Author Archives: hacks4pancakes

Whose Fault Is It? (A brief discussion on misconceptions about Equifax)

Posted on by

Our personal financial identities are exposed, and we’re mad. A sick, visceral, exhausted anger that hits us in the pit of our stomachs and makes us feel powerless.

People are understandably furious about the Equifax breach- to a degree that makes it tough to have a rational discussion about what happened. Unfortunately for information security professionals, anger is a luxury we don’t have right now. It’s now past time to have frank discussions about what went wrong and how to prevent it in our own environments. I’d like to take a moment to clear up a few exceptionally harmful  misconceptions about Equifax’s information security and security operations in similar practical environments.

Angry You Says: “I’m mad at Equifax for getting breached.”

It’s reasonable to be angry about Equifax’s existence, or their business model, or their retention of data. It makes no sense to be angry simply because they were breached. Any organization can, and likely will eventually be breached. What ultimately matters is their preparation, response, and risk mitigation.

You should be angry about Equifax executives selling stock before completing breach notifications.  You should be angry that Equifax was not prepared to respond to customer inquires about their breach in a timely manner.  You should be angry that the site Equifax put up in response to the breach was poorly branded and appeared hastily implemented. All these things could and should have been prepared for in advance.

Good incident response involves a lot more than simply performing forensics on an attack after the fact. It also involves solid communications plans, drilling for potential incidents, and procedures for plausible scenarios. To an experienced outside observer, Equifax’s incident response and breach notification plans were mediocre at best. Their DFIR team could be top notch at timelining attacker activity on servers, but that means little if they didn’t know who to call for hours.

We must remember to never base any of our metrics, good or bad, on attacker activity alone. Attackers are an unpredictable data point we cannot control. A sophisticated enough attacker can gain access to nearly any network given proper motivation and resources. You are not immune, and neither is any organization, huge or small. Every organization should plan like their most critical system will be hacked, tomorrow.

It may be Equifax’s fault that an individual attack worked due poor procedures, or that they weren’t prepared for an attack, but not simply that they were ultimately breached. It was their job to create the best defensive posture possible, and prepare for the worst case scenario.

Angry You Says: “The breach is Equifax’s fault for not patching.”

There are many scenarios in the corporate world that preclude or delay the application of software patches. Vendors go out of business or discontinue products. Responsible risk management decisions are made regarding critical application downtime vs. life and safety or preventing financial hardship.

The key phrase here is, “responsible risk management decision”. At the end of the line, there should be a clear audit trail leading back to risk managers who involved correct stakeholder teams and provided an analysis of patching versus not patching the system. The risks associated with not patching can be somewhat mitigated through other security practices, like adding defense in depth and monitoring solutions, or segregating vulnerable systems. In a healthy environment, all these things should occur. If Equifax didn’t make a responsible risk decision around not patching, and didn’t provide sensible mitigating controls, you can be angry about that.

Angry You Says: “The Equifax server admins are idiots for not patching, and I blame them!”

In most Fortune 1000 companies, if a system can be patched and isn’t, it is likely not the fault of “Joe or Sue admin”.

There are exceptions to this rule, such as malicious insiders. However in the vast majority of cases, the blame lies squarely with leadership – often C-level executives.

There are the cases where a server can’t be brought down for patching because the business refuses to accept the required downtime. In those scenarios it is the responsibility of management to have patching policies in place which account for limited and temporary exceptions given proper risk evaluation, with mitigating controls. These policies must have buy-in at executive levels so that an angry VP can’t override them merely by threatening a technician’s job.

Of course, there are also instances where organizations operate on unsupported software because leadership has decided to not expend the money or work hours necessary to upgrade them to a supported system. Once again, it falls to security and IT managers to make a case to  executives that the upgrade expenditure is a good risk management decision and financially responsible. If a sensible decision isn’t made by executives after being presented with this information, the blame lies squarely at the C-level.

Finally, there there are the cases in which a CIO or CISO fails to provide a policy or advocate for patching, and claims no knowledge of a server’s existence or of a threat. Ultimately, it’s the executives’ responsibility to hire savvy and articulate managers, who in turn hire subject matter experts who can generate comprehensive inventories and make reliable recommendations.

Do not make the mistake of comparing operational bureaucracy in a 50 person company with that of a 50,000 person company.

Angry You Says: “Equifax’s CISO was unqualified. She was a fine arts major!”

The Susan Mauldin‘s degree in music composition is totally irrelevant to whether you should be angry with Susan Mauldin.

It is possible for the Equifax CISO to have performed poorly at her job, while also being similarly credentialed to numerous, very competent information security professionals. Her degree should be treated as a non-issue.

As I’ve written in previous blogs, information security academia is new and delightfully inconsistent in quality. The vast majority of professionals with a decade or more experience in security did not attend a security-centric degree program, because those programs simply did not exist prior to around 2006. Like many fast-paced technical fields, information security degree programs that exist now are often abysmally out of date and fail to teach relevant skills. Hiring authorities still see many ‘paper tigers’ who leave 2-4 year degree programs with no substantial real life knowledge.

While I personally do recommend a computer science degree for academically-focused people interested in pursuing a security career, degrees still function mostly as a means of gaining fundamental knowledge in a structured environment, and a stepping stone for career progression and salary increases. Useful intangibles gained by attending a university often tend towards report writing, business, and interpersonal skills. There are other valid ways to gain those skill sets. Many a lauded information security executive has a degree in business, unrelated engineering, or indeed, fine arts. A large percentage don’t have degrees at all (although they still increase promotion potential).

What really counts toward being a competent information security executive? Passion, drive, and business savvy. A firm understanding of high-level fundamentals encompassing a broad range of niches. The ability to hire the right subject matter experts and technical managers to advise him or her without requiring micromanaging. Excellent risk management skills. The ability to play a tough political game to advocate for good security practices and necessary money and headcount.

I don’t know more about Ms. Mauldin than what the internet bios say. It’s possible the blame for a majority of the mistakes made by Equifax lie with her. It’s also possible her input and reports were universally dismissed by the CIO or CEO, and more of the blame can be placed on them. These things may become more clear as more technical and operational details are released. For the time being, stop looking at degrees and certifications for answers, lest you unintentionally personally insult some of the best minds in security as a side effect.

Credit Card Security Infographic

Posted on by

CCinfographic

I commissioned the very talented artist Bryan Ward to make a good quality version of my previous credit card security infographic. This is meant as a tool to educate and inform people who post photos of their credit cards on the internet, and you may link to or repost it accordingly. Please give credit and do not use it commercially without permission.

Click the image above to view a larger version in a new window. I can provide a PDF version for printing if requested.

Why NotPetya Kept Me Awake (& You Should Worry Too)

Posted on by

NotPetya may not have been the most sophisticated malware ever written. However, it was exceptionally effective due to the authors’ savvy exploitation of common security misconceptions and their deep understanding of poor security architecture. I want to briefly express my personal thoughts on why I found NotPetya particularly concerning and a bad omen for things to come for the digital world.

Living Off The Land

A lot of the news coverage on NotPetya is focusing heavily on the use of the stolen EternalBlue (MS17-010) exploit. In my opinion, this distracts from something more sinister, because patching Windows is in many cases a relatively clear and simple fix.

NotPetya has a choice of several means to move across a LAN once it is inside a perimeter. As well as exploiting MS17-010, it can also use PsExec and WMIC to move from system to system after using a stripped down version of the Mimikatz tool to steal passwords from the system it is on. PsExec and WMI are common methods of administering Windows systems and are provided by Microsoft.

I’m honestly a little surprised we haven’t seen worms taking advantage of these mechanisms so elegantly on a large scale until now. They are very popular tools in modern hacking. A good hacker avoids the use of malware and code exploits whenever possible. He or she may use them occasionally where no other practical option exists – for instance, exploits might be needed to escalate privileges on a system, or malware for initial phishing compromise – but every use of malicious code is one more potential detection point for traditional signature-based antivirus and Intrusion Prevention Systems (which are relied on exclusively far too often). There’s no sense in using malicious code when simpler and quieter means are available.

The use of WMI to move laterally across a network is increasingly trendy, and the use of PsExec to do so is nigh archaic now. Both methods remain stunningly effective, because they are popular avenues for systems administration and often inadequately monitored. Logging of WMI lateral movement was quite tricky until Windows 8, and with large swathes of Windows 7 (and older) still in use in business it’s still frequently neglected.

The use of these propagation methods alone is not likely to fire any built-in attack signature in traditional, signature-based security tools. There’s nothing to sandbox nor an unusual unique file hash to scan for. On the surface, this activity will look like administration, and might only be detected by more detailed behavioral analysis. With the speed that NotPetya was able to spread, this isn’t particularly practical.

Abusing Mandatory Software

One of the primary initial infection vectors of NotPetya was the compromise of the update package for a piece of Ukrainian financial software, M.E.Doc. According to reports, this software is one of only two software options Ukrainian businesses have to pay their taxes. This was a clever choice for three reasons:

  1. Attacks were constrained somewhat to Ukraine (and companies that have interests there).
  2. The distribution base within the country was extremely comprehensive. Ukrainian businesses would have a high chance to have this software on a computer.
  3. The software company was relatively small and may potentially have been compromised previously, indicating it was potentially under-equipped to rapidly respond to a sophisticated attack on this scale.

This is obviously not a new thought pattern – attackers have leveraged popular, commonly deployed software for exploitation for decades. Adobe Flash and Java were two of the more abused programs in recent history because they had extremely wide installation bases. However, that was within the context of commodity malware and crimeware which typically infect victims fairly indiscriminately. NotPetya delivery combined elements of a targeted watering hole attack we’ve traditionally seen used by nation states with traditional software exploitation to devastate a specific user base. Obviously, the potential of this avenue of attack can be explored further in the context of nearly any country or demographic.

Masquerading as Ransomware?

In both the case of WannaCry and NotPetya, we saw malware that was ostensibly ransomware end up not looking as much like it after a deep dive under the hood and into attacker behavior. WannaCry had lackluster response to handling actual payments, and NotPetya looked deceptively identical to the older ransomware Petya on the surface while functioning quite fundamentally differently (and not being particularly well designed to make money). This sowed confusion for responders, and eager security companies posted early misleading reports. Masking targeted attacks as crimeware is an interesting strategic choice which could indicate a number of very troubling things. I will leave further speculation on those to my natsec and threat intelligence colleagues.

Ransomware is loud. Until Cryptolocker in 2013, the majority of crimeware tended to be purposefully quiet – stealing data and performing other nefarious tasks without its victim’s knowledge. Ransomware is intentionally disruptive. Independent of anything “cyber” it is also a tremendously effective criminal enterprise model, so it has become increasingly popular. There is plenty of clear evidence in the form of money and news stories that demonstrates how much ransomware can impact victim organizations and individuals’ lives. This means ransomware is also a great pretense for groups with other motives. They know their attack will cause misery and lost money, and news organizations cover ransomware attacks enthusiastically (often without much further digging).

Abuse of Poor Network Security Architecture

Beyond the use of native tools, NotPetya’s lateral movement mechanisms were extremely effective because they exploited common weaknesses in many big networks. Of course, unpatched (or not recently rebooted) Windows hosts were vulnerable to MS17-010 exploitation. Beyond that,  lateral movement with WMI and PsExec is very effective in environments with poor network security architecture and implementation. Flat networks without segmentation were vulnerable. Networks where their use was permitted were vulnerable. Networks where desktop users commonly had workstation admin or domain admin permissions were vulnerable, and networks where these privileges were not restricted or tightly controlled were more so. Windows 10 credential guard was a potential mitigation against the theft of passwords from system memory, but it is infrequently deployed and not backwards compatible (or indeed, even compatible with every computer running Windows 10).

All of these design and implementation problems are woefully common, repeatedly bemoaned by security professionals auditing and consulting on those networks. They are not easy or cheap problems to fix in many cases, and this is likely not going to be the case that pushes a lot of vulnerable organizations over the edge in mitigation.

Yes, I’m Concerned

If you work outside Ukraine, you probably got really lucky, yesterday. Many enterprises were tremendously vulnerable to this type of attack, had they merely been targeted by the initial attack vector one time.

Blood is in the water. Not only have criminals found that ransomware is a great money-making scheme, but nation states and terrorist organizations have realized pseudo-ransomware makes a misleading and effective weapon. A weapon that can cause collateral damage, globally.

Things are going to get worse, and the attack landscape is going to deteriorate. Malware relying more on legitimate credentials and native tools may easily render signature-based and hash-based solutions fundamentally less effective defenses. Organizations must no longer rely on black boxes with good sales pitches to band-aid fundamental architectural failures and neglected security best practices like out of date operating systems, liberal administration policies, legacy protocols, or flat networks. Defense in depth, including human threat hunting and effective detection and prevention at many points, is key. This will involve policy and financial buy-in from many lagging organizations at a new level.

 

 

 

Edit: 6/28 10PM – Minor technical corrections to clarify the purpose of M.E. Doc, the debate over encryption issues in NotPetya, and grammatical errors. Thanks to MalwareTech, grugq, and Jim Moore for pointing out my omissions, and duplicate words!

7/5 3PM – A video was posted of the seizure of M.E.Doc’s equipment which shows the equipment and approximate number of employees at the firm. https://www.youtube.com/watch?v=TY5f2fmwcDE

This blog will be updated as further information is available.

Consolidated Malware Sinkhole List

Posted on by

A common practice of researchers studying a piece of malware is to seize control of its malicious command and control domains, then redirect traffic to them to benign research servers for analysis and victim notification. I always highly recommend monitoring for traffic to these sinkholes – it is frequently indicative of infection.

I’ve found no comprehensive public list of these sinkholes. There have been some previous efforts to compile a list, for instance by reverse engineering Emerging Threats Signatures (mikesxrs – I hope this answers your questions, a little late!). Some sinkholes are documented on the vendors’ sites, while others are clearly labeled in whois data, but undocumented. Still others are only detectable through behavior and hearsay.

Below, I share my personal list of publicly-noted sinkholes only. Please understand that with few exceptions I have not received any of this information from the vendors or organizations mentioned. It is possible there is some misattribution, and addresses in use do change over time. This is merely intended as a helpful aid for threat hunting, and there are no guarantees whatsoever.

Before we proceed, credit where credit is due:

I am certainly not claiming credit for this entire list. There are many smart people out there who provided partial data and clues.

http://www.kleissner.org/ maintains fantastically useful lists of command and control servers for numerous botnets. Within those lists, a number of sinkholes are attributed to specific organizations, some of which I could and could not independently verify.

The extremely talented Miroslav Stampar has quite a few sinkholes identified within his maltrail malicious traffic detection tool.

Many, many Robtex, DomainTools, and VirusTotal queries and a lot of Google search hacking went into compiling and cross-checking this list. Michael B. Jacobs has written a terrific paper  which covers some of the methodologies I used to detect and confirm undocumented sinkhole servers through DNS and behavioral analysis.

There are more detailed databases of sinkholes, but they tend to be access-restricted and contain data I will not repost for confidentiality reasons. My list is fully OSINT-based and can be reproduced with time and effort.

Here’s the current list:

If you have any corrections to offer either as one of these organizations or an independent researcher, please contact me and I will give credit in this blog accordingly.

 

College and Infosec: To Degree or not to Degree?

Posted on by

So, you love to hack, and you’re going to get that dream job in infosec! Except, now what? A wide array of certification firms and colleges are willing to sell you an infosec program, with shiny advertisements and clever sales pitches. Unfortunately, college is massively expensive in the US, and the learning environment isn’t great for everybody. Is it worth the money and effort to get that Bachelor’s in Cybersecurity? Will a degree in an unrelated field do the trick? Will not getting a degree come back to bite you years later?

***

College degrees. I’ve found few topics aside from vulnerability disclosure in information security which raise so much raw emotion and fierce debate. In the interest of giving a well rounded and diplomatic answer about their value, I’ve once again asked several exceedingly qualified people to join me in sharing their time, experience, and ideas on the subject. Through a series of ten questions, each of us has weighed in on some hefty questions about the value of college education in learning about information security, getting an information security job, being promoted, and showing credibility.

Please allow me to introduce today’s contributors, who have generously contributed their time and thoughts:

Daniel Miessler, I’ve been in information security for around 18 years, with most of my time in technical testing (thick, app, web, mobile, IoT) and consulting. I lead OWASP’s Internet of Things security project and run a website, podcast, and newsletter where I talk about infosec, technology, and humans. More at https://danielmiessler.com/about.

Tarah M. Wheeler, Tarah Wheeler (BA, MS, CSM, CSD) is Principal Security Advocate & Senior Director of Engineering, Website Security at Symantec. She is the lead author of the 2016 best selling Women In Tech: Take Your Career to The Next Level With Practical Advice And Inspiring Stories. She co-founded and now serves as board chair for Fizzmint, an end-to-end employee management company. She has led projects at Microsoft Game Studios (Halo and Lips), architected systems at encrypted mobile communications firm Silent Circle, and holds two agile development certifications through the Scrum Alliance. She founded Red Queen Technologies, LLC & Infosec Unlocked. She acquired her startup funds by cleaning out poker rooms in the Northwest and Las Vegas. Reach her at @tarah.

Robert Sheehy, @helpmerob. Helping “people” with “stuff” while holding a senior management role in infosec.

Space Rogue, Looks like everyone else is putting their corporate bio here, uggh. I’m just some guy, ya know? I’ve been around for a while and I’ve done some stuff. I currently work as a Strategist for Tenable, [@spacerog http://www.spacerogue.net]

Chris Sanders, Chris Sanders is an information security author, trainer, and researcher. He is the founder of Applied Network Defense, a practitioner focused information security training company, and the Rural Technology Fund, a nonprofit devoted to providing technical education resources to rural and high poverty schools. He is the author of the best-selling security books Applied Network Security Monitoring and Practical Packet Analysis. He also hosts the Source Code Podcast., [@chrissanders88, http://www.chrissanders.org]

Jessica Hebenstreit (@secitup),  I’ve been doing security for almost 17 years.  I got a lucky break early in my career at Motorola as an Intern and have been doing InfoSec ever since. I’ve done a lot of different roles in a few different verticals.  I always come back to Ops and IR. Creator of the DREAMR framework, speaker and volunteer.  I am active in the security community and enthusiastic about making the industry more inclusive and accessible. https://twitter.com/secitup/  https://www.linkedin.com/in/jessicahebenstreit/

Without further ado, let’s launch into some of the most contentious questions about career paths in the industry!

***

  1. First of all, the elephant in the room – did you go to college or university yourself? If so, did you get your degree before or after you started formally working in security?


    Jessica: In short yes.  However my academic career was varied, and longer than a traditional “4 years”.  I started at Iowa State University in the Computer Science program.  After a couple of major changes (because I am not great at coding and suck at math), along with study abroad experiences and transferring to Arizona State, I graduated with a Bachelor’s degree in Interdisciplinary studies with a focus on International Business and Spanish.  I was fortunate to start working in security as an Intern at Motorola for 3 years prior to graduation.  I was offered a full time role that I began prior to actual graduation.  I also have a Master’s degree that I obtained in 2012.

    Space Rogue: I started school like everyone else but quickly ran out of money despite the GI Bill.. I was able to get good paying IT jobs anyway and figured I didn’t need a degree. Then one of the many recessions in my career hit, I found myself out of work with few opportunities. I could almost always get an interview based on my resume and experience but on more than one occasion after the third or fourth interview I was asked, “So I don’t see a degree on your resume, do you have one?” I would answer truthfully, “No, but I have years of experience and have done all these great things, blah blah.” and I was told “Thank you very much, we’ll call you.” After the fourth time in a row that this happened I decided I needed to get a degree. It took me several years of online and night classes but I finally graduated.

    Chris: I had an opportunity out of high school to take a computer network consulting job that would have put me in the top 1% of earners in Mayfield, KY. Of course, that was making 40K/year as Mayfield is a very rural, high poverty area. I’m fortunate that I had a few teachers who really cared about me and got it through my head that my ceiling was much higher and a degree would help me realize that. I ended up completing my bachelor’s, master’s, and am currently working on my PhD. I couldn’t afford college and didn’t receive nearly enough financial aid to pay for it all, so I worked full time (and then some) while working through all of my degrees.

    Robert: I received a two year degree in computer programming, although I have been considered a hacker since my early teen years. I’ve undertaken a significant number of independent studies since getting my degree, most of which did not result in a formal credential. I’ve taken and passed well over three dozen various IT and infosec certification exams, with close to a dozen still being active. Most of them demonstrate a minimal understanding of baseline requirements and not of advanced expertise. I feel that some people are way too proud of their credentials and certifications.

    Tarah: I went to college before formally working in infosec, though I’d been doing hardware assembly and servicing since 16 and coding since I was about 19. I got degrees in international relations and political science with quantitative elements. I have a BA and an MS, and in my experience, no one at all cares if those degrees are in cybersecurity or not. They’re an absolutely indispensable box tick when it comes to getting past HR, however.

    Lesley: I hold two Associate’s degrees (Avionics and Electronics) which were more an accidental byproduct of completing a lot of coursework than anything else. My Bachelor’s is in Network Engineering. I received it before working in infosec formally and after joining the military (thank you, G.I. Bill!). There weren’t really any security specific degree programs yet at the time.

    Daniel: I did go to college, for four years, but I left before graduating to start my professional career in infosec without a degree. I’ll be completing my bachelors soon and moving on to a Masters. At this point it’ll be just to check the box and for the fun of it.


  2. Based on your experiences hiring entry to intermediate-level infosec professionals and working in the field yourself, where do you fall on the spectrum of extremely pro-college, somewhat pro-college, neutral, somewhat anti-college, or extremely anti-college?


    Chris: Somewhat pro-college. I think everyone can benefit from being surrounded by a group of people who are devoted to learning. However, I recognize that it isn’t for everyone and finding the right faculty/college/program is non-trivial. All things being equal, if I’m choosing between two candidates I will go with the person who has a college degree.

    Tarah: Somewhat pro-college. I don’t think in any way that college is a prerequisite for being in security. I think it’s a startling leveller when it comes to diversity in technology, and one of the challenges employers are always facing is how to justify hiring someone who doesn’t “look” like a hacker or coder. I have, in my several previous positions, had to fight like a dog to get a woman or a person of color or someone queer to get hired, and sometimes the only ammunition I have is that they have a degree, and the more stereotypical (and often less-well qualified or experienced person) doesn’t. When I’ve been the CEO, I could just say “you’re hired,” but when I’ve been in a hierarchy, I have had to, in the past,  justify my decisions to a structure that doesn’t always understand the hacker mindset.

    Space Rogue: Neutral. Personally I would rather hire someone with at least some experience than just a college degree. I am always looking for someone who has done something, anything, real as opposed to just book learning. But I also realize when it comes to hiring managers I’m probably a bit of an anomaly. As infosec as an industry matures it is becoming more and more difficult for entry level people to stand out amongst the crowd. There is a lot of talk about the talent shortage in infosec but that really only applies to the mid and high level. The entry level is awash with people just finishing college with their newly minted degrees all looking for some way to stand out.

    Robert: Neutral. There needs to be experience outside of school for anything beyond entry level. Without experience, a credential can help to demonstrate that the candidate can see through a formal curriculum program to completion.

    Jessica: Somewhat pro-college, I believe some are “late bloomers” and that college right out of high school may not be for everybody.  I think more doors are opened for college degrees. I also think college gives one a variety of experiences and challenges one might not encounter otherwise.  I also realize college is expensive, at least in the US and for that reason alone can be out of reach for some folks.  I am still deeply in debt for my degrees.

    Lesley: Somewhat pro-college. I see more benefits than negatives, but it’s not for everybody and it’s extremely expensive in the US.

    Daniel: Somewhat pro-college. There are skills you can get from university that you don’t usually get other places, but it shouldn’t be considered a must for most infosec positions. This is something Google figured out when they did their big study of what variables make people successful. They expected to find that great colleges produced the best workers. Or people with the best grades, or who interviewed best. But no–they found few correlations with any of this stuff, and they were forced to accept that there’s no magic variable to any of it. Their people who went to college or didn’t, or went to a small school vs. a big famous one, didn’t show much difference in their performance. It turned out to be all about the management of the team that made the difference, but that’s a story for another day.


  3. What are some skills, motivations, and credentials that stand out to you the most on a entry level infosec résumé (before the first phone screen)?


    Space Rogue: I look for anything done outside of school that is relevant to the job. I want to see some kind of passion for the work, at the entry level it doesn’t have to be much but something. If the resume is nothing but degrees and certs and zero extracurricular things they will unlikely get an interview from me. If a person has no relevant work history at all then I want to see non-relevant work history. To me work history, any history, beats formal education every time.

    Chris: I don’t expect much out of an entry-level resume and put very little stock in them. I rely much more heavily on the interview and wind up interviewing most of the people who apply to an entry-level posting. Hiring is the most important decision I make, so it’s well worth the time spent. As far as resume content, it’s an entry-level job, so I don’t expect them to be passionate or display that on the resume yet. I want them curious, and then as their manager it’s my job to help them evolve that into passion. That said, if someone has already started learning about the field I think it’s great to list what they’ve been learning, how they’ve been learning it, and who they’ve been learning it from. I also value resumes that show involvement in service projects. People who have a servant leadership mindset and are willing to give of themselves are the type of people I want to work with.

    Tarah: Have they built a computer from parts to booting? Have they contributed to an open source project…even so much as a pull request to fix a typo? Have they built a website? Have they tried to harden their home network? Have they ever demonstrated that they’re willing to help others by posting blogs or information or answers? I don’t much care if they feel like they’re good people or if they love animals. I care what they can *do*. No one can hire solely on potential; you must demonstrate some of your ability.

    Jessica: Passion for the industry is something I definitely look for.  Personal projects that one can speak to such as those on github, or a blog.  Competing in things like CTFs or other contests, volunteering and other involvement in conferences, competitions or other projects show a passion for industry.  

    Robert: Personal initiative and interest in information security. The best professionals are passionate about what they do.

    Lesley: Speaking, presenting, competing, or working at infosec conferences. Other participation in the security community through projects or meet-ups. Some type of dedicated coursework that demonstrates good systems and networking fundamentals, or equivalent work experience in another IT field. Some college is a plus, but the degree doesn’t have to be technical. Overall, I look for motivation to learn and succeed.

    Daniel: Having a website or other home for projects you’ve created or helped with. Projects show passion, and passion is a powerful force for improvement. If you’re actively working on projects in your field there are few things that are more compelling to a hiring manager than seeing actual fruit of that curiosity and skill.


  4. Can you think of a situation in which you might recommend that an entry-level person who is interested in security not get a degree?


    Space Rogue: I don’t think I could recommend anyone not get a degree ever, not in today’s job market. In the 90’s and early 2000’s almost nobody had an infosec degree because infosec degrees did not exist. Everyone was self taught so if you didn’t have an infosec degree you were no different than anyone else. Infosec or more accurately ’cyber’ degree programs exist at just about every college and university today. If you decide to not get a degree you will be at a pretty big disadvantage compared to everyone else competing for the same entry level job. That said, if your resume makes it to my inbox I won’t really care if you have a degree or not if your resume shows that you have the experience and or skills for the job. But then I’m probably not the hiring manager for the job you are applying for.

    Chris: I had to work 60+ hours a week to pay for college and even then I still have fond memories of standing in Wal-Mart calculating what foods had the best dollar/calorie ratio so I could spend as little on food as possible. You have to REALLY want it sometimes (or just be deathly afraid of failure). If you have hardship to deal with, whether financial or family, you have to figure out how much pain it will cause you and whether the upside reward is worth it. For some people, it simply isn’t.

    Tarah: No. Sure, save money and do some at a community college, do the GI Bill, do a state school and be a big fish in a little pond…but I simply cannot in good conscience knowing what today’s job market looks like and how overheated cybersecurity hiring is going to be for the next ten years recommend that someone not get a degree. Note here that I don’t give a damn what your degree is in. Neither will anyone else past possibly a couple of people in your first entry level jobs. Just get one. And get an MS if you can. It’ll pop your earnings drastically long term and is  a HUGE leveller for diversity in tech.

    Jessica : No, I’ve spent quite a bit of time thinking about this question recently and I really cannot come up with a scenario where I would recommend not getting a degree. Even if you have to go part time while you work and it takes years and years, I strongly believe you will be better off in the end with the degree.  I think there are definitely outliers that find vast success on skill and reputation alone, but those folks are few and far between (you know “outliers”).  I’m seeing more and more organizations that are putting in hard and fast degree requirements, particularly in healthcare and high education, without which you will quickly reach a ceiling.  I’ve seen this ceiling as low as not going past a Senior Analyst/Engineer without a degree.

    Robert: College degrees are only one way to show that you’re well rounded and take your professional development seriously. An individual’s personal situation and experience must be considered in respect to what is the best focus of their professional development efforts. Particularly if student loans are involved, the long term debt accumulation might not be worth it. Focusing instead on a certification could serve as a first helpful step towards gaining that first position in infosec.  If working as a contractor it might be wise then to defer schooling even further in your carrier until obtaining a permanent position that offers tuition assistance. With professional momentum and outside self study, you might get to the point in your career where your professional experience are accepted as substitute for the formal accreditation. World travel, for example, can be used to demonstrate educational sophistication in lieu of a degree.

    Lesley: If they’re only interested in the money or prestige as opposed to the work, or they haven’t done anything to learn about the field before launching into a degree. Also, if they already have a strong network of infosec contacts and going to school would interfere with taking a great opportunity immediately. Lastly, if it’s a significant long-term financial burden, college may simply be unfeasible.

    Daniel: If they already have some significant level of skill that makes them competitive and they’re being offered a job in the field similar to what they’d get when they graduated. Even then, if it would be relatively painless, I’d say get the degree just to have the checkbox, but if it’s overly difficult and you already have the skills required to get a job, go for it. It all depends what you’re looking for. If you just want to get into the field, you can do that. But if you want to make it to the top at a big company, you’ll probably need a bachelor’s and/or masters.


  5. If an entry or intermediate-level infosec person chooses not to get a degree, what are steps do you suggest he or she take to mitigate this when applying for jobs or promotions (which may state college as a requirement or preference)?


    Space Rogue: My first bit of advice is to realise that without a degree there are some jobs where your resume just won’t make it past the first level of HR. However if it is a job that I am hiring for and your resume can actually make it to my inbox then I will want to see some sort of experience. Something that says you are really interested in this line of work, volunteering at an infosec conference, a github project, contributions to an OSS project, participating in the local citysec meetup, something, anything.

    Chris: While this may be an unpleasant fact of life, not having a degree may affect your ceiling because some organizations value it. However, for the job seeker there is a benefit that infosec is in a skilled worker shortage. If you can develop skills in areas where need exists, you can find a job. However, you need to be able to show those skills in some way. For some people that might be a certification, for others it might be a github repo showing a project, and for others it might be a blog. Once you establish one or more of those things, focus on connecting with real people instead of relying on HR gatekeepers and automated systems. Do your research, find people working in or hiring for roles you want, and reach out to them. Even if it doesn’t lead to an immediate job, you might find a mentor or build a long-lasting relationship.

    Lesley: Network, network, network. You’re going to get blocked at a number of HR filters, which are automated and unforgiving. So, your hopes lie with name recognition with hiring managers who can tweak postings for you or somehow bypass the computer. This means proving your competence through projects, community participation, and being articulate. Currently we’re in a skill shortage, which plays in your favor in this scenario. This gap is decreasing, starting with entry level as more people graduate from cybersecurity training and degree programs. Certain geographic markets will take longer to catch up than others, so looking outside your local area may help.

    Robert: It is not a degree by itself that makes someone qualified for a senior position, rather they serves as a proxy to be used by the hiring managers to measure capability. This requirement can be substituted, but constructing the best argument to support your personal experience as a worthy substitution is completely on the individual. Non-traditional education can stand for formal degrees, but it may require a substantial effort to make the case for your specific goals, and are likely to require repeating every few years.  Always address any concerns about an educational deficiency in your resume head on when pursuing a new roll. It can go a long way to submit a well written statement in response to any concerns that you’re willing to obtain whatever credential is expected while working in the position, along with spelling out in detail how your specific personal accomplishments and experience directly address the traits your target is hoping are demonstrated by having the degree requirement.

    Tarah: Get good and get well-known for it. Get a CISSP, which is the bareass minimum you’d need to get past HR without a degree at some infosec jobs. Network your ass off because without a degree, you’ll suffer for recruiters contacting you. Figure out how to get some publicity. You must, must, must begin speaking and teaching widely.

    Jessica: First of all take a long hard look at where you want your career to go long term.    I think these decisions are made with a short to medium term outlook.  Come to peace with the fact that you are likely closing doors and limiting your upward mobility.  That said, get certs CISSP is a must to get past HR, I also recommend several SANS certs, maybe the OSCP, depending on which area in security you want to be.  Lastly, get your name out there, network, get on twitter volunteer and/or speak at every conference you can.

    Daniel: If they’re just starting out and don’t have a degree they’re going to need to show proof of existing skill. That usually means blogging and projects showing your abilities. Show vs. tell is a powerful concept in today’s market.


  6. Conversely, can you think of a situation where you might suggest to an infosec candidate that he or she should get a degree? If so, which skills would this most enhance?


    Daniel: I’d say get a degree if it’s at all easy for you to do so. If it’s paid for. If it’s an easy program. If your friends are there anyway. Etc. If it’s not going to put you out too much, or if you don’t have any skills at all and you need to learn fundamentals in a structured way. The other advantage is just rounding out your writing, general education, etc., which are important for advancing to later career stages.

    Space Rogue: Getting a degree is not going to hurt you. You will never be disqualified from a job because you have a degree. It is possible to get a degree without spending fortune and going into debt. You can either get a degree to actually learn something or you can just get the piece of paper. Either way a degree can only help you. If you are going to spend the time and money to get the degree you should try to actually learn something. I would focus on any hands on classes where you can actually work with production systems, even if they are simulated. Learn to code. Any class that allows, no, encourages you to break things.  

    Lesley: When you can’t fill more than half a page, single spaced on your resume with IT-relevant skills or experience, it’s definitely worth considering. Also, some companies and government agencies value degrees very highly as a corporate culture, and degrees may be tied fundamentally into future promotions or pay raises. If you’re looking to join one of those organizations, or you want to stay in one, it may be time to start planning ahead. Finally, if you have G.I. Bill or your employer pays a significant portion of tuition fees, it’s prudent to not waste free money.

    Chris: If you are capable of getting a degree, you should do it. There are immense benefits to being surrounded by people whose goal is to both teach and learn. Not only might you actually learn something, you’ll also learn how to think differently and be exposed to viewpoints differing from your own. In real life you have the option of filtering out people who you don’t agree with. In academia, that is a lot harder and it forces you to think about things you’re not used to thinking about. This also makes you better at debating, presenting information, and incorporating new information into your existing viewpoints.

    Robert: College can be fun, you can learn a lot, and start networking with other future professionals early. What degree you get likely does not matter for a career in infosec, but I would recommend sizing any opportunity to get a degree if it does not come with a significant debt burden.

    Tarah: Getting a degree cannot possibly hurt you. The Pareto-optimal solution is to get a bachelors in any field as cheaply and as rapidly as you can. Unless you are graduating top of your class in CS at Stanford or MIT, no one cares.

    Jessica: Getting a degree, any degree is not going to hold you back. If you have a desire to someday move into leadership a degree is going to help to facilitate that.  I know a lot of folks in security that do not have technical degrees; archaeology, accounting, psychology, business, women’s studies to name a few. I also know several folks that didn’t get a degree and are now finding roadblocks to advancement because of it and are now going back in their late 30’s and 40’s to get the degree while also now balancing a job,  spouse, kids, etc. which makes it that much more difficult.


  7. Assuming an entry or intermediate level infosec person has decided to get a degree, do you find more value in non-technical degrees or technical degrees? Is there any value in a minor in a different field? Does it matter at all from your perspective or management’s?



    Daniel: I think technical degrees are preferred. CS is preferred but CIS (what I did mine in) are also solid. The more you get away from those the less value it’ll have for infosec jobs. But keep in mind that many companies are just looking for the bachelors checkbox. This matters most if you’re looking to a formal hiring process at a very large or prestigious company, where CS and CE are preferred.

    Space Rogue: If you just want to pass the first entry gate of HR then get a degree in basket weaving or creative writing or philosophy. The automatic system scanning your resume won’t care and will sort your resume into the ‘with degree’ pile. Assuming you focus on a ‘cyber’ degree your minor will depend on what your long term goals are. If you want that CSO/CIO job in 20 years then look at a business or even accounting minor but I wouldn’t discount an art history or western civ minor either. You might be surprised at what lessons from other fields can be applied to infosec.

    Lesley: What you gain from a degree is much more fundamental than technical minutiae, which becomes obsolete quickly. Lots of skills one learns in college are ubiquitous across majors. Business, language, and communication courses provide important insight in our field. From a technical degree, you should concentrate on gaining a solid understanding of how things work at a fundamental level: programming, the telecommunications infrastructure, attack vectors, and common system architectures. Learning how to use a specific tool is rarely helpful after a couple years, and I see few course curricula that aren’t already several years out of date. You should be learning how to think logically, continue learning, and express your thoughts professionally.

    Chris: The unfortunate fact of our industry is that most university degrees don’t actually teach the skills necessary to do the job well. There are a few pockets of excellence and great instructors scattered here and there, but they are rare. Traditional computer science is great at building engineers and programmers, but not information security practitioners. Dedicated programs for information security are often dramatically out of date and focus on the wrong things. For that primary reason, I urge people to get degrees in other things while studying infosec through non-traditional means. This also has an added benefit of bringing “outside” perspective into information security, which is much needed and helps set you apart. I perk up when I meet someone who has a degree in physics, psychology, engineering, english, or something completely unrelated to tech. I can’t wait for the day where I feel good recommending people pursue information security degrees, but that day isn’t today. You can come from anywhere and be an effective infosec practitioner, but the ability to think in a way that is unique from your peers will help you move up quicker in many cases.

    Tarah: There’s a hack here. The hack is to get your degree in whatever you can get paid for or most cheaply–and to take research methodology or EECS or applied math courses alongside. This is what I did. I have a decade and a half of technical coursework that bumped my skills to next level in math, data structures, computer science, electrical engineering, social network and complexity theory, etc. You can pick and choose what you emphasize as you speak to employers. I personally find that people with philosophy degrees make magnificent programmers, and people with math degrees make magnificent philosophers.

    Jessica:  Get any degree.  I think there is something to be said for applying ideas and learnings from one field to security.  I started out in a technical program (computer science), but had a hard time with programming classes (I took intro to C++ 3 times) and math classes (Calculus I 3 times as well!) and it wasn’t feasible for me to continue this path.  I went into my manager at Motorola where I was interning and she said something along the lines of:
    “Jessica – you have a job here but you have to graduate at some point.  I can’t hire you without your degree and you can’t continue as an intern without being in school. You work for a multinational corporation get ANY degree that could be applicable.”

    I then scoured the course catalog and settled on International Business and Spanish.  There is a lot to be said about being well rounded and not having all of your knowledge in one basket.  I’ve also never had an interviewer ask “why International Business and Spanish; not CS/CIS/MIS/etc.?”

    Robert: Since any degree is unlikely to actually provide you the core skills you need to be successful in infosec, the degree pursued is insignificant. I’d recommend taking a topic you find interesting that you will see through to completion.


  8. Considering candidates you’ve interviewed and current cybersecurity curricula at a variety of institutions, would you recommend cybersecurity-specific degrees at all? What would you consider some indicators of a good and/or a bad infosec degree program?




    Daniel: I generally judge programs by big vs. unidentifiable names. If it’s a big name school, or a big CS school, that’s a plus. If it’s a no-name school then it’s just a CS checkbox, which is still positive. Most of the benefit of someone from a big name school is the fact that they got accepted in the first place.

    Space Rogue: To be honest I am not super familiar with the various programs that are out there. I know some are a lot more hands on than others but if I am looking at a resume I am unlikely to research your school to see how good of a program they have because frankly I don’t care. However, if you are looking to actually learn something then look for a program that has additional certifications. Something like the NSA’s National Centers of Academic Excellence in Cyber Defense or other certification.

    Lesley: I see too much focus in most “cyber” programs on specific tools and minutiae, as opposed to critical IT fundamentals which are so important to being a good hacker or defender. Also, I see an unfortunate tendency to gravitate towards the cool, theoretical, and “sexy” as opposed to less exciting but more relevant skills. For instance, my ongoing gag gripe is about every Forensics major I meet doing their thesis on steganography, which is relatively rarely seen in real practice. The same people often aren’t comfortable with memory forensics or timelining. There’s a lot of pragmatism in real life infosec. Overall, ensure that the program has plenty of general IT courses that build a good understanding of how systems work, and references real life cases.

    Chris: Our industry is really good at building excitement around topics like breaking and hacking. Unfortunately, those aren’t the skills you learn first and they aren’t the areas where the most jobs exist. Most cyber security programs gravitate towards those areas and skip over the fundamentals. The ones that do see a need for the fundamentals often think those fundamentals are computer science. While computer science is foundational, you don’t need to be an expert in mathematics or embedded systems to be successful in the vast majority of infosec jobs. For these reasons, I have a hard time recommending cyber security degree programs. I’m hopeful this will change at some point when more experienced practitioners find their way to academia, which is happening. Universities needs more instructors who have been in the trenches, but also understand academics and what foundational knowledge is critical for our field.

    Tarah: Only the power of your alma mater’s network matters here. Unless you’re going to UW, CMU, Stanford, MIT, Berkeley, or a similar program known for tech, your best  move is to learn what you love and add tech as tools for you to use. That will be reflected later in your work and career.

    Jessica: I feel like a lot of the “cyber” programs are reminiscent of the MCSE bootcamps from the early 2000’s and other certification mills.  If that is the program you want, then find a quality one.  Otherwise go for another degree.  Cyber programs also need more folks that have been actual practitioners to teach actual skills that will be used.  Having a good foundation, rooted in theory is fine and in some cases needed; however  I see too many candidates now that can memorize the buzzwords and talk very shallowly about a concept but cannot apply it in a meaningful way.  Additionally, critical thinking and analysis skills are sorely lacking.  Those are hard to teach but it’s really hard to be a good Security practitioner (particularly in a role like SOC or DFIR or Red Team) without those skills.


  9. At this time, (or in the near future), do you foresee any potential benefits in the infosec field in going on to get a graduate degree?



    Daniel: Yes, if you’re interested in working in any sort of formal field. Like government, or a big company in a specific department, like data science. Other than that, the bachelors is usually quite sufficient. The other thing a Masters is good for is that it’s somewhat important for senior roles in big companies, or top roles (CISO) at any company, if you think you might want that later on.

    Space Rogue: If you really want to differentiate yourself in the job market then yes, get a graduate degree. But this really depends on your own personal long term goals. If you really want to be a scapegoa^H^H^H CIO/CSO than a graduate degree will be a big help in achieving that.

    Lesley: I can see two situations where this would be desirable. The first is when it is likely to be required for a desired promotion in the future (I do see Master’s Degrees, especially MBAs, preferred for senior leadership positions). The second is when one’s intention is to stay in academia or dedicated advanced research. I rarely see graduate degrees greatly preferred over a Bachelor’s degree in entry-to-intermediate level infosec hiring.

    Chris: If you are thinking about a masters degree then you should have a sense of how much you enjoy your current work and where you want to go with it. For example, if you want to get into business leadership then something like an MBA might be helpful. The thing here is that you shouldn’t just pursue another degree because you feel it’s a requirement to get someone you want to go. Chances are, with persistence you might be able to get there anyway. You should pursue another degree because it will introduce you to new ways of thinking and teach you things that will be more fulfilling to you on a personal or professional level. I pursued a master’s degree in homeland security because I was interested in national defense and public policy. That provided valuable perspective that I apply in multiple areas of my life. The more successful people I’ve seen often pursue master’s degrees in things a bit outside their normal comfort zone. The key is that it should be about learning, not about checking a box.

    Tarah: Hell, yes. It’s definitely put me at the top of lists. And my MS is in political science, don’t forget. It’s just a box to check. Get a law degree or an MA in English–it just doesn’t functionally matter.

    Jessica: some industries are now requiring this in order to be in a management/leadership position.  I would not have gotten my job at Mayo Clinic without my master’s degree, they require it for Director level positions.  I think there is going to continue to be more rigor there. I know my Master’s has opened other doors for me as well.  I do wish I would have gotten a JD or MBA instead of my MSIT.


  10. Anything further you’d like to add on the topic?


    Space Rogue: In the ongoing twitter debate there have been a lot of comments about the cost of college. While a traditional name brand four year school will cost a pretty penny there are ways to get an accredited degree without going into huge debt and spending a fortune. Without going into super detail here are some thing for you to google on your own.  Look at your state school, often much less expensive than a private institution. Don’t forget you can start out at a local community college and transfer the credits later. Also depending on what program you are looking at many schools will offer credit for life experience, if you know who to ask. One of the best ways to get credits for little money is the College Level Examination Program, again depending on your school you can get up to two years worth of credits for $80 per class. Anyway if all you’re looking for is to check a box and get a degree cost is not a valid excuse.

    Tarah: Either the hiring manager wants to bring you aboard or they don’t. If they do, they might need extra ammunition for their choice of you over someone else. Make it easy on them by sticking every letter you can behind your name (on LinkedIn, not in your Twitter bio). I want to emphasize one last time: degrees and certifications are the big leveler in diversity. I have a growing body of anecdata that is burnishing my now gold-plated theory that women, POC, and queer people benefit disproportionately from getting degrees and certs. That typically manifests itself as a drastic uptick in recruiter approaches at each career level when you update your LinkedIn in a way that doesn’t seem to happen for people who stereotypically look like the media’s conception of hackers. If the hiring manager doesn’t want to hire you (based mostly on the first fifteen seconds of your impression on them) no degree will help you. But chocolate and career coaching might.  🙂

    Jessica:  College is expensive in the US, and the cost is only going to continue to increase.  It will open more doors than would otherwise be opened.  Think of it as future proofing.  I’ve always known I want to be in leadership, but I have colleagues that came to that conclusion later in their careers and are now going school to check the boxes.  Set yourself up for success and an easier path now.  I think as our profession matures it is only going to become a more steadfast requirement, like many professions there are some minimum requirements and I see ours continuing in that direction.  We’ve moved past the infancy of the infosec profession; along with that comes a threshold, which often times and more in the future, means a degree.

    Chris: Most knowledge-based professions have a really well prescribed paths for getting into the field and finding success. If you want to get into medicine, accounting, or law you know exactly what you need to do. Our field couldn’t be farther from that — there is no single path. The beauty of that is you don’t have to go to college. However, like those other professions, you do have to learn how to think. Being aware of how you think and effectively applying that (aka metacognition) is the most critical part of gaining expertise and ensuring you are capable of learning effectively. The beauty of college is that it is the perfect environment for your metacognitive ability to flourish…if you let it. If you view college as an opportunity to do this and seize it you will benefit tremendously. If you view it as merely a checkbox to get a piece of paper, you’ll be disappointed in how far that paper gets you.

    Daniel: Credentials have the value that others place on them. Understand that and you’ll understand a lot about degrees. Make a clear distinction between the education and the credential, and realize that while you can self-educate you can’t self-credential. Understand that you’ll find a full spectrum of respect for degrees in various populations, countries, verticals, sectors, etc. Some will not even notice if you have a degree or not, and others won’t take you seriously unless you do. That being the case, it’s always better to have it than not, so the question is really about what you’re sacrificing to get it, and whether or not that’s worth it.

What’s in my (Hacking Con) bag?

Posted on by

A number of people have asked about what I carry at a typical hacking con. In the blog below, I provide a brief overview. This article isn’t meant to be an endorsement and was in no way sponsored. Use what works for you, but I have included links for things when I can remember where I got them.

First, let me show you my bag, itself:

IMG_0017

My bag is a Grunt Style tactical messenger bag. I like it because of the small form factor, it has lots of interior and external pockets, and has a variety of attachment points – carabiners, molle, ties, and velcro. It also happens to be configured for CCW, if that’s your cup of tea.

I’ve used various styles of backpacks, but I found myself with a tired back by the end of the day and I prefer the security of a cross body I can keep an eye on. This one fits my 13″ MBP in a clamshell. I believe that’ s the biggest notebook one could fit in it (but I highly advise against carrying a 15 pound desktop replacement to a con, if you must carry a laptop at all).

There are lots of vendors that carry similar bags, and each manufacturer has dogmatic followers who will regale you with the merits of their choice. Try them out and see what works for your computer and body.

Now to the important part – the contents of my bag:

The “Must Haves”

Item Purpose
Printed Ticket Because your phone will die or not scan at a really inopportune time.
Phone & Fob-Sized Faraday Bag An alternative option is carrying a burner phone, but for the most part I see people with their personal or work phones at cons. Sometimes you’re in a situation where you want to stop transmitting everything, that minute. Usually it’s because an antenna is pointed at you and somebody is grinning. It’s a cheap and important thing to have.
Wallet with ID, and Adequate Cash
 The RFID wallet fad is pretty irrelevant. Just avoid bringing credit cards if possible, and don’t bring a debit card within several miles of the con. Cash whenever possible, and don’t use an ATM once you’re there!
Phone and Charger Self-explanatory.
Earplugs Because con parties, shared lodging, and airplanes can be too loud for the most die-hard rocker.
Wet Wipes or Hand Sanitizer Con plague is real.
Insulated Water Bottle It’s really important to stay hydrated at *any* big event. Alcohol, coffee, and energy drinks don’t count – bring a refillable bottle to drink lots of water, and have some juice with vitamin C daily. There are two types of bottles I like for cons – insulated bottles that keep water cool or coffee warm, and filtered bottles when the water there is less palatable.
Pens, Pencils, Sharpie Self-explanatory.
SyncStop A must-have if you would even consider charging a device off any USB port that does not belong to you.
Power Bank Outlets are in high demand.
Mini First Aid Kit & Prescriptions I have rarely gotten through a con without myself or a friend needing an OTC painkiller or a band-aid. I would recommend having those, at a minimum.
Mini Toiletry Bag On your person, for long days – not the one in your hotel room. I “militantly encourage” deodorant, and recommend a disposable toothbrush, as well as contact lens stuff and hair ties (as applicable).

The “Nice To Haves”

Item Purpose
Business Card Case Not only will you want to give out cards, but you will likely be handed cards you do not want to lose.
‘Bag of Holding‘ (with cables, adapters, dongles, USB drives, assorted antennae) Lots of vendors make cable organizers for travel that have spots for cables and USB devices. In mine, I carry video adapters for my laptop, presentation remote, charging cables, wifi and bluetooth antennas, hacktools, and USB drives. It really beats them tangled about in the bottom of the bag.
Properly-Imaged Laptop If you decide to bring a laptop, do not bring one with personal or work data on it. Swap the drive, or reimage. It is very possible you do not need a laptop.
Multi-Tool Don’t leave home without one. (Except through airport security.)
Pelican 1010 With Essential Lockpicks I have bigger Pelican cases with my practice locks and full set of physical intrusion tools that I can pack in my suitcase. On my person, I carry a few favorites to use in Lockpick Village, lobby con, or at vendor challenges. Mine are pretty assorted (see the image above), but Toool sells a good beginner set. Check out Deviant’s blog and Red Team Tools regarding other useful locksport tools (which he can properly name much better than I).
Warcollar DopeScope  For CTFs, challenges, and just finding weird stuff wireless stuff around the con to impress drunk people.
Hak5 Rubber Ducky  Too small not to, and can come in handy in  assorted challenge land. (No, I don’t have a Bash Bunny, yet.)
Small Screwdriver  I almost put this in the “must have” list. You should never travel with electronics without an appropriate screwdriver. Most multitools don’t have a tiny one, either.
Snacks Always a good idea to throw a few granola or protein bars in your bag. Schedules can get packed, and lines at local eateries and coffee shops can get very long.
Sweatshirt Conference rooms get miserably cold.
RTFM The pen testing book you are most likely to loudly scoff at now and sing praises of when Google isn’t available and man isn’t relevant.

I hope you found this list and explanation helpful.

Ask Lesley InfoSec Advice Column: 2017-04-26

Posted on by

I was sent some very challenging scenarios this week, from entry level remote work to anonymity. As always, submit your problems here!

 

Hi Lesley,

I’ll add a little background before my question I’ve always wanted to break into the infosec industry as I love tinkering and figuring out how things work. I managed to get my first IT job on a helpdesk, which has taught me loads, and continues to everyday, however I’m not content with sticking to support. I’ve been very lucky in being accepted onto the Cisco CCNA CyberOps scholarship. My question is, do the course objectives look to be industry relevant?

First exam objectives – https://learningnetwork.cisco.com/community/certifications/ccna-cyber-ops/secfnd/exam-topics
Second exam objectives – https://learningnetwork.cisco.com/community/certifications/ccna-cyber-ops/secops/exam-topics

I’m going to sit the course and try pass it regardless, I’m just interested on how it is viewed by an infosec professional

– A keen n00b 🙂

Hi Keen,

Congratulations on your scholarship. The CCNA SECOPS and SECFND objectives are good, and cover many fundamentals every security professional should be able to describe and define at a minimum. Think of the program as your ten thousand foot view of many different niches and professions in security. Use the opportunity to pick out things that interest you personally, and dig into a couple farther. This might be indicative of the field you want to eventually work towards. Conversely, if you find at that high level you’re weak in any specific areas,  then it’s definitely a sign you need to study up on that subject.

Dear Lesley,

I’m a programmer, last year I quit my job and started to study infosec and systems programming at home, around December I reached the conclusion that I wouldn’t be able to turn this hobby into anything profitable (“pay-the-rent” profitable, not Zuckerberg profitable). I don’t live in the US, UK or any other major country, so these positions just don’t exist locally, information security is a non issue here.

The only way out of this that i could see are bug bounties, but even then, bounties don’t seem like a reliable source of income, surely i could make some good money in some months, but i can’t pay the rent only “in some months”, you know?

So that’s my question, how would you go about making infosec your main source of income if you can’t work for local companies nor relocate?

-Nasher Alagondar

Hi Nasher,

It’s really commendable that you want to get into security despite there not being much of a field, community, or market where you live.

You’re in a tough situation. If you were able to move I would definitely recommend going abroad with an internship or entry level position to get your foot in the door for a while before working remotely. The independent bug bounty market is a tough one, and it’s a mess of very skilled to totally unskilled people trying to make a living. Lots of companies don’t pay out bounties, and some even pursue legal action against people who submit them. If you could build up credibility with a dedicated bounty firm like Bugcrowd, that would probably be the best case scenario, but it’s still a cutthroat industry filled with many people in similar situations to you. If you go this route, you will really need to rise to the top in responsiveness and skill to be successful.

There are some remote low-level blue team cybersecurity jobs, particularly at big managed security providers. Their nationality requirements are going to vary, and it’s very likely they will require you go to their office for a period of time for training. Perhaps some commenters on my blog have specific suggestions of firms. This seems the most ideal option for stable work.

A third option is making it a issue in your area. Cybersecurity is in the news more and more lately, and malware like ransomware really has an visible impact on even very small businesses. I’m not sure where you live, but if there are businesses, hospitals, or schools that use computers, you can probably sell them general IT service consulting with a side of basic security configuration and response. That’s going to take a lot of initiative and entrepreneurship on your part, and requires enough of a market to make a living.

Either way, please reach out digitally and do all the networking you can with other security professionals. It can’t hurt to have friends who can hire!

Dear Lesley,

I’ve been in IT for over 10 years, with a focus on security the last 4. I want to continue in the security field and am really interested on the defensive side of things.

The problem I have is that most certifications, books and resources online seem to be aimed at Red Team folks. I know the best way to defend against attacks is to learn how the attackers work, so I do see the value in learning things like pen-testing etc. My question is what else can I do to strengthen my Blue Team skills and also grow my career?

Thanks!

– I Want to Be Blue Like A Smurf

Hi Smurf,

Yes, red team skills are directly translatable to the blue team, as are general systems administration skills. There are plenty of defensive courses and certifications, but they are not as broad as red team certs like OSCP or CEH.

  • For instance, if you’re interested in reversing, you should be looking at books like Practical Malware Analysis, conferences like REcon, courses like SANS 610 or Applied Reverse Engineering with IDA Pro, and certs like GREM.
  • If you’re interested in forensics, you should be looking at books by Harlan Carvey and Brian Carrier, courses like those from Volatility Labs or SANS 408, 508, 526, and certifications like EnCE, GCFA, GCFE.

And so on and so forth. There are many defensive niches and they each have specific training, tools, and certifications. The broadest defensive certifications are Security+ and CISSP, and those are pretty high level for a reason. With your years of experience, I would suggest specializing a bit.

Dear Lesley,

In today’s world guarding our personal information has become more important than ever and maintaining our privacy has become more difficult and exhausting whether we like it or not. My first question is what do you think we can do to protect our privacy while we looking for a job or socializing with other people …etc… and second do you thing it’s worth creating a pseudo-name (pseudo-identity) and give it to the people we meet inside and outside of our field instead of your real name as a layer of privacy and maybe protection?. Thank you for your time.

– cautious paranoid

Hi Paranoid,

I can’t tell you whether it’s better for you personally to use a real name or a pseudonym online. This requires a series of judgement calls you have to make yourself, and you will have to weigh costs and benefits. I can tell you that I use my real name because the exposure I get is tremendously beneficial to my credibility and ability to speak and train people. This comes at a cost. I have friends who use pseudonyms which can be traced back to them with effort, and others who have decided to be as anonymous as possible so they can discuss subject matter their employers disapprove of. If you use your real name, you should carefully craft your online persona and avoid posting offensive or sensitive personal information. If you use a pseudonym, you must be cognizant that it could be traced back to you tomorrow, or in ten years.

Unfortunately, this is one of those situations where you must weigh convenience and ability to function in society versus personal privacy, and try to maintain a balance between the two that works for your individual situation.

Dear Lesley,

First of all, thank you for this question series and for the Infosec Megamix. It really helps self-doubting me to get back on my feet and continue their path in the infosec world. Now, I recently obtained an infosec certification and it turned out to be an eye-opening experience which played well along my broad-and-shallow approach to learning. But ultimately I want to specialize in some sphere and my interests are (in no particular order) threat intelligence, forensics and research/exploit development. Which are the topics I should get familiar with that are essential to all these spheres? (or maybe 2 out of 3?) I’m currently picking up some low-level knowledge (reversing, OS insides etc.) and there are so much to be learned, so some guidance will be very helpful. Thanks again and keep the good work!

– The Inkmaster

Hi Inkmaster,

Congrats on your hard work and certification. I’m really glad it inspired you.

The three areas you mentioned are pretty functionally disparate. The two you are most likely to see overlap in a role are forensics and threat intel, but that’s not super common.

Threat Intel requires a lot of soft skills, OSINT research, and geopolitical understanding. Forensics requires a lot disk, memory, and operating system knowledge. Exploit research is entirely a different can of reverse engineering worms on the red team side of things. However, I like your question because it brings up a point I rail on a lot – system and network fundamentals are critical for every red team or blue team person.

Off the top of my head, some things that will overlap between those fields:

  • OS architecture, system function, and file systems – Forensics and Exploit Research
  • TCP/IP, ports and protocols, and internet architecture – All Three
  • Scripting with Python – All Three
  • Exploit methodology and the ‘kill chain’ – All Three

Dear Lesley,

I would like to know when performing various things over the internet like hacking/scanning someone’s network and other stuff that can alert the authorities, how can I perform those tasks without them knowing who I really am(like my IP and stuff and most uses proxies but i have a gut feeling it’s not only that) ? I would like to know how professionals cover themselves up over the Internet of course 🙂

-QuesT-Ion

Hi QuesT-Ion,

First, the caveat – I don’t recommend or condone illegal hacking and you should only exploit systems that belong to you or you have clear written permission to test.

No, it’s not only about proxies. Sure, many a hacker has screwed up and forgotten to tunnel one piece of traffic, and many an ISP and VPN provider has been successfully subpoenaed, but IPs alone are not the end-all way to catch a hacker. Not only can attackers use proxies, but they can also use another compromised system as an attack platform, so the whole fields of DFIR and Threat Intelligence are pretty much dedicated to associated detective work.

There are lots of hard and soft indicators that can give away the nationality, location, or even identity of a hacker. Hard indicators include solid evidence like IP, MAC, system fingerprinting, metadata on files that shows a creator or source device, or geolocation data. Many an attacker has screwed up and left an internal hostname, handle, or local SSID behind in commands or code. Soft indicators, when put together, can also paint a great picture of an attacker. They are things like the time zone the attacker worked in, the language their tools and keyboard were set to, the specific malware variants or tools they selected to use, when they took breaks or made errors, and their methodology.

Of course, many an attacker has just been caught by much more embarrassing means, like bragging about their attack without enough caution, or getting caught in a sting operation.

Real life attackers try to eliminate all of those mistakes and soft and hard indicators, but as threat intelligence reports will show, that’s very hard to do completely.

Ask Lesley InfoSec Advice Column: 2017-03-16

Posted on by

This week, I address some burning questions about education and training.  As always, submit your problems here!

Dear Lesley,

Let’s cut to the chase. I hate coding. I don’t enjoy building things from scratch. I do, however, love taking things apart, and would probably be able to learn to code if I started in that direction.

I currently work as a Linux sysadmin in the web industry, with a couple certs (and 4 years) under my belt so far. I love infosec and want to move in that direction, but I have no idea where to start, given my utter distaste for traditional methods to teach coding.
Do I just… download some arbitrary code and take it apart? That seems like a horribly insecure idea, but I’m just not sure where to start. I also tend to have serious issues with confidence in everything, especially tech. Please help! ”    

– Flustered and floundering

Dear Flustered,

I don’t like coding, either. It’s actually not uncommon in infosec – we tend to like rapidly changing environments instead of the routine patience involved in coding. I’ve spoken to many ex-programmers and ex-CS students who agreed.

I see two routes you can go if you think anything like me:

  1. The scripting route: Many, many blue team and red team tools are Python and Ruby based, and many of them are extensible by design. Pick offensive or defensive security, then choose a tool set in one of these common languages that interests you. (For me, it was the Volatility framework). Take apart a few existing scripts and see how they function in real life. Then pick some interesting feature to add in your own script. This won’t necessarily teach you how to write a stellar production application, but for most security roles scripting is what you need.
  2. The reversing route. If analyzing malware piques your interest, that’s a great way to learn how software works all the way down to the assembly level. The intrigue can be a great motivator to learn. Definitely don’t pick commodity malware out today to analyze -it’s purposefully hard to reverse! Start with a book like Practical Malware Analysis or Malware Analyst’s cookbook that has detailed, step by step tutorials from the very basics. Learning how to take something apart can be a great way to learn how to put it together, and you’ll definitely figure out what fundamentals you need to brush up on on the way.

Dear Lesley,

Looking into the future…what would you guess would be the safest career path/area to focus on now in security, considering the growth in available off the shelf tools to get the jobs done. Would penetration tester still be needed for example in 10-20 years time?  

–  Spinner.


Dear Spinner,

First off, no guarantees – I’m not clairvoyant. There definitely is something of an infosec bubble as more people enter degree programs. However, there’s a caveat – being a great hacker is a personality trait, not a skill that can be taught academically. If you’re innovative and adaptable, I sincerely doubt you’ll have trouble finding work in that time frame.

In terms of automation, some tasks automate better than others. Unfortunately, the one that automates the best is the entry level security analyst gig. Merely passing the Security+ and being able to read and route SIEM events may not cut it in a couple years. You’ll need creativity and a broader skill set. More advanced defensive and offensive roles will require human attention for the foreseeable future because attackers innovate constantly. While a magic black box may pick up a new zero day, remediating and understanding the impact and additional factors is more complicated.

Security engineering continues to become more automated. The need for people to simply maintain static blocklists, signatures, or firewall rule sets will continue to decrease. Those jobs are trending towards more advanced SIEM and log aggregation management.

The jobs I see in the most demand with the least supply right now are malware reversing at an assembly level, threat intelligence with an actual political science or foreign studies background, and higher level exploit research (coupled with good business and communication skills).

Dear Lesley,

How does one begin exploring the world of sec without coming off as a script kiddie or just wanting to be an “edgy hacker”?     

– Careful but eager beaver


Dear Careful but Eager,

I’m really sad you feel that you have to ask that question, because merely asking it means you probably aren’t the type you’re concerned about. How do you know if you’re skidding it up? You enter commands into a hacking tool with no idea what they are doing, and much more importantly, no interest in knowing what they are doing. Being a good hacker has nothing to do with pwning stuff. It has to do with understanding how lots of stuff works and being able to manipulate that to your advantage.  (I should put that at the top of my blog in huge red letters!)

Imagine you’re a secret agent, needing to break into a vault. You can take one other person with you. Person 1 is another agent who has read a few books on how the vault works. Person 2 is the engineer who has been installing and maintaining the vaults for 30 years and has agreed to help you. Who do you pick? I’d pick the second person, who knows the system inside and out. I can teach her to sneak around a little and how to wear a disguise. Person 1 doesn’t know the foibles of the vault and only knows how to attack it the way the books said.

To summarize, you skid check is how many commands you enter in Kali or Sift or whatever without bothering to figure out what the heck you are doing. When you’re learning, the goal is understanding that, not getting a shell.

You shouldn’t care what you come off as. If you’re genuinely interested in learning, plenty of hackers will be willing to help you.

Dear Lesley,

(tl;dr at the very last line)

I am a novice who is looking to break into the field of security. Currently, I have received an offer to read a book (The Web Application Hacker’s Handbook) and participate in an assessment to show if I can perform the work necessary to do the job. Essentially, the assessment (from what I’ve gathered) is to assess the security of a vulnerable web application and then reverse a protocol.

Coming from a mathematics background with limited formal education in computer science and no formal education in networking, the book is hard to digest. I have setup pen test labs such as DVWA and WebGoat which I am practicing with and I have made surprisingly good progress in these labs. I’ve also learned a little bit about networking through much trial in error in setting these labs up in safe environments!

However, I fear that even if I pass the assessment, I will not be offered a position due to my lack of networking knowledge. I am aware of certifications such as OSCP and Security+ to bolster my background, but they suggest a solid understanding of networking before enrollment in the courses or studying for the examinations.

Do you have any recommendations on books/courses/certifications that would take an individual from zero-knowledge of networking to the suggested level of networking knowledge for these kinds of security certifications?

– Not a smart man


Dear Smart Man (I refuse, because it’s untrue!),

It really sounds like you’re doing everything right. You have correctly recognized that solid TCP/IP knowledge is really important in security. The lab is fab. But, you can do other things in that lab. Like take a step back from the security tools, and concentrate on the networking ones. How long have you spent in Wireshark, just observing and filtering through network traffic? Something just watching what’s going on and identifying common ports and protocols can be huge. What does opening a website look like, and why? What does a ping look like? What does it look like when a new computer is connected to the network?

Certs (and associated books)… There are a lot of options in network land. Network+ is okay for fundamentals and really cheap (although an inch deep and mile wide). WCNA is the Wireshark specific cert, but by nature teaches a pretty in-depth level of knowledge of reading packets. It’s also quite affordable. If you have 600 bucks and free time, I’d do both (in that order) and blow those folks out of the water with your resume. If you don’t have those resources, they give you some great study materials to start with.

There are endless good books and blogs on TCP/IP out there that will get you started and give you an understanding of the OSI model and common ports and protocols. Hands on experience in your lab or on your home network  is much more important.

 

 

 

Phishing Exercises, without the “Ish”

Posted on by

Much like open offices and outsourcing in business, information security is subject to trends. One you probably saw in your vendor spam folder over the past couple of years is phishing awareness exercises.

The premise sounds simple – phish your employees before the bad guys do, monitor how they respond, and react accordingly.  In reality, people’s experiences have been more complex. There’s not much middle ground in the discussion of phishing exercises. I see either glowing articles praising their merits (most of which are selling something), or bemused cynicism about them from security professionals. In my experience, there really can be benefits to running phishing test exercises in a sensible way, but many organizations are not implementing them in a sensible way, so they end up pretty worthless.

When you’re setting up a phishing test program, you have the option of developing your own phishing exercise infrastructure and metrics collection toolkit, combining open source solutions like King Phisher or (SET), or purchasing one of many available commercial solutions. I won’t advocate for one brand over another in this blog – most will work (in the right configuration and conditions). A similar set of concerns exist, whether you develop a deployment and metrics solution, or you buy a commercial solution in a box. Let’s discuss how any and all of these tools are being used incorrectly.

 

Before spending money, or implementing anything

Develop a clear goal for your program with your senior leadership fully involved. This goal should not be, “stop employees from clicking on phishing messages”. That’s simply unattainable. Yeah, you want that number to decrease, but even top security professionals have fallen for well-crafted phishing messages. People click on things when they’re busy and distracted, and it theoretically only takes one compromised host to breach a network. A real attacker only has to get that one, inattentive click. If your senior management measures your success by phishing clicks reaching zero, you’ll ultimately find yourself dumbing down campaigns to look more successful. This won’t do anybody any favors.

A more realistic goal is improving the quantity and speed of reporting of suspicious emails. Detecting phishing with tech is hard. Most organizations spend a great deal of money on modern solutions to catch and alert on phishing messages, and even those can be circumvented. Your last line of defense against phishing and social engineering is a good relationship with end users who will promptly tell you they are being attacked. While it takes only one phish to compromise a network, it takes only one prompt report to security to shut an attack down.

Next, you should bring your HR and Legal teams into the conversation and discuss anonymity. There is no room for gray area here. You will either conduct phishing exercises anonymously or you will not. If you conduct the phishing exercises anonymously, you must develop the program in a double blind way where even network security can’t practically retrieve the names of people who clicked. You’ll still see an overall view of the health of your organization, but nobody can be pressured to provide identifying data, even by angry executives.

If you choose to not conduct exercises anonymously, I recommend that you clearly document any repercussions for clicking, and ensure they are uniform across your organization. Otherwise, your exercises could easily become a public humiliation game or end in unequal punishment by managers, putting you in hot water with HR.

 

A carrot, instead of a stick

Regardless of if you conduct your exercises anonymously or not, you may decide to provide extra security training to people who click on your test phishes. Frankly, a lot of security awareness training is pretty awful, “death by PowerPoint” stuff. If your users can fly through every slide and kludge their way through your multiple choice test, chances are it’s a waste of time. Try to have some empathy for how an end user is feeling when they click on a test phish and are routed to a long, mandatory training. They’re embarrassed, frustrated, and it’s very possible they clicked because they were already frantically busy. In their minds, you aren’t helping – they feel like you tricked them. There’s now hostility in your relationship, not a willingness to help “the team” stop attackers.

If possible, in-person training is a great option (snack bribery highly encouraged). Offer a lunch and learn, or a social hour with IT security. Offer this in lieu of traditional web-based training, and have a conversation with your end users. People are statistically more inclined to help somebody they have met in person and feel some connection to. You want to try to make your phishing exercises a positive thing that people want to improve, not a negative thing that people subconsciously associate with punishment or embarrassment.

If training has to be computer-based, try to make it quick, effective, and interactive. This is a space where you may wish to spend some money to get something good quality and enjoyable.

Be clear about what you’re trying to accomplish with phishing exercises and why they are important to your organization. Ensure you give credit to people who report phishing and help your team improve more than you punish people who make genuine mistakes. It’s better to provide measures to protect victims and help them learn, rather than encourage them to circumvent your security team.

 

Who should you phish?

Establish the scope of your exercises. Must certain employees be exempt for legal reasons? Are multiple languages spoken in your organization which will require separate exercises? Will your exercises be conducted across global business hours and all shifts? Have you done some OSINT to generate a list of exposed users and email addresses that require special attention?

I highly advise against phishing everybody at once. The only things that travel faster than light in workplaces are rumors. Once one person realizes he or she has fallen for the phishing exercise, it’s nearly impossible to contain the “helpful warnings” to neighbors and friends. This is good, but won’t necessarily give you accurate metrics about individual performance.

 

Designing your phish

Security teams everywhere look forward to this part with glee. I must remind my blue team friends of a lesson that successful red teamers learn early in their careers: your job is not to “get” your target for the laughs. Your job is to educate your target and improve their security. You are on their team. Yes, you can phish nearly anybody with a well crafted message and insider knowledge. Conversely, you can produce excellent metrics by selecting an absurdly easy phish. Neither results in any significant security training.

Your phishing exercises are a scientific experiment, and a good experiment has as few variables as possible. The variables that do exist must be well quantified, and should include the difficulty of the phishing message, which is easier said than measured. Comparing clicks on an excellent phish with perfect grammar and a timely topic to one that applies to few employees and is written in poor English is apples to oranges. If you want to change the variable of phishing difficulty, do not change the variable of employee selection or time of day, and vice-versa.

If you’re having trouble with this, look to your phishing awareness training. Most commercial training programs list warning signs of a phish. When developing your messages, choose a specific number of these specific warning signs to include.

 

Avoiding phishing-related divorces, and other unpleasantness

Writing a phishing email seems fun and easy. You copy one you’ve seen in your filters, or use a common phishing theme, and send it out with a link or attachment, right?

Or not.

Bad guys have it a lot easier than us, as defenders and pen testers. Bad guys can emulate any public company or person they want in their phishing messages, and abuse any emotion. While we want to make test phishes as realistic as possible, there are good reasons why we have to put more thought into ours.

The reaction of a human being to a phishing email depends on a lot more factors than just their corporate security training. They’re also influenced by their outside security education, their biases and experiences with the content of the message, and their emotions. Imagine a phishing test email that uses the classic “payment received” scam, ostensibly from some real online payment firm. Some people will look at the phish, see it for what it is, and report it appropriately. Others will Google the payment provider and report the phish to them instead; a black eye (or even a blacklist) for your company. In a worst case scenario, an employee could receive the message and apply a personal context, forwarding it to their spouse as ‘proof’ they’re hiding money.

You must try to keep your phishing exercise contained. Remember, you are handling live lies. Not only could forwarding of your test message alter your metrics, but it could also result in more dire legal or ethical consequences if it should leave your network perimeter. Ensure you thoroughly prevent this, and clean up after your exercise as soon as possible once you’re done.