Getting Into Infosec

Latest Episodes:

Bonus - Cyber Security Job Search Frustrations (Jayesh) Mar 05, 2020

Show notes

These are quick hallway conversations with recent graduates discussing the difficulties they've faced in their job search. I did not know any of these people before interviewing, and it's the first time I'm asking them these questions. This was recorded at RSA Conference 2020.

Getting Into Infosec:

Breaking IN: A Practical Guide to Starting a Career in Information Security: https://www.amazon.com/dp/B07N15GTPC/
T-Shirts, Mugs, and more: https://gettingintoinfosec.com/shop/
Sign up for sneak peeks, updates, and commentary: https://pages.gettingintoinfosec.com/subscribe

See omnystudio.com/listener for privacy information.

Mentioned in this episode:

Stay In Touch

Bonus - David Zeichick - Cybersecurity College Professor Mar 04, 2020

Show notes

So as I was at RSAC, I was trying to keep an eye out for those looking to get into the field. RSA is not usually the place for that, but I saw the NetWars tournament and figured that might be a good place to start. On my way there, I met David Zeichick, who had "College Day" on his badge. Intrigued, I asked about "College Day," and he told me all about it.

I sat down with him for an impromptu interview on the topic.

Links

David on Twitter: https://twitter.com/dzeichick

Getting Into Infosec:

Breaking IN: A Practical Guide to Starting a Career in Information Security: https://www.amazon.com/dp/B07N15GTPC/
T-Shirts, Mugs, and more: https://gettingintoinfosec.com/shop/
Sign up for sneak peeks, updates, and commentary: https://pages.gettingintoinfosec.com/subscribe

See omnystudio.com/listener for privacy information.

Mentioned in this episode:

Stay In Touch

Tanya Janca - From Insecure Developer to Appsec, Diversity/Inclusion Advocate, and Mentor Feb 23, 2020

Show notes

BIO

Tanya Janca, also known as SheHacksPurple, is the author of ‘Alice and Bob Learn Application Security.’ She is also the founder of We Hack Purple, an online learning academy, community, and podcast that revolves around teaching everyone to create secure software. Tanya has been coding and working in IT for over twenty years, won numerous awards, and has been everywhere from startups to public service to tech giants (Microsoft, Adobe, & Nokia). She has worn many hats: startup founder, pentester, CISO, AppSec Engineer, and software developer. She is an award-winning public speaker, active blogger & streamer and has delivered hundreds of talks and trainings on 6 continents. She values diversity, inclusion, and kindness, which shines through in her countless initiatives.

Founder: We Hack Purple (Academy, Community, and Podcast), WoSEC International (Women of Security), OWASP DevSlop, OWASP Victoria, #CyberMentoringMonday

Notes

Part of security is teaching security
Started in software development, then starting meeting hackers, and decided to switch to security.
Tanya is extremely scholastically inclined
She comes from a family full of women computer scientists, technologists, and mathematicians!
- Her aunt was the FIRST to graduate in CS from Ontario.
- Her mother was a mathematician.
- She had four uncles in computer science.

Tanya's Quick List For Getting Into Infosec

Responsibility of a mentee: [30:29]
- Have energy and time
- Respect your mentor's time
- Need to have already looked for the answer online before you ever ask them for something
- They are not a free consultant; you shouldn't ask them to do your work
- You shouldn't stand them up for meetings
- Recognize and have gratitude for the fact that this person has a crap-ton of knowledge in their brain that they're sharing with you for free. They're taking the time out. You're not their daughter or son. You're not their friend. You're a person in their industry, and they're trying to pay it forward.
- You want to actually do the exercises that your mentor gives you
- Choose your mentor wisely
- Do not expect your mentor to find you a job

Quotes

"We're graduating people who don't know how to make secure software, but they do know how to make software! So that ends up being insecure software." [4:57]
"So if I [were] going to teach a software security course at a university, they would pay me as an adjunct professor, and they would pay me almost nothing. It would almost be equivalent to volunteer work." [5:35]
"I thought I really wanted to be a penetration tester until I discovered that there is this weird spot… in between red team and blue team." [10:17]
"A lot of penetration testers get a little depressed."[11:07]
"People just don't know how many super awesome cool things there are out there!" [15:11]
"The people I liked the best are the people in my computer science class." [22:24]
"Honestly, I just smoked a lot of weed and just showed up and would ace things." [22:12]
"You don't have to spend money at the beginning necessarily." [31:58]
"Which certification should I get so that I can be a good pentester?" [31:34]
"I don't know enough to be a mentor." [31:50]

Links

Tanya Online
- Personal Site: https://dev.to/shehackspurple
- Twitter: https://twitter.com/shehackspurple
- Pushing Left Series: https://code.likeagirl.io/pushing-left-like-a-boss-part-1-80f1f007da95
NICE Framework: https://www.nist.gov/itl/applied-cybersecurity/nice/nice-cybersecurity-workforce-framework-resource-center
OWASP: https://owasp.org/
WoSec: https://wearetechwomen.com/wosec-women-of-security/
Franziska Bühler https://twitter.com/bufrasch

Getting Into Infosec

Breaking IN: A Practical Guide to Starting a Career in Information Security: https://www.amazon.com/dp/B07N15GTPC/
T-Shirts, Mugs, and more: https://gettingintoinfosec.com/shop/
Sign up for sneak peeks, updates, and commentary: https://pages.gettingintoinfosec.com/subscribe

See omnystudio.com/listener for privacy information.

Mentioned in this episode:

Stay In Touch

Nick Vissari - Engineering Dropout to Math Tutor to Security Architect/Engineer Feb 04, 2020

Show notes

Nick Vissari went from being an engineering dropout (he didn't like creative writing) to a tech consultant to a math tutor. His penchant for fixing things homed him back into tech, where he is now responsible for security in a large school district. He recently went back to school and received his cybersecurity degree as well.

Notes

At 10-years-old, his Dad had problems putting the computer together, so he helped his dad
Family never stifled any inquisitiveness he had
Started as a math tutor at the school system
How he initially had the wrong attitude in security

Quotes:

"Once you get into a position somewhere, do whatever you can to make yourself invaluable. Find the things people don't want to do and do them. The hard problems are the ones most rewarding."
"If you're not automating right now, it's probably because you have more resources than you know what to do with."
"There are a lot of people that are security professionals, but they really don’t know about how a system works."
"Just got to have that passion for wanting to learn and you can definitely jump into security."
"My grandmother always said: 'Those who don't make mistakes, don't do much.' So get out there a make a bunch of mistakes."
"Don't be that guy that says 'No' to everything."

Links

Nick on Twitter: https://twitter.com/nickadam
sslstrip by Moxie: https://github.com/moxie0/sslstrip
Firesheep plugin: https://en.wikipedia.org/wiki/Firesheep

Getting Into Infosec

Checkout My Book: Breaking IN: A Practical Guide to Starting a Career in Information Security: https://www.amazon.com/dp/B07N15GTPC/
T-Shirts, Mugs, and more: https://gettingintoinfosec.com/shop/
Sign up for sneak peeks, updates, and commentary: https://pages.gettingintoinfosec.com/subscribe

See omnystudio.com/listener for privacy information.

Mentioned in this episode:

Stay In Touch

Page Glave - Professor of Kinesiology to Cybersecurity Analyst! Nov 16, 2019

Show notes

Page Glave was a tenured Associate Professor of Kinesiology with a focus in exercise science and was successful in her field. However, she came to the realization that she can't see herself doing this for the rest of her life. She offers lots of great advice on resume tips when switching, homelabs, certifications, and how she was able to break into the field. This is her story.

BIO

I am an analyst, project manager, ethical hacker, and tech consultant with more than 10 years’ experience with research and project management. I spent a while in higher education – long enough to get tenure and decide it was time to do something else. I have eJPT (eLearnSecurity Junior Penetration Tester), Security+ and Splunk User certifications. I love learning and tech, so digging into all of this stuff just makes me happy.

Notes:

5-months into her first security job!
Being in a small environment, she gets to do everything from governance to pentesting
Previous to this, she was a tenured associate professor in kinesiology, focusing on biomechanics and obesity.

Quotes:

"Pretty big adventure on a daily basis because no day is the same."
"Really is an environment where security is everyone's job."
"I think I'll always be in-house tech support for as long as I live." [7:08]
"I kinda got bored… I didn't want to keep doing something that wasn't challenging." [7:28]
"Do I really want to do this for the next 30 years?" [7:58]
"…going through the headers, that should have been a clue that maybe tech would have been a good fit for me."
"You'd be hard-pressed to find anyone in Information Security who was just thrilled with their budgets."
"Being able to translate that self-directed learning to something on my resume."

Links:

Page's Twitter: https://twitter.com/pageinsec (Thank her via Twitter)
Breaking Down Security Podcast: https://www.brakeingsecurity.com/
Pacific Hacker's Conference: https://phack.org/
Sam Bowne's Class: https://samsclass.info/
Skadi VM: https://www.skadivm.com/ (by Alan Orlikoski https://twitter.com/AlanOrlikoski)
Marco Palacios: https://twitter.com/MPalacios_Cyber
Keirsten Brager: https://twitter.com/KeirstenBrager
Intro Music: https://trash80.com/#/content/133/weeklybeats-2012-week5
Outro Music: https://www.youtube.com/channel/UCNXDIltPLbdcAavUtL00i7g

Getting Into Infosec:

Follow Me on Twitter: https://twitter.com/coffeewithayman
Subscribe To YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
Checkout My Book: Breaking IN: A Practical Guide to Starting a Career in Information Security
Sign up for updates and commentary: https://mailchi.mp/467573a314e5/gettingintoinfosec
Website: https://gettingintoinfosec.com

See omnystudio.com/listener for privacy information.

Mentioned in this episode:

Stay In Touch

Nick Jeswald - Confessions of a Cybersecurity Recruiter (Part 2) Nov 02, 2019

Show notes

Part 2 of 2 - Nick Jeswald has been an external and internal recruiter in security. He shares with us what he looks for in a candidate, common mistakes made by candidates, and the nuances of hackers he's learned over the years.

Show Notes

SEE PREVIOUS EPISODE FOR COMPLETE NOTES & RECRUITING TIPS FROM NICK.

Getting Into Infosec:

Follow Me on Twitter: https://twitter.com/coffeewithayman
Subscribe To YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
Checkout My Book: https://amzn.to/2HP2i25
Sign up for updates and commentary: https://mailchi.mp/467573a314e5/gettingintoinfosec
Website: https://gettingintoinfosec.com

See omnystudio.com/listener for privacy information.

Mentioned in this episode:

Stay In Touch

Nick Jeswald - Confessions of a Cybersecurity Recruiter (Part 1) Oct 25, 2019

Show notes

Part 1 of 2 - Nick Jeswald has been an external and internal recruiter in security. He shares with us what he looks for in a candidate, common mistakes made by candidates, and the nuances of hackers he's learned over the years.

BIO:

I've been in infosec for 8 years, and in various IT roles since 1996 (Developer -> Sales Engineer -> BD Specialist -> Security BD -> Security Recruiting -> Dir. Corp Dev). However, I've also been one of the top recruiters for each company I worked at whatever role I've had.

Show Notes:

Internal recruiters != external recruiters
- Backgrounds are different
  - External recruiters come from varied backgrounds, virtually zero from infosec
    - Much like BD people
  - Internal recruiters are more likely to have a greater understanding of infosec or at least IT
  - A recruiter that doesn't understand security is more likely to make bad placements with higher turnover
- Motivations are far different
  - I want to choose people to spend a career with
  - They want to make a commission and meet SLAs
- Attention to detail is very different
  - A tiny detail that could betray a hidden skill set or flaw would likely be overlooked by a 3rd party
  - I have an interest in understating the person, not just the resume
    - What is their desired career/life trajectory?
    - How will our company enrich/hinder that life?
You are in competition with an army of low-skilled counterfeits
- You need to be able to demonstrate raw skills, not just list your certs
- Have a body of work available for review on GitHub, your own site, etc.
- Internships are a nice touch, but they cut both ways
  - You interned with unnamed-big-4-biz-consulting firm? Don't drag that culture in here. I fear for what you learned.
- Can't talk about where you interned because it was a non-DOD three-letter agency? Communicate that point to me in your way. If that is the truth, I'll trace you back and verify.
Always be client-facing
- I have seen many recruits passed over for poor hygiene, arrogant treatment of interviewers, disclosure of illegal activity, and just generally obnoxious behavior
  - You couldn't act like this on a client site and not get sent home; don't do it on the interview
  - Yes, you are talented...there's always someone cooler than you
Interview your interviewers
- You should have a standing list of questions for interviewers
  - Why do you stay with them?
  - What is the intended growth path? Organic? IPO? Channel?
  - Is there any merger/acquisition activity going on? Planned? Intended impact?
  - Is there any rebranding activity going on? Planned? Intended impact?
  - What conditions are driving this open role? Turnover? Internal restructuring? Organizational growth?
  - Will I be supported in my security research? How?
  - Does your company have a defined mentoring path? Why not?
  - How does the company support continuing infosec education?
Meet your team
- Watch the team interaction closely
- Can you see cohesion? Are they supportive or adversarial? Are they authentically happy with their jobs?
Understand the org chart you are stepping into
- To whom does security answer? CXX? IT Director? General Counsel?
  - Understanding this will help mitigate surprises later
Understand the company culture
- Big corp? Big corp problems.
- Boutique? Founder problems.
- Is there a "treehouse" mentality among the senior employees?
Never forget who you are
- I know you want a job, but don't take a job that is sure to kill you slowly from the inside
  - Like doing offensive security? Don't start in the SOC.
- Did you walk away from the interview(s) thinking that this company understands the care & feeding of hackers?
- If you can already see the point at which you will outgrow the company, is it the right place to start?
  - Maybe! If you have a goal of entrepreneurship, or of working for a specific team, this first step just needs to support that eventual goal. This may be detected by an astute interviewer, though.

Resume tips

One page.
- My dad started at the bottom, and worked up to EVP of a Fortune 50 corp. One page.
Focus on your work experiences and extracurricular infosec workrelevant
I'd rather read about 0days and CVEs than certs
I want to know about your community involvement
- 2600, local DCs, TOOOL, OWASP, etc.
- Presentations at cons matter to me, especially if I can watch you deliver information to an audience
  - Like a free audition, and believe me I watch every one people link in resumes
I don't care about your GPA, fraternity/sorority, who we know in common, what sports you enjoy, or what you look like. At all.
- Seriously, don't add a photo.

General tips

Code in several languages.
- Despite semantic differences, you should have a pretty good working knowledge of the most widespread VMs, coding languages, and compilers
Web apps are your paycheck
- Knowing the OWASP Top 10 is like knowing your middle name...not impressive in and of itself, but if you don't know them, there's something wrong.
- Many composite "red team" projects will involve some Web app hacking, and even the most specialized consultancies will agree to a Web app assessment for an established client
Think holistically, and make yourself more valuable
- If you can't write a report, of what value are your assessment activities?
- Seem always to have interpersonal conflict? Time to read up on Empathy and EQ. Be the go-to on your squad.
- Get comfortable with an audience. Toastmasters is there for you.
Learn the value of "the Halloween Mask" as Henry Rollins called it
- Sure, you're a young security professional. We all expect eccentricity from you. We're all also trying to make money and be taken seriously
  - Don't forget: in boardrooms of white-haired old men across the nation, we're still the same guys who lost them millions of dollars on ERPs and useless Y2K preparations
  - I'm not kidding about this.
- Don't wield your difference like a blunt object. A little bit goes a long way when you're also scaring the hell out of everyone with pen test reports.
- My life is far more complex and wacky than my coworkers know, and I talk a lot. I just know how much to let through the mask

Getting Into Infosec:

Follow Me on Twitter: https://twitter.com/coffeewithayman
Subscribe To YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
Checkout My Book: https://amzn.to/2HP2i25
Sign up for updates and commentary: https://mailchi.mp/467573a314e5/gettingintoinfosec
Website: https://gettingintoinfosec.com

See omnystudio.com/listener for privacy information.

Mentioned in this episode:

Stay In Touch

September 2019 Update Sep 23, 2019

Show notes

Summer was crazy. My day job was keeping me super busy, and I've been really mentally occupied lately dealing with kids, family, and school. I miss producing shows and will be getting back into it. Have some really good shows queued up! I've still active on Twitter when possible, so we can stay in touch there in between shows.

Oh, and by the way, it's been a year since I started podcasting! Pretty cool. So many things I want to do with the show, like animating my spoof ads and transcribing the shows.

Anyway, just wanted to update you and let you know I didn't forget about you. I can't wait to release some of these amazing shows.

As we depart, here is a draft of a spoof ad I put together real quick. It talks about my love of the word "cyber."

See you next time.

Getting Into Infosec:

Follow Me on Twitter: https://twitter.com/coffeewithayman
Sign up for updates and commentary: https://mailchi.mp/467573a314e5/gettingintoinfosec
Subscribe To YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
Checkout My Book - Breaking IN: A Practical Guide To Starting A Career In Infosec - https://amzn.to/2HP2i25
Website: https://gettingintoinfosec.com

See omnystudio.com/listener for privacy information.

Mentioned in this episode:

Stay In Touch

Fareedah Shaheed - From Tech Curious to Information Security Jul 31, 2019

Show notes

Fareedah, a lifelong learner, was always interested in technology and grew up reading her father's Cisco books. His influence led her to the field of information security, where she stepped up and is always tackling new challenges.

BIO

Fareedah Shaheed was born in Maryland, but spent most of her childhood outside of the US. She returned to the States in 2013 and attended the Community College of Baltimore County (CCBC), where she majored in cybersecurity.

Her experiences with different cultures and the tech field led her to combine her interest in psychology with cybersecurity, and thus, her passion for security awareness was born.

In 2018, she founded Sekuva with the mission to educate and support small business owners and families with understanding how to secure their sensitive information.

She currently works as a Security Control Analyst at a financial firm in Maryland.

Notes:

Currently works with Security Awareness and Threat Intelligence
Must break down concepts for both executives and associates
Saw that there was a lack of cybersecurity awareness for "regular" people, especially with parents
Got thrown into leading "lunch & learn" events and experienced imposter syndrome due to her lack of her experience
Her lack of experience became a benefit to the audience as they were able to relate!
Father was in tech. Changed her major in college based on his advice
Wanted to teach, but didn't want to be a teacher
Has read 2000 books since childhood
Fareedah had really good role models growing up

Quotes:

"I vowed never to have anything to do with math whatsoever."
"I was a broker, I did an internship, I did teaching... and through all of that, I realized I didn't really want anything but tech."
"Whatever your parents' field is, that kind of is in the back of your head, whether it's a yes or no."
"Let me do it. Let me try this out."
"Cybersecurity is new. It's upcoming. I really believe that your skills would be good for cyber. There's not a lot of women there. Especially not a lot Muslim women there, who look like you."
"I remember just lying awake at night just thinking about how does WiFi work."
" Instead of guards, we have guides." [21:12]
"You have to do it afraid; you can't wait for the perfect moment." [25:35]

Links: