got home and got the podcast out, three days late. Thursday, I wrote about suicide. Friday, I wrote about password policy. Both very serious topics.

Things sort of got normal after that. I took the weekend to kind of dink around on stuff I wanted to do. Monday I got two of the four podcasts edited I needed to. I was invited over the neighbors Tuesday for beer and baseball. Finally, last night I got four podcasts scheduled. I'm heading to Asheville tomorrow for BSides Asheville (still looking for a ticket). Much beer (and maybe a podcast) will be involved. Tonight is the night for me to write something and hopefully get a little Overwatch in. Damn I've been busy. Didn't really realize that until writing it down.

Back to ShowMeCon. This was my third year and fantastic as always. It's the ideal security conference. The hackers think it's too businessy. The business people think it's two hackery. There are more women at this conference than any other security conference, I've been to combined. I love it!

I did my first ever podcast panel, which went really well for being the first time. They had a personal trainer there to talk about health and fitness. There were a lot of questions at the end. This might be something I need to write about. I do work at a wellness company after all!

During the conference I managed to get two interviews for the podcast recorded. I really like the idea of recording interviews at conferences. It's a much better vibe when the two people are in person. It flows better. There's the low rumble of the crowd. The low thud of doors smacking closed. It's fantastic. Those will be releasing over the next two weeks.

Now that ShowMeCon is over, I've been re-evaluating my desire and need for submitting to conferences. I've been speaking since 2015. It's a great challenge and a good career booster. Now that I'm at a company that I adore and in a role that continues to expand, I'm starting to wonder the value I'm getting out of submitting to conferences. I love sharing ideas and challenging myself to become a better speaker. The downside to speaking is that it takes time away from my family.

I have two kids still in the single digits. I'd like to spend more time with them. At one point I was slated to be at 12 conferences this year. With other obligations, conflicts, and one conference not happening this year, I'm down to eight. That's still quite a bit. I've presented at all five I've gone to this year. It's not just going to the conference that takes time. It's also the preparation leading up to the conference. I spend several hours putting the talk together. Then I spend the week leading up to the conference practicing the talk. This is on top of the weekly podcast I produce.

I spend a lot of time in the field. Because of my expanding role I'm spending more time at work now too. I'm trying to find that balance. I'd like to spend more time with my kids. I think that will be at the cost of the conferences I attend. If I do submit a talk, it'll be for a podcast panel. The preparation for that is much easier than a full blown talk. I'd like to say I'm cutting back on conferences, but I don't think it'll take much for me to go to a conference (someone asks). We'll see.

 This blog post first appear on Exploring Information Security

Converge and BSides Detroit wrap-up

Last week, I headed to Detroit for a wonderful conference called Converge. It was quickly followed on Saturday by BSides. This is one of staple conferences every year. The crowd is great. The venue is top notch. The other speakers are fantastic. The organizers are awesome! And of course dueling coney dog restaurants. 

This year I got the opportunity to both speak and put on a workshop. The topic is the one I've been peddling all year, Social Engineering for the Blue Team. The talk went well enough. I had to transfer slides to our new company template and I missed some notes. The workshop went really well. I got some great feedback and found some refinements that need to be made. I only had six people in the workshop. Which worked out well, because I had a lot of back and forth and contributions from the crowd. I look forward to doing it again in the future.

I recorded one podcast interview and then did another conference interview that will come out this week. I'm going to try and do more podcast interviews while I'm conferences. Before I wanted to enjoy the conference and not worry about audio equipment and recording. That's a bit selfish, because I think I can record in-person with people. This would ideally lead to some better quality interviews and content. Shout out to Jesse who told me that he liked the new format. Thanks Jesse!

I'm playing with the format a bit so, I think this can slide in nicely. I plan to record some impromptu interviews where I just hit the record button and go. I think for the over-the-internet interviews I'll use my old format. I'll tweak it a bit. Ditch the old opening where I have the interviewee listen in. Instead I'll record an intro for each episode. This will allow me to give impressions of the interview and any promotional things. Still experimenting.

The conference went really well. I caught up with some friends and made some new ones in the process. If you missed it this year, I highly encourage you to check it out next year.

This blog post first appear on Exploring Information Security

Speaking and workshop update

BSides Nashville

I got picked up to do my Social Engineering for the Blue Team topic as a 25 minute talk. It's the last talk in the green room. Maybe I'll take that opportunity to see how long I talk before everyone leaves. Because it's in the green room, I'm going to try and give the talk a new twist.

I'll be at the conference as the photographer again. I've also been asked to help out with the resume and interview workshop. If you need help with your resume or interviewing stop by the workshop. I'm going to start preparing interview questions next week, which might make a good blog post.

Converge and BSides Detroit

The signup for my Social Engineering for the Blue Team workshop is up. It will be a four-hour workshop. Be sure to check out the other workshops. They're all fantastic and I wish I could go to all of them.

I've also been picked up as a speaker for the conference and we're in negotiations to do an Exploring Information Security panel. A year after I said I'd never speak twice at the same conference, I am now speaking three times. It's going to be awesome!

ShowMeCon

I'm back at ShowMeCon for my third year. This year I'll be doing a panel for the conference. Converge and ShowMeCon will be my first time hosting panels. I want to get it right while also making it something worth attending. The basic idea is to allow the audience to ask questions of the panel. Similar to what I do with guests on the podcast. It'll be an interesting experience and something I can pitch to other conferences.

 This blog post first appear on Exploring Information Security

SANS SEC487 Open-Source Intelligence Gathering and Analysis

Last week I had the pleasure of attending the brand new SANS course for OSINT in McLean, VA. The creator of the course, Micah Hoffman, has been on the podcast a few times and someone I consider a friend. He'll make his fourth appearance in a future episode on the topic of the SEC487 course. I wanted to take this opportunity to give some impressions of the course, while it's still relatively fresh.

Micah created videos for help with the labs as part of the course. This was one candid moment from those videos.

Simply put, the course is fantastic. I recommend it for those with OSINT experience and those without. I have some OSINT experience. As part of my job, I've investigated internal and external people. Working in a Security Operations Center (SOC) for the State of South Carolina, I did a lot of OSINT looking up IP addresses, URLs, and various other things. I've used it to figure out if a marketing or technical recruiter email is legitimate. I've used it in job hunting.

I still took quite a bit away from the course. I took 18 pages of notes. Another project idea came out of the course, OSINT for the Blue Team. I couldn't wait to get back to work to start building out some OSINT standard operation procedures (SOP). I've already taken my notes and built out a resource page for others to use.

I got to build my first sock puppet. Work on better documentation (I love mindmaps for documentation!). I used Tor for the first time and visited the "dark web." Got a ton of new tools and resources to check out. I'm excited to start using Hunchly and Spiderfoot as part of my processes.  The capture the flag (CTF) on day six was fun and engaging.

We laughed a lot. If you're in the area, I recommend Super Chicken and the food trucks on Pinnacle Drive. Center of the Universe brewing has got some really good beer. Which reminds me, Untapped is a gold mine for OSINT. I got to see snow (see above)! Best of all, I got to see Micah teach a five-day course on one leg. He got really good at the three-point turns towards the end of the week.

Enjoying #SEC487 with @webbreacher! Learning tons of OSINT goodness already.

A post shared by Timothy De Block (@timothydeblock) on Mar 19, 2018 at 8:02am PDT

The course was a beta, so it had it's rough moments. Those were rare. Most of the feedback I had was for improving the course. Moving content to earlier in the week rather than later. Maybe doing a little less on this topic here or more of that topic there. The course is solid and it's only going to get better.

Future dates include:

• Denver, CO - May/June 2018(not listed yet)

• Baltimore, MD - September 10-15, 2018

• Las Vegas, NV - September 23-28, 2018

• Singapore, Singapore - October 22-27, 2018

Click here for more details.

This blog post first appear on Exploring Information Security.

I went to BSides Indy, then killed my computer

I still makes mistakes with computers (This might be the reason why I'm starting to drift towards the human side of things). I went to BSides Indy this passed weekend and had a great time catching up with old friends and making new ones. Monday I got pictures loaded and vetted onto my computer. Then Tuesday, after a not so great day, I killed my computer. My CPU looks to be toast after I smothered it in  thermal paste. Yes, I do mean smothered. I got it on three sides of the first row of pins and in the CPU cradle. I'm pretty sure the thing is done.

That's okay though because it was on its last legs. It was built in 2011 (with upgrades in 2016). Instead of shopping for parts, I decided to try out a company I've heard good things. I'm over being hands on with my computer (see thermal paste). The new computer will take some time to get here. After I get my computer I'll be able to process the pictures I took at BSides Indy.

We’re off and running at @indybsides! Some really great talks today.

A post shared by Timothy De Block (@timothydeblock) on Mar 10, 2018 at 6:25am PST

BSides Indy was wonderful. They have a new venue this year at Indiana University-Purdue University (IUPUI). It had a lot of space. In fact, people on YouTube were commenting on how people weren't showing up for talks. It was really just the angle and no one wanted to sit up front. With this in mind, I made sure people sat in seats that were in frame to make it look like my talk was the most popular.

Speaking of my talk, (slides) it went really well. It was probably my best first talk I've done so far. It was done so well that it will be the only version of that talk I give. Let me explain.

I have so much content for Social Engineering for the Blue Team, that I think I can make multiple talks on it and still not touch everything I want to touch. I think there's an opportunity here for me to have the same title and abstract and provide something different each time I present on the topic. This will be more work for me. It also means that I can work on content for ultimate goal of the idea, training and workshops.

This topic is something I'd love to give at conference as training (both paid and free). To do that I need to work out some of my ideas and present them to a crowd of people. I've gotten positive feedback for the BSides Indy talk. I am scheduled to do a remote talk for ColaSec. I've already adjusted the slides for the presentation.

After that I'm an alternate for BSides Nashville. I'll plan to have the slides worked by then as well. If they don't get re-worked then I'll present those at ShowMeCon. Before that though I have my workshop at Converge and BSides Detroit. That will have everything in it as I'm planning for an 8-hour workshop (not sure on exact length yet). I'm waiting to hear back from a couple conferences and I'm waiting for a couple more to open up.

Back to BSides Indy. It was one of my favorite events. It's very laid back. It's in a city great for families. My wife came with me and took the kids to the mall where the played blacklight putt-putt. Both my kids got hole-in-ones on the 18th hole. We checked out the kids museum the day following the conference. That place is freaking awesome. It's four levels of activities for children (and adults). I highly recommend the place.

#TeamButts @InfoSystir @TimothyDeBlock pic.twitter.com/BN8Po7smKx

— Snow 🤞 (@_sn0ww) March 11, 2018

In between pictures I sat down to help Team Butts with the CTF. I say help, but what I really mean is that I googled an ID number and found it was associated with the rick roll video. I was hoping there would be more web app stuff, alas there was none. Still Snow and Infosystir (with a shout out to Dave from Hak4kidz) carried the team to a first place victory. The two top placing teams got NetWars accounts. Those ended up going to students as the people from the top two teams didn't have as a big of a need for them.

That's what I love about the infosec community. We care about each other, the advancement of juniors, and the betterment of the community.

This blog post first appear on Exploring Information Security.