Starting an InfoSec Career – The Megamix – Chapter 6

[You can find the previous chapters in this continuing blog series here:
Starting an InfoSec Career – The Megamix – Chapters 1-3
Starting an InfoSec Career – The Megamix – Chapters 4-5]

Chapter 6: Self-Study Options

In the previous chapters, I’ve discussed potential career paths, education and certification options, and the fundamental knowledge needed to become a successful InfoSec professional. Unfortunately, college degrees and certification courses aren’t financially or logistically an option for everyone, nor do they provide all of the skills and practical experience needed to become a desirable candidate for an entry level position. Without further ado, let’s delve into some options for improving InfoSec knowledge individually.

==== Home Labs ====

Building a home practice lab is an integral part of improving skill at any area of blue team or red team information security. Since most of us (hopefully) don’t want to break the law and get arrested while learning how to hack, conduct forensic investigations, or reverse engineer systems, we’re obliged to create our own self-contained network environments to practice and learn within. This will also improve network and systems administration skills, which as I noted in Chapter 1 are absolutely fundamental for being a well-rounded InfoSec professional.

A decade ago, a home lab looked significantly different. It almost certainly included multiple computers, and likely a network rack complete with switches, power supplies, KVM, and cabling. While this is still a great option, a rack of computer equipment is noisy, hot, and power consuming. Today, we have the tremendous luxury of virtualization. A single reasonably spec’ed ESXi host server can act as most of our practice environment. While we might still opt for some physical network hardware, we have virtualized network lab environments available for use, as well. I really prefer the virtualized option because as we exploit, infect, and otherwise destroy our hosts, we can simply revert them to an earlier snapshot and start over.

Regarding purchasing the physical equipment or host machine(s), we can get as creative as our budget requires. A great way to purchase server grade computer hardware is via federal and state government auctions. These auctions are fairly underutilized next to commercial sites like eBay, and can offer some great deals during regular equipment replacement schedules. Remember that local businesses, hospitals, and municipal services often replace their hardware and sell the older equipment for a fraction of the original price. For virtualization, we’ll want a decent server grade processor, a lot of memory, and enough disk space for all the operating systems we are interested in using to grow as expected. Everything else is fairly negotiable. Many folks buy a few old servers of the same model, pull all of the memory, NICs, and hard drives out, and put them into one chassis.

The hosts we install in our lab environment shall vary quite a bit based upon our area of interest and what we’re currently trying to accomplish. For instance, in my forensics lab, I selected SIFT and Windows 8 hosts which I use to conduct analysis, and an array of primarily client OSes which I conduct analysis upon. My network monitoring and incident response environment is very different, because network services, network IPS, and firewalls are in play in a more realistic network environment. A penetration testing environment will look different still. Before you purchase equipment or begin the lengthy process of building your lab, consider what you want to learn, and what hosts and services you will need to accomplish this goal.

I’m not going to delve much further into the technical details of building out a lab, as a lot of people have done great writing on this subject already. I recommend looking at Carlos Perez, Matt Barrett, and Adrian Crenshaw’s informative blogs.

==== Self-Study Materials ====

Every person has a different learning style. Some of us are more comfortable learning new skills by watching a video; others need hands on practice or reading materials to understand new concepts best. Fortunately, at this point people who wish to learn InfoSec skills have a plethora of freely available options to fit any learning styles.

For the Visual Learner:

Years of talks at information security conferences have been recorded and are freely available on YouTube. I’d avoid watching Joe from ACME computer shop explaining how to use Kali, but there are more hours of recorded talks on from reputable conferences than anyone will ever have time to watch. Archive.org hosts an immense number of conference talks. Adrian Crenshaw has recorded talks at conferences for years, and has a prolific archive of these videos on his channel. SecurityTube is also a great resource, (although some of their materials are paywalled by PenTester Academy, which may or may not be in your budget).

For the Auditory Learner:

Check out the amazing range of InfoSec podcasts available for free. There are so many more great podcasts than I could discuss in a blog of their own, but some highlights are PaulDotCom, Southern Fried Security Podcast, Security Now, ISC Stormcast, Defensive Security, Liquidmatrix, and Braeking Down.

For the Reading Learner:

There are two major resources you should investigate – textbooks, and blogs. This will, of course, vary quite a bit based your area of interest. My personal ‘essential reading list’ for Information Security professionals would include the following:

There are an immense number of amazing security blogs out there, but a very short list of my favorites includes Dark Reading,  Krebs on Security,  McGrew Security, Graham Cluley, Naked Security, Lenny Zeltser, Troy HuntAndrew Hay,  Threatpost,  and Andy Ellis.

For the Kinesthetic Learner:

As we previously discussed, a home lab is a great option, followed by Capture the Flag exercises and Challenges, which I discuss in the next section.

==== Capture the Flag and Challenges ====

Once you feel ready to leave the safety of your own home lab and delve into another network, a great option is Capture the Flag events, and similar challenges. A large percentage of hacking conferences provide some kind of CTF event, which will pit your skills against challenges they’ve designed as well as other participants, in a structured, legal environment. The challenges usually vary from simple to extremely difficult, and points are awarded to participants as they find or reach ‘flags’ hidden in the challenges. Don’t be daunted; most CTF events are rarely restricted by skill level, and they’re a great way to test what you’ve learned. You’re competing against yourself as much as other teams or participants.

CTFs and challenges are not restricted to red team penetration testers. There are plenty of open and paid practice challenges in many areas available now, both in person and online. DFIR challenges test investigation and forensics skills, while malware challenges test participants’ ability to reverse and analyze malicious code. Check out the great list of online challenges at captf.com.

==== Conferences ====

There are no substitutes for in-person networking or training events. I strongly recommend attending InfoSec / hacking conferences, but I also encourage you to choose the right ones for you. Regrettably, the events with the biggest budgets often get the most hype. That does not translate to them being the best environments to learn in. Cost is often a factor that bears consideration, as well. Tickets to InfoSec conferences range from free (or nearly free) to thousands of dollars. Hotel and airfare costs vary by venue. All these factors should weigh into your decisions, but there’s a conference for everybody.

Hacking conference size and content vary a lot, but there are some commonalities. There are normally one or more tracks of speaker talks, selected by the organizers from outside call-for-paper submissions. Capture the Flag type events are fairly ubiquitous. It’s also not uncommon to see an option for longer, hands-on training classes for an additional fee. You’re likely to see some vendors, as well as hobbyist groups such as locksport organizations or makerspaces sharing their expertise. Evening parties sponsored by the conferences or vendors can provide an opportunity to network and have fun.

Let’s discuss a few popular conferences. A couple caveats. Firstly, I’m quite certain I am going to offend one conference or another by not listing them here – for this list I selected some better known representative examples and it is by no means comprehensive. Secondly, I’m based in the US, so my examples are primarily in North America. Hacking/InfoSec conferences are a global phenomenon, and the types of conferences I list have equivalents in Asia, Europe, Africa, and South America. Please feel free to ask me for assistance in finding ones in other locations as needed.

DEF CON – Las Vegas, NV, USA

One of the oldest, most famous, and largest hacking conventions in the world, DEF CON is held in August on the Las Vegas strip. The attendees are a mix of everybody from the most dubious black hats to corporate security professionals, from journalists to Generals, from researchers to federal agents. Events and talks run the full gambit in every sense of the word. The parties are wild and so are the attendees. DEF CON tickets current cost $230, (cash only!).

>> Pros: This is where you’ll see some of the most cutting edge research released, and meet many top notch pros. Everybody should DEF CON at least once, for the sheer experience.

>> Cons: Over-the-top parties, crowds, and hangovers can overwhelm actual learning and networking. If this is your first hacking conference, or you’re not reasonably cautious, you may be targeted for pranks (or worse).

BLACK HAT– Las Vegas, NV, USA

Black Hat (USA) occurs the week prior to DEF CON, and offers more structured training opportunities on a variety of topics. There’s a heavy vendor presence. Black Hat is more targeted towards security professionals and executives, and offers organized networking events and a bevy of courses and high profile speakers. The talks are well vetted. This doesn’t come cheap; regular tickets are currently $2195. Training courses cost significantly more. If money is a factor, I certainly wouldn’t recommend paying your own way to Black Hat unless there is a course you desperately want to take that isn’t offered anywhere else. Wait for a scholarship or corporate sponsor.

DERBYCON – Louisville, KY, USA

DerbyCon is a relatively new but very popular conference, and acts a bit like a more community and family-friendly alternative to DEF CON. It occurs in September in the heart of downtown Louisville. While it’s not as big of a conference, DerbyCon offers five simultaneous talk tracks, as well as hosting a few special interest working groups and CTF. DerbyCon tickets are $175, and given the reasonable cost of living in Lousiville, this can be a pretty economical conference, without quite as much of the shock value. Although there are bad apples at any hacking conference and basic precautions should always be taken by attendees, DerbyCon is policed pretty well and is a very safe bet for a first con.

SHMOOCON – Washington DC, USA

Shmoocon was founded by a husband and wife team to become a relatively small, friendly, community and education focused conference. It occurs in January, and costs $150, making it the most affordable of the ‘big name con’ admissions. Due to its location and educational reputation, it’s popular with federal government, military, and federal contractors, and the networking, vendors, and talks can reflect this a bit. The downside is that Shmoocon has grown much more popular than its size allows, and tickets sell out quickly – very quickly – a matter of seconds, making attendance a bit of a lottery. If you plan to attend Shmoocon, (I do recommend it), read up on the ticket purchase process well ahead of time.

RSA CONFERENCE – San Francisco, CA, USA

If you missed that RSA occurs in February, you’re not tuned into information security news. I can draw a lot of parallels between RSA Conf and BlackHat, but personally favor Black Hat as an event. They’re both targeted at executives and professionals, throw star-studded vendor parties, come with a hefty price tag (standard RSA tickets are currently $2,295), and get plenty of press. They have the biggest vendor expos, and often boast high profile speakers. I don’t recommend RSA to entry level infosec folks, even if the price tag is in your budget. For the money, I’d attend a course at Black Hat or REcon. The glitz and glamour do not make this the best environment to learn fundamentals or network, and despite some very good speakers, in my opinion RSA Conf continually commits public security faux pas to the ire of hackers and security professionals.

RECON – Montreal, QB, Canada

If reverse engineering malware, hardware, or software is your cup of tea, there’s no better conference to learn more than REcon, which focuses exclusively on sophisticated reversing. Ticket prices for RECon increase through the year leading up to the event, currently starting at 700 CAD and culminating in 1200 CAD in June. Student tickets are discounted. The ticket price is hefty, but includes snacks and lunches. The available hands-on training courses will run you around 2000 – 5000 CAD, so once again, you may want to wait until you’re eligible for some sort of sponsorship for this one. I have not had the pleasure of attending this conference myself, but I’ve heard nothing but glowing reviews from my colleagues in this space.

CIRCLE CITY CON – Indianapolis, IN, USA

Circle City Con is newer than Shmoocon and DerbyCon, but fills the same educational / community friendly conference niche. Circle City Con occurs in June, near the Indianapolis Convention Center. Tickets are currently $150 and include optional training classes, aside from any required materials. Circle City Con is another safe bet for a first conference, and for family participation.

HOPE – NYC, NY, USA

Hackers On Planet Earth is still a bit of a ‘hidden gem’. Although it’s one of the oldest annual hacking cons, it remains reasonably small and attended by industry greats. HOPE occurs in July, and tickets are currently $150. HOPE offers some of the most unique and varied events of any conference outside DEF CON, and boasts film festivals, art, and robotics along with the usual offerings. It’s a bit more eclectic and nuanced than other conferences. HOPE is worth serious consideration, especially for East Coast folks.

GRRCON – Grand Rapids, MI, USA

GrrCON specifically states their goal of avoiding elitism, and as a result they’ve earned a reputation as a positive and friendly environment which is heavily geared towards great networking and security education. GrrCON occurs in October and regular tickets are currently $150. Another location with very reasonable room and board, it would be a great choice for a first con. GrrCON also offers opportunities for family participation.

BSIDES EVENTS (Global)

Perhaps you looked at this long list of conferences, and balked at the locations, travel costs, and ticket prices. All is not lost. Seek out your local BSides event, which occur in many metropolitan areas. BSides events tend to be organized by local hacker groups, and most are one or occasionally two days. BSides also tend to be smaller and less expensive, with tickets usually ranging from $0-50. There’s rarely a good excuse to miss your local BSides – it’s a great opportunity to network with security folks in your area for a nominal fee. BSides events also make a great excuse to travel to cities on your bucket list across the world, learn about hacking, network with people, while enjoying the local culture, sights, and cuisine.

I’d be remiss if I did not briefly discuss hacking conference safety and preparedness. As I’ve mentioned above, the level of ‘threat’ at conferences varies and exists everywhere, but regardless of the event you should take common sense precautions. (All of these precautions should translate into everyday life, because bad gals and bad guys are everywhere!)

  • Consider whether it is necessary for you to even bring a laptop to the conference if you’re not attending a course that requires one. Given insecure networks full of hackers, safely using a laptop adds an extra layer of preparation required and gives you another bulky, expensive item to carry and keep track of.
  • If you must bring a laptop, I highly recommend using a new hard drive with a clean OS image, full disk encryption, and as little personal data as possible that you only use for the conference(s). Ensure you have a standard array of vetted security tools if you plan to connect to any network, including VPN. Ensure wireless and Bluetooth are fully disabled when not in use. Use common sense about what you log into.
  •  It’s hard to function today without a smartphone, but consider ways to make your phone more secure. Burner phones or faraday bags are popular options. At the very least, ensure wireless and Bluetooth are off, and that the phone itself is encrypted. VPN if possible. Do not connect to WIFI. Do not borrow phone chargers.
  • Bring cash for as many purchases as possible. Bring as few credit/debit cards as absolutely necessary, and ensure they’re in a vetted RFID safe wallet (but certainly don’t expect those to be foolproof). Don’t bring unnecessary stuff in your wallet or purse such as your work ID, social security card, or passport. Do not use an ATM within an easy walk of the event. I have rarely been to a conference where the hotel ATM wasn’t obviously and amusingly hacked by the end of the first day.
  • Don’t leave valuables unattended at the bar or in your hotel room, in a hotel full of hackers who can trivially open (any) hotel doors. Double lock your room when you’re inside.
  • Know who you can contact and how to reach them if there’s a security or medical issue at the conference – most hacking cons have a staff of security ‘goons’ who are always present and reachable. Any large event can have its share of bad apples, rowdiness, alcohol overuse, and drugs, and they’re there to keep things from getting out of hand. That being said, hacking conferences should not be treated like Mos Eisley cantina. Look out for the safety and well being of your friends and the people around you, and get them help if needed.

==== Local Hacking Meet-ups ====

Aside from organized conferences, many metropolitan and regional areas have formed hacking meet-ups of varying structure and activeness. I recommend finding your local group as soon as possible and participating as much as you can, as it’s a really important way to network with local hiring managers and security teams. Name recognition in this community is absolutely invaluable when applying for jobs.

There were ways that hackers met two decades ago that still work, but they’ve been  impacted by Web 2.0 and social media as much as anything else. So, I’ll both discuss the more traditional ways to find your local hacker and InfoSec folk, as well as newer options.

The Old Ways

  • DEF CON local groups: They’re named by area code, globally. Unfortunately, in my experience, some are now defunct or inactive. (Check and make sure before showing up.)
  •  2600 : 2600 meetings occur in public spaces to be inclusive to everybody, but be cognizant that they are more ‘hacker’ meetings than ‘information security’ meetings. Their active group list is maintained pretty well.
  • CitySec meetups: A more ‘security professional’ focused set of informal meetings in many global metropolitan areas.

The New Ways

  • Meetup.com: I’ve seen quite a few various information security organizations start posting their meetings through this site over the last few years. It’s always worth a look.
  • ISSA: A formal professional organization with chapters around the world.
  • Twitter – Plenty of these organizations post their scheduled events.
  • LinkedIn – Plenty of these organizations are listed as LinkedIn Groups.

 

 

Community

One of my friends commented today as the infosec community broke into another quabble that,

Okay. Let’s step back for a moment. Disagree or agree with me, but kindly let me present an argument.

Have you ever read the ‘Conscience of a Hacker’? The Mentor wrote it – it was published in 1986. Regardless of what you think of the author, it brilliantly exposited for years to come what being a hacker meant to more than one generation. It meant a lot to me, personally. Maybe it will mean something to you.

  "I am a hacker, enter my world...
        Mine is a world that begins with school... I'm smarter than most of
the other kids, this crap they teach us bores me...
        Damn underachiever. They're all alike."

I’ll link it here without further commentary. It remains profoundly influential and relevant. I’m not going to post it here, but you should probably read it: http://phrack.org/issues/7/3.html

That feeling of being on the edge of something incredibly new and open may have faded. If it has, I’m truly sorry, because we’re still living on the edge of the new. That’s the big secret. There’s always something new that begs to be taken apart.

Most of us aren’t in school anymore. We work for corporations and organizations. Some of us work for the feds. And that’s okay.

When we’re paying our taxes or putting our kids to bed, that feeling that we don’t quite fit in might just still nag at us. Sometimes, people still look suspiciously at us and nervously crack jokes when we try our damnedest to explain what we do for a living. I’ll tell you from experience, it doesn’t matter how amicably you present yourself – “I’m a hacker” doesn’t go over particularly well at reunions. Some of us are very good at fitting in, and some of us find it a lot more difficult. That’s okay, too.

Many of us have money now, and freedom. We’re still too smart, and the combination of those things multiplies into a thousand eclectic hobbies and impossible achievements. We’re hackers, but we’re also home-brewers and martial artists and authors and skydivers and tinkerers and tattoo artists (and smartasses). We aged well.

This was supposed to the age of the electron and the switch, and even the criminals ended up on 8AM conference calls. Tough. We still have so many advantages and opportunities that others don’t. We still see the world through that very special lens that is unique to us – figuring out how to take things apart and put them back together into something changed just enough. We have a community of some of the greatest minds in the world, but sometimes our personalities get beyond us and then we’re back to being that frustrated kid in the back of the classroom trying to shout at the world. (“Listen to me! This is wrong! Let me show you why!”)

Sometimes we still find ourselves at odds with society, but we are many now. We have a voice across channels and social media. We have conferences and meet-ups that span every continent. Perhaps perversely, people go to school to try to learn to do what we do. Some of them succeed, while others fail. It’s all still amazing, because every so often, a new hacker realizes he or she has found a home. These are my people, and they are like me. I’ve seen the pride that a large portion of our community takes in that.

Conversely, our private little world has been infringed upon by every aspect of ethical and unethical human society. Today, hackers are often the ones who wage war, murder, cheat, and lie. Sometimes we lose friends to drugs, and alcohol, and illness. We have to come to terms with that, and take some responsibility in dealing with it.

Caught in the middle of all of these conflicting things, don’t ever lose sight of what it means to be a hacker. We are part of something truly damn amazing and we’re still outsmarting the world, 30 years later.

"I know everyone here... even if I've never met them, never talked to
them, may never hear from them again... I know you all..."

This is still a place where we belong. As unique as we are, we’re still alike.

[Love you all.]

 

 

Gen Con 2015 – A Big “Thank You!” from Us to You!

Wow! I can’t believe Gen Con is already over. We had an amazing time at the con and giving our Hacking in Fiction panel for 43 lovely people on Thursday night. I want to extend a big thanks to my co-speakers, Johnny and Beltface. We ended up going over our allotted 90 minutes again – mostly because we had so much fun answering fantastic audience questions. Also, thanks to our many Twitter friends who came out to roast us, like Joe, 0DDJ0BB, Lslybot, and Justin!

1507786_10101499320032651_8905633191381467502_n

11026186_10101499319658401_5972790770425278560_n

Just some awesome costumes I snapped pictures of!

11822515_10101499320292131_8557055176193733910_n11825926_10101499320317081_430971884735938165_n


Our most frequently asked question that I want to restate here for the world was, “I don’t have much experience; how do I get into infosec/hacking?”

If you’re asking us that question, you’re on the right track. I firmly believe have the best community out there in a professional field. There are tremendous resources for anyone out there who has the will and motivation to be good at infosec. They usually don’t come with any dependency on expensive degree programs or certifications. My recommendations are:

  • Go to independent security conferences, Def Con, DerbyCon, Shmoocon, GrrCon, and various local BSides are great options to learn about security and network with other people who share your interests. You can get into most of these conferences for 100-200 dollars and a hotel room. There is no experience requirement, and there are usually talks at technical levels from management skills to sophisticated reverse engineering. Yes, these conferences can be intimidating, but follow basic best practices like not using a credit/ATM card, turning off WIFI on your phone, and not bringing a production computer, and you’ll find them an intriguing and welcoming environment with lots of fun!
  • Use your internet resources. Blogs, Twitter, and Podcasts are a great way to learn more about current events in InfoSec. Don’t rely on bulletins from vendors or government agencies. Some of my favorite general security news sources are:

    Paul’s Security Weekly

    Naked Security – Sophos

    Krebs on Security

    Dark Reading | Security

    Steve Ragan | CSO Online

    We Live Security

  • Find your local hacker meetups and attend. As well as 2600, DC(area code) groups, and BSides, many metro areas have independent security meetups. These are a great way to network and find a mentor.
  • Do publicly shared CTF exercises to learn more about hacking. Beyond “Hack this Site“, many agencies post online ‘Capture the Flag’ exercises in blue team and red team areas of security that allow you to take your best shot at a hacking simulation and then see the results when it ends. I recommend all of the SANS exercise, especially their holiday challenges.
  • Build your own lab, and experiment! It’s really not that expensive to build a hacking lab at home. Virtualization has made it relatively affordable to construct a VM lab environment with an attacker and defender machine(s) in which you can simulate the area of security of your choice. It looks fantastic in interviews if you can describe your home lab an d
  • Don’t get intimidated! While I highly recommend you always be certain you have permission to hack the computer network(s) you are experimenting with, there are plenty of legal and affordable ways to learn more about information security. Everyone who legitimately claims to work in ‘infosec’ or ‘cyber’ should have a solid understanding of how bad guys think. Avail yourself of available resources, and test your skills!

What is ‘DFIR’? And how do ‘Digital Forensics’ roles vary?

I had a discussion today with a particular charming infosec pop star about what differentiates ‘DFIR‘ from other infosec job roles and how it relates to them. This is a question I get asked a lot by ladies and gents interested in making a jump into information security careers, so let’s have a brief discussion on what these forensicator jobs tend to do in your average working environment.

Now, you may be generally familiar with digital forensics – the exciting science of taking all manner of digital ^stuff^, and finding out what it’s done, when it was done, and who did it. Seen weekly on your average episode of CSI or NCIS… it is nothing like CSI or NCIS.

It’s usually not too much like what’s taught in ye olde average Forensics degree program. Not judging.

So first, what is this ‘digital stuff’ that we can do forensics on? Well, the obvious use case is a hard drive. Take it out of a computer. and find out everything that’s happened on that computer. When was the computer turned on, and who logged in? What programs did they start, and what did they do in those programs? Did they do any internet browsing? In the 1990’s and early 2000’s, proving those things in court were a large portion of the field. Modern digital forensics goes way beyond that. We’re not just concerned with PC hard drives. We’re concerned with anything that runs on 1’s and 0’s, from cars, to hospital equipment, to USB drives, to cameras. That’s the ‘internet of things’, friends. It can all contain digital evidence. A car GPS can tell us where it’s navigated to for weeks. A camera can tell us where every photo was taken. A hospital lab machine can tell us which USB drive connected contained malware, and from where.

“But Lesley, who wants that evidence? Abby from NCIS, and her beautiful beautiful pigtails, no?” Yes, and no. As appreciative as I am of Ms. Sciuto’s fashion sense, law enforcement is only one small measure of modern forensics professions. We can generally break down forensics on all these devices into two fields – e-discovery, and Digital Forensics and Incident Response (DFIR). E-Discovery is the legal side of forensics – in a broad sense the person being investigated is the case, and digital forensics tools and procedures are being used to support a case involving them. DFIR is more the infosec side of forensics- the digital system is the case, meaning instead of our main objective being investigating a external case, the digital device is being investigated. Examples of this are all types of security incidents, from data breaches to malware. Some forensics professionals do both types of cases, and others just do one or the other.

E-Discovery professionals tend to interface the most with legal and law enforcement agencies. Many e-discovery professionals have a legal background, but that is certainly not all inclusive. These are the guys and girls who are reading the emails you deleted. DFIR professionals tend to work as part of the blue team, working as parts of SOCs or CSIRTs or with malware analysts. They often have security operations center backgrounds – again, not all inclusive by any means.

Both of these jobs involve similar tools. Both types of investigators need tools to sift through deleted files on hard drives, browser caches, memory, and Windows registries (for similar and different reasons). The commercial products used by both overlap, although memory forensics is still often a DFIR specific field, and preserving a court admissible chain of custody oft remains the realm of e-discovery.. We see a lot of Guidance, FTK, and Oxygen tools heavy in the market. Obviously, both require quite specialized tools as well. Malware hides differently than human beings do.

“So, Lesley, what is the biggest myth about digital forensics?” Well, first of all, it is not Abby’s pigtails, because I rock fishnet. I would have to say that the biggest exaggeration is steganography. Its become a running gag that every time I find a person who wants to study or is studying forensics, their first case study will be some sort of steganography. If you don’t know what that is, you should read an article or two, as it is quite intellectually interesting. Unfortunately, it is a rare case that actually involves the hiding of data in this manner. The truth is, networks tend to be so insecure that such drastic methods are not usually necessary outside of certain uncouth communities. I spend a great deal more time recovering wholly undeleted data from memory and slack space on hard drives. I do wish that forensics degree programs spent a lot more time on memory forensics with products such as Volatility and Mandiant Redline, as it is frequently critical.

The second biggest myth is that ‘porn mode’ has any impact at all on me being able to see what you’ve browsed in the last several weeks. It rarely does. Not judging, again.

So there we have it. Foreniscs, and it’s variations in a nutshell. If you would like to know more, please feel free to tweet or message me. I am as always, happy to respond.

Lesley’s Rules of SOC

I see a lot of the same errors made repeatedly as organizations stand up Security Operations. They not only result in lost time and money, but often result in breaches and malware outbreaks. I tweeted these out of frustration quite some time ago and I’ve since been repeatedly asked for a blog post condensing and elaborating on them. So, without further ado, here are Lesley’s Rules of SOC, in their unabridged form. Enjoy!


  1. You can’t secure anything if you don’t know what you’re securing. 

    Step one in designing and planning a SOC should be identifying high value targets in your organization, and who wants to steal or deface them. This basic risk and threat analysis shows you where to place sensors, what hours you should be staffed in what regions, what types of skill and talent you need on your team, and what your Incident Response plan might need to include,

  2. If you’re securing and monitoring one area really well and ignoring another, you’re really not securing anything. 

    An unfortunate flaw in we as an infosec community is that we often get distracted by the newest, coolest exploit. The vast majority of breaches and compromises don’t involve a cool exploit at all. They involve unpatched systems, untrained employees, and weak credentials. Unfortunately, I often see organizations spending immense time on their crown jewel systems like their domain controllers, and very little paid to their workstations or test systems. All an attacker needs to be in a network is a single vulnerable system from which he or she can move laterally to other devices (see the Target breach). I also see people following the letter of the law in PCI compliance, ignoring all the software and human practices beyond this insufficient box.

  3. You can buy the shiniest magic box, but if its not monitored, updated, and maintained with your input, you’re not doing security. 

    Security is a huge growth market, and vendors get better and better at selling solutions to executives with every newsworthy data breach. A lot of ‘cybersecurity’ solutions are now being sold as a product in a box – ‘install our appliances on your network and become secure’, This is simply not the case. Vendor solutions vary vastly in quality and upkeep. All of this is moot if the devices are placed in illogical places in the network, so that the devices can’t see inbound or outbound internet traffic, or host to host traffic. Even with a sales engineer providing product initial setup, a plan must be developed for the devices to be patched and updated. Who will troubleshoot the devices if they fail? And finally, their output must be monitored by somebody who understands the output. I’m constantly appalled by the poor documentations big vendors provide for the signatures produced by their product. Blocking alone is not adequate. Who is attacking and what is the attack?

  4. If your executives aren’t at the head of your InfoSec initiatives, they’re probably clicking on phishing emails. 

    I think this is pretty self explanatory. Security is not an initiative that can be ‘tacked on’ at a low level in an organization. To get the support and response needed to respond to incidents and prevent compromise, the SOC team must have a fast line to their organization’s executives in an emergency. 

  5. Defense in Depth, mother##%er. Your firewall isn’t stopping phishing, zero days, or port 443. 

    I constantly hear organizations (and students, and engineers) bragging about their firewall configs. This is tone deaf and obsolete thinking. Firewalls, even next generation firewalls that operate at layer 7, can only do so much. As I’ve said previously, exploits from outside to inside networks are not the #1 way that major breaches are occurring. All it takes is one employee clicking yes to security prompts on a phishing message or compromised website to have malware resident on a host inside their network. The command and control traffic from that host can take nigh infinite forms, many of which won’t be caught by a firewall without specific threat intelligence. You can’t block port 80 or 443 at the firewall in most any environment, and that’s all that’s really needed for an attacker to remote control a system. So you have to add layers of detection that have more control and visibility. such as HIDS, internal IDS, and system level restrictions. 

  6. There are a lot of things that log besides your firewall and antivirus. 

    I wrote a post on this a while back listing a bunch. The thing that horrifies me more than SOCs that don’t have a decent SIEM or log aggregation solution are the ones that only monitor their antivirus console and firewall. So many network devices and systems can provide security logs. Are you looking at authentication or change logs? DNS requests? Email? 

  7. Good security analysts and responders are hard to find. Educate, motivate, and compensate yours. 

    Or you will lose them just as they are becoming experienced. Our field has almost a 0% unemployment rate. 

  8. Make good connections everywhere in your organization. People will know who to report security incidents to, and you’ll know who to call when they do. 

    There’s often a personality and culture clash between infosec people and the rest of the business. This is really dangerous. We are ultimately just another agency supporting the business and business goals. All of our cases involve other units in or organization to some extent or another. 

  9. If you don’t have some kind of Wiki or KB with processes, contact info, and lessons learned, you’re doing it wrong. 

    I can’t believe I have to say this because it’s true of almost any scientific or technical field. If you don’t write down what you did and how you did it, the next person who comes along will have to spend the time and effort to recreate your steps and potentially make the same mistakes. This also means everybody on your team needs to be able to make notes and comment on processes, not just one gatekeeper. 

  10. You can’t do everything simultaneously. Identify and triage your security issues and tackle one project at a time. 

    Plenty of the horror stories I hear from security operations centers in their early stages involve taking on too much at once – especially without the guidance of a project manager. These teams drop everything because they can’t do it all simultaneously. We have the unfortunate tendency to be ideas people without organizing the projects and tasks we develop into structured projects.

  11. Threat Intelligence is not a buzzword and does not center around APTs. Have good feeds of new malware indicators. 

    Yes, there are predatory companies selling threat intelligence feeds with little or no value (or ones that consist entirely of otherwise free data). The peril in discounting threat intelligence is that signature based malware and threat detection is becoming less valuable every day. Every sample of the same malware campaign can look different due to polymorphism, and command and control mechanisms have gotten complex enough that traffic can change drastically. We are forced, at this point, to start looking in a more sophisticated way at who is attacking and how they operate to predict what they will do next. The includes things from identifying domains resolving to a set of IPs to sophisticated intelligence analysis. How far you take threat intelligence depends on time, funding, and industry, but every organization should be making it a part of their security plan.

  12. if your employees have to DM me for help with their basic SIEM / log aggregation, you’re failing at training. 

    Happens all the time, folks. I see a lot of good people at organizations with terrible training cultures. Make sure everybody has a level of basic knowledge from the start, and isn’t so intimidated in asking for help that he or she feels forced to go outside your organization. 

  13. Team build, and don’t exclude. The SOC that plays well will respond well together and knows their members’ strengths and shortfalls. 

    Prototypical hacker culture, while an absolute blast, is not for everyone. I’ve seen people shamed out of infosec for the most bizarre reasons – the fact is that some people don’t drink alcohol, or want to go to cons, or think Cards Against Humanity is appropriate. Yes, we are generally intelligent people and we can be rather eccentric. That doesn’t mean that people who find these things unpleasant don’t have skills and knowledge to contribute. Accept that they don’t have the same interests and move on without badgering. It’s their personal choice. When you plan your teambuilding activities, try to make them inclusive – people with kids might not be able to hang out at the bar at midnight.

  14. If you seek hires do it in range of places. Grads, veterans, exploit researchers, and more all may have different stuff to offer. 

    I see a lot of organizations with a relationship with a infosec group or university that only recruit from that specific pool. As with lack of genetic diversity, this provides no advancement or innovation. There are tons of places to find interesting perspectives on infosec from well educated candidates. It’s important to bring fresh ideas and perspective into your team.

  15. if your ticketing system doesn’t work in a security context, get your own dang ticketing system and forward. 

    There are two main reasons that you shouldn’t be using the same ticketing system for security cases that your IT department uses for everyday help desk operations. The first is security – there is no reason that your IT contractors or non-IT staff in general should be able to see the details of sensitive cases, even by an error in permissions. This also includes their accounts, should they become compromised. The second is that these ticketing systems are not designed with security incidents in mind. A security incident case management platform should do Critical things like store malware samples safely, provide court admissible records of evidence hashes and case notes, and integrate with SIEM or log aggregation solutions. If your ticketing solution is not doing these basic functions, it’s high time to consider a separate platform.

  16. DO virtualize your malware analysis. DON’T virtualize your security applications unless the vendor says how to. 

    Virtualization software is critical for lots of reasons in infosec – from setting up malware analysis labs to CTFs to honeypots. It is not appropriate for all security applications and solutions. Most organizations are heavily pushing virtualization as a cost saving initiative, but be very cautious when presuming all resource intensive and highly specialized security tools will function alike when virtualized.