Threat Modeling at BSides Nashville 2024

I’m excited to announce that I will be speaking at BSides Nashville May 11, 2024. I will presenting my threat modeling talk which I’ve been blogging about the past couple of weeks. I’ll link the blog posts to the talk and pictures for past BSides events below. I’ve been going to BSides Nashville since it started in 2014. The first few years I attended I lived in Columbia, SC, which meant a seven hour drive to attend the conference. In 2016 I moved to Nashville and now consider it my home BSides conference.

It’s a really great event with a lot of great speakers and great spot. It’s also Nashville so getting into some fun (or trouble) is right around the corner. Prior to the pandemic they used to sell out 300 tickets very quickly. Post-pandemic they’ve struggled to get back to those number but so has every other local user group and conference. I’m expecting this year to be a big year for conference attendance not only for myself but the community. I believe people are ready to get back out there. More importantly the job market is influx and a lot of people are looking for jobs. The best way to do that is to get out and network with people at local user groups and conferences. If you’re planning to attend reach out and we can meet in person!

Threat modeling blog posts:

• Why Threat Modeling is Important

• What is Threat Modeling?

• Basics of Threat Modeling

• Methodologies and Approaches for Threat Modeling

• Threat Modeling Risk Management

BSides Nashville Pictures:

BSides Nashville 2014

Bsides Nashville, TN, May 17, 2014.

BSides Nashville 2015

BSides Nashville, TN, April 11, 2015.

BSides Nashville 2016

BSides Nashville, TN, April 16, 2016

BSides Nashville 2017

Nashville, TN, April 22, 2017

BSides Nashville 2018

Nashville, TN, April 14, 2018

BSides Nashville 2019

Nashville, TN, April 13, 2019

Exploring Information Security Podcast Now on YouTube

The Exploring Information Security podcast is now available on YouTube! This is something I’ve been working on for a month due to Google’s verification process which rejected me multiple times. YouTube is something I’ve wanted to get more involved with and submitting the podcast RSS feed was the first step. I have some other content planned for live sessions on YouTube.

You can also check out ColaSec’s YouTube channel where I contribute to that local meetup virtually. Also, the latest edition of the EIS podcast is up where I talk to Mubix about Mimikatz.

Exploring Information Security podcast format

First, I’d love to hear feedback from listeners on the podcast. This post is going to deal specifically with length of the podcast. In the past I’ve tried to keep episodes to around 30 minutes. The idea being that people can listen to an episode during a commute and that they have other podcasts the listen to on a regular basis. It also allowed me to split up longer conversations so i could more easily release content on a regular basis. One conversation could be three weeks of work with some extra editing.

I think I’m going to ditch that and just let the conversations run for as long as they do. A couple reasons for that: people pick and choose episodes and reduce the extra editing. Towards the end of the podcast I started getting more insights into how people listened to the podcast. I found that I had a regular listener base but also a lot of people who would pick and choose the episode to download. For example, one of the more popular episodes was on studying for the OSCP. It was downloaded a lot. Searching the internet I found it on a lot of reddit threads as a suggestion for people studying to get their OSCP. I think breaking up the podcast makes it harder for people to listen to the content they want. They have to go through multiple podcasts with an intro and an outro.

On the backend there’s a lot of work that goes into a podcast episode. One episode of 30-60 minutes is usually about three to four hours of production time not including the recording. I have to schedule guests, research the topic to make the questions, and then do post editing to clean up and put together the audio. While breaking up the podcasts gets me more episodes it adds a little complexity to the editing process and I want to simplify that. It does mean I’ll have to book more guests but I think that adds more content naturally to the podcast and site.

Thoughts are appreciated. Hit the comment section below or reach out to me via the site contact form or LinkedIn.

This blog post first appeared on Exploring Information Security.

Finding a mentor in books

I’ve never been a big fan of formal mentorship or the push for new people to find mentors. I’m okay with the concept and if it get’s setup properly, then great. I think it puts too much pressure on mentees and it can be frustrating if the assigned mentor isn’t into it. On the flipside I’ve heard plenty of good mentors give mentees recommendations and then don’t see a follow through. I’ve also started seeing young professionals getting hung up on this concept and hold themselves back because of it.

A lot of that is from my own experience. There’s not one individual person or group of people that I can point to as being exceptional mentors for me. They’re out there. I just haven’t had the fortune to run into them. Instead I’ve appreciated the more organic mentors I’ve had. The ones that are peers of mine or even subordinates. Yes, subordinates or people early into their careers are a mentor to me because they bring fresh ideas and perspectives. That’s why I wrote the blog post - Mentorship is a two way street. A year later I’ve discovered that there’s another form of mentor, books.

As I’ve reflected on my career and who I am as a person I can find certain books that have really impacted me and helped me more than any one person. Specifically books about current and historical people. The last several years I’ve been studying stoicism and a lot of that study includes examples of philosophers from the pasts. Their words, their difficulties, and even more importantly their actions. I’ve also read books on Will Smith, Bruce Lee, and Winston Churchill. Churchill in particular has been fascinating for me because he dealt with a lot of politics. His struggles have aligned with some of the struggles I’ve had moving into management. That’s what a mentor provides. Experiences and difficulties they’ve had and how they handled them.

Again, not saying mentors aren’t important they are but it doesn’t need to be a person. Below are some books I’ve read that I feel have helped mentor me in my career (and still are).

Mentor Book Recommendations

The Official Biography of Winston Churchill - This is the current series I am going through. It covers the entire life of Winston Churchill and everything he or others have written about him. The shortest book is 700+ pages. I’ve found these books helpful as I’ve moved into management and run into the same type of politics at the companies I’ve been employed.

Man’s Search for Meaning - This is a powerful book by Viktor E. Frankl who lived through the worst conditions during World War II. It covers survival and the psychology around it. If you’re struggling at work this will highlight how insignificant a lot of it is when surviving a concentration camp in WWII required a mindset and luck. I spent several years trying to figure out my purpose. This book flips that on it’s head and says I get to make that determination.

The Supreme Commander - This is about Dwight D. Eisenhower and his leadership during World War II. It covers all the planning and execution of the Allied invasion of Europe. From this I learned about leadership, planning, and the higher up the chain the less control you have over individuals and the execution of your direction.

I Was Right On Time - Buck O’Neil is a fascinating figure in baseball. A lot of that is because he had such a great attitude towards life and the trials he went through coming up as a player through the Negro Baseball League and Major League Baseball. I’ve tried to foster a more positive approach to work and life though I am no Buck O’Neil he is someone to look up to as a positive influence. Also, check out The Soul of Baseball: A Road Trip Through Buck O’Neil’s America.

Final thoughts:

As you can see I have a very heavy lean towards World War II. Anything by Stephen E. Ambrose is excellent and covers individuals and leaders in tough situations and how they handled them good or bad. I’d also recommend Bernard Cornwell if you’d like some fictional mentorship. He writes historical fiction and looking back on my career I’ve modeled my professional career around two of his characters: Richard Sharpe and Uthred Ragnarsson.

You don’t have to read my recommendations. I would recommend identifying your interests in security and outside of it and look for leaders in those spaces and read up on them. Especially, if you feel frustrated with finding a mentor. There are multiple ways we can interact with a mentor.

This blog post first appear on Exploring Information Security

Curious about OSINT?

Check out https://osintcurio.us/. It’s a new site authored by several pretty well known names in the industry. How it got started is a mystery (how I got invited is even more of a mystery).

I’m really excited for the site. There are already 11 posts on the site (including my origin post), including one about Python and how to use it for OSINT purposes. As with other communities I’ve contributed to, there’s a lot of excitement to start. Then it dies off. I don’t think this is the case here. There’s a lot of people involved that are really into OSINT. Most of them are regular contributors. I hope I can match their energy for this site.

This post first appeared on Exploring Information Security.

Social Engineering for the Blue Team

I am happy to announce that I will be doing a workshop at Converge and BSides Detroit this year. The conference is May 10-12 in Detroit, Michigan, at Cobo Hall. Tickets are currently available for this event. It's a great conference with some really great trainers and speakers. I am humbled to be a part of the experience again this year.

I decided I wanted to do the training on this topic, because I think it's something our industry needs. Building relationships is very important for security. It's what allows us to get buy in from leadership, probably the most important factor in setting the tone for security at an organization. It's also what allows us to more easily get security implemented from a compliance and technical stand point.

I tried submitting this idea to some conferences (DerbyCon) at the end of the year last year. I wanted to avoid the use of the term social engineering, because I saw it as a sexy word. Something the red team only did. I didn't get any traction on the idea. I had a really long title. Something like, "Building relationships to get more security blah blah blah (boring!)."

After I read, Chris Hadnagy's book, Social Engineering: The Art of Human Hacking I realized that it's more than just a red team activity. In fact Wikipedia has multiple entries on the topic. It's not just security focused. It's also political. Reading the book it's even more than that. Sales and marketing people use social engineering. In fact, we all do it, to varying degrees. Some better than others. The book is focused on red teaming for social engineering. A lot of those concepts, though, I could easily apply and even provide examples of doing on a day-to-day basis.

Maybe I should backup for a moment and explain what I do. I sit with a development team. I don't sit with the security team. I am their security resource. I liaison security needs to them and development needs to security. The role has expanded to working with multiple teams and multiple departments. A large part of that is because I seem to have a knack for getting along with people. And that's because I apply a lot of social engineering techniques that red teamers us to breaking into a building or network. I never truly understood why until I started studying social engineering.

That has resulted in me not only understanding the why, but also how I can be even better at what I do. I would like to share that with the infosec community. I think we can all be better at interacting with other departments. I think using these techniques we can get even more done. We can reduce frustration and stress. We can have more opportunity to talk about security and influence others into a more secure mindset.

I've submitted this topic to multiple conferences. I was accepted as an alternate for BSides Nashville (tickets go on sale February 14.2018). I'm waiting to hear back on others. In the interim, I've started working on my slides and training. I plan to use the podcast and this blog as an opportunity to get my ideas and thoughts out of my head. Feedback is encouraged either in the comment section below, on Twitter, or email (timothy[dot]deblock[at]gmail[dot]com).

This blog post first appear on Exploring Information Security.

Podcasting and blogging update: New archive feed and other thoughts

New archive feed!

A few weeks ago, I discovered that I had a problem with the Exploring Information podcast feed on iTunes. It was only holding the last 100 episodes. The first several had rolled off. The iTunes limit for podcasts is 300. I found out this was a limitation by Squarespace. I like having all my episodes available, because I try to make them as timeless as possible.

After a bit of research and work, I've managed to setup an archive feed for the podcast. This is an entirely separate feed that I will transfer older episodes over to as I need space on the original feed. You won't need do any changes to your current subscriptions. New episodes will continue to show up there. I will have to do this every 100 episodes I put out, which is just under two years.

Podcast ideas

I've run into an issue recently where I can't seem to get ahead on scheduling episodes. Part of this was the holidays, followed by going to CodeMash. I also run into the issue of infosec professionals (particularly ones with interesting things to say) are super busy. Some won't respond, others will respond with interest, then radio silence. #PodcasterProblems

I think I'm good now after my two most recently recorded sessions (I'm getting four episodes out of two recordings). However, I also think I want to sprinkle in some more solo episodes. I've got a long list of ideas for solo episodes that I think will help with putting out more content. I also think I'm going to create a list of people who I can go to on a more regular basis to discuss topics in a particular area. I still plan to have on new guests, but I think this will help with scheduling guests (and make my life a little easier).

Twitch.tv. I am thinking of doing a Twitch.tv or Google Hangouts stream for when I record episodes. I think it'd be cool to show you how I recording. It would also allow people to ask questions of the guest. A couple reasons why I don't like the idea is that it could end up being distracting. Having to manage a chat channel while talking to a guest isn't always ideal. I also try to loosen up the guests before the show and sometimes we talk about things that they or I don't want recorded. Maybe not a big deal if I go live when we start recording. Then there's also the fact that it could eat resources and cause things to crash (I need a new machine soon).

Thoughts and feedback in comments below, please.

Blogging more

I am planning on blogging on a more regular basis. There's something relaxing and soothing to get thoughts and ideas typed out. I've been trying the link posts. Those are nice but don't fill in the act of typing out a blog posts with coherent thoughts. I've also felt the pressure to put something useful out to the community. That can often lead to writers block and make the writing feel more robotic.

What I am going to try is blogging about the podcast, talk ideas, gaming, and maybe some personal journal type of stuff (my alcohol posts seem to resonate with people and I have an update!). That's it. See you soon!

This blog post first appear on Exploring Information Security.

Yet another 2017 December link post

What I'm reading

Would people (who actual read this blog) rather have me do link posts or spend this time putting together blog posts?

New Pluralsight Play by Play: What You Need to Know About HTTPS Today. Another Pluralsight course by Troy Hunt.

Jocko Willink on the Power of Discipline by Cal Newport: "If you want freedom, then you need to have discipline"

On the Complicated Economics of Attention Capital by Cal Newport: "And yet, even though we’ve pushed connectivity to daring new levels — a technological miracle built on numerous ingenious innovations — we haven’t become more productive."

Mirai IoT Botnet Co-Authors Plead Guilty by Brian Krebs: "The Mirai malware is responsible for coordinating some of the largest and most disruptive online attacks the Internet has ever witnessed."

"I can' believe you wore a plunging neckline when you save mankind" by Frances Cole Jones. Some people will always find something negative to say.

Anti-Skimmer Detector for Skimmer Scanners by Brian Krebs. Of course, skimmers are getting more complicated and harder to detect.

The end of facebook's ubiquity by Cal Newport. "...once social media services are forced to make a sales pitch, as oppose to leveraging an inherited position of cultural ubiquity, they suddenly seem so much less vital."

New Package Moniker rules. I love npm's stance on security. They're doing a lot of great things (see link below). In this instance they're trying to battle the typosquatting issue in the npm registry.

Skyrocketing Bitcoin fess hit carders in the wallet by Brian Krebs. Interesting to see the downside (for the darkside) of the rising value of Bitcoin (that sentence sounds weird. Is it weird?).

4 Years after target, the little guys is the target by Brian Krebs (can you tell I like Brian Krebs?). If you like Jason's Deli (I don't really care for it) it may have had credit card information compromised.

npm private modules outage on December 12th. I love this! This is awesome and gives some insight into responding, troubleshooting, and fixing a production issue.

Buyers beware of tampered gift cards by Brian Krebs. I had something like this happen to me. I won a gift card at work. Went to use it and it had less the $3 on it.

What I'm watching

This is my favorite holiday video for this time of year.

An interesting take by John Sonmez on Net Neutrality. I like looking at contradictory views. I think losing net neutrality will cause a positive reaction.

Brockmire. I recently watched the first season of Brockmire. I gotta say it's a funny series. Crud, but funny.

This blog post first appear on Exploring Information Security.

Early 2017 December Links

What I'm reading

MacOS High Sierra had a fun bug for accounts. You could keep hitting submit on authentication and get authenticated after a couple of attempts.

Bill Sempf wrote up a good article on performing reconnaissance for a security assessment.

Former NSA Employee pleads guilty to taking classified data.

Hacked password service LeakBase goes dark.

I love this idea of checking in with people, even when there isn't anything to report. It makes people feel much better knowing that you're still on top of things.

Phishing emails and pages are getting better. I consider that a good thing. It's raising the bar for user awareness.

I am fascinated by Docker security. This past week I found an article on 22 security tools for Docker.

Help the Rural Technology Fund introduce 100,000 students to technology.

What I'm watching

AVENGERS ASSEMBLE!

This blog post first appear on Exploring Information Security.

Post 2017 Thanksgiving links

I hope everyone had a good Thanksgiving. Onward to Christmas!

What I'm reading

Using an Attack-for-Hire could get you in trouble with the law. Now you can do it from your mobile device!

Facebook's mission: ‘How do we consume as much of your time and conscious attention as possible?'

Interesting idea for setting goals. Three days, three months, and three years (what happened to three weeks?). New Year's is coming up!

Finding sensitive information in URLs is one of the easiest things to find in application security. Adam Baldwin went down a rabbit hole with this question: “wonder if any npm dependencies are using urls that contain tokens or passwords.”

CouchDB and the npm registry.

Good article on Digital Forensics Incident Response (DFIR) resources.

Root9B shuts down at the end of the year. It's a Brian Krebs article if you're wondering, "who is Root9B?"

Another Brian Krebs article. Scammed via Western Union? There's a fund for you.

Great take on the baseball Hall of Fame by Astros County

Troy Hunt is testifying in Washington DC regarding data breaches.

What I'm watching

Linkin Park & Friends Celebrate Life in Honor of Chester Bennington

When You Haven't Played Destiny 2 in 3 Weeks...

Destiny 2 Lore - The Story of Osiris

Leviathan Raid Funny Moments

#EarnedHistory | Houston Astros

This blog post first appeared on Exploring Information Security.

Podcast updates: EIS now available on Google Play and a new Astros podcast soon

The Exploring Information Security podcast is now available on Google Play Music. I decided to add it to Google Play Music, because a listener requested it. In the past I've put podcasts on multiple podcasting platforms. That is a bit of a pain to manage. With EIS I decided to just put it on iTunes and add it to other podcasting directories when requested. If you have another directory you prefer over iTunes or Google Play Music reach out and I'll get it added to that directory.

For those who enjoyed the Crawfish Boxes podcast (an Astros related podcast) I'll be starting a new Astros podcast soon. I've been toying with the idea for a month or two. I think I've figured out the format, the co-host, the recording time and place. I have some ideas for a name (I might do a Twitter poll). It will be much more casual. Name suggestions are welcome.

I expect to start the new podcast right around the playoffs.

This blog post first appeared on Exploring Information Security.

Recommended resources for information security

“What are some good materials you would recommend on InfoSec?” -Kenneth Reavis

This is such a great question and one I thought worth a post. My short answer is podcasts, blogs, and videos. These are what I use to help improve and stay relevant in the information security field. I listen to podcasts on my ride into work. I read Feedly to stay up with news events and people in the industry. I watch YouTube and Pluralsight when I need to pick up a complicated concept or technical topic.

Podcasts

I love podcasts. I love them so much that I produce my own. Security Weekly is the first podcast I started to listen to when I got in the field. Each episode contains a news, interview, and demo segment. I found the interview segment to be the most useful. This is a good first podcast to start with. The show has been around for years. It has a lot of good content and it’s a good crash course to the hacker culture of the field.

Risky Business is the best podcast in the infosec field. The production quality and content are top notch. The show starts with a news segment. That leads into two interview segments. The first usually deals with a current topic being discussed in the field. The other is a sponsor interview, which is usually just as useful as the other interview. The show is usually 50-65 minutes long.

Peerlyst has a long list of podcasts. Look for a few that are of interest. Give the podcast about three episodes before making a decision. Podcasters do sometimes have “off” shows. Here are some of the other podcasts with good content.

Down the Security Rabbit Hole - Leadership and business

Defensive Security podcast - Blue team focused

Data Driven Security - Data scientist focused

DevelopSec - Application security focused

On my ride home I listen to hobby and interest focused podcasts. I found that when I listened to infosec podcasts both ways I started to get burned out on podcasts. I now listen to infosec or business related podcast on my drive in. This helps me get focused. On the ride home I listen to hobby podcasts. This helps me transition from work to home much easier.

My last recommendation is to pick up podcasts that don’t have an infosec lean but focus on improving the self. I listen to both Manager and Career Tools for business etiquette guidance. I also listen to the Art of Charm for relationship building and self-improvement guidance. Both have helped tremendously in my day-to-day interactions at work.

Blogs

I use Feedly to collect RSS feeds from the sites and blogs I have an interest in. I follow ars-technica for news. Their articles are both informative and usually a quick read. I also follow Steve Ragan at CSO for news.

I work in the application security field. Troy Hunt is one of the bigger names in the field that produces content regularly. He also runs Have I Been Pwned which is a very useful tool for incidents involving a breach.

Brian Krebs is the man when it comes to reporting on breaches and criminal activities involving digital technology and ATMs.

Bruce Schneier is one of the top names in the cryptography and encryption field. He also tends to focus on the bigger picture and ramifications of security in society.

I add and prune my feed pretty regularly. If I get too far behind on my feed I’ll look to simplify it and get rid of the blogs. I look for blogs that aren’t providing as much value or report on stories I see from other feeds.

Get an RSS reader setup (it doesn’t have to be Feedly). Start adding to it and adjust if necessary. Feeds are also good for keeping up with alerts and vulnerability databases.

Video

I am a visual learner. The two resources I use extensively are YouTube and Pluralsight. I add a lot of conference talks to my Watch Later list. That list has 48 videos as of this writing. I don’t get on YouTube as much as I would like, but it’s still a useful tool for research. And every once and a while I'll create a playlist. It’s a valuable resource for better understanding a technology or infosec technique. Pluralsight requires a subscription. The content is top notch and provides a more indepth look at technology or security topics. It's $300 a year. I've had my place of employment pay for the last few years. It's usually an easy sell.

Conclusion

Those are the resources I use on a daily basis to learn and keep up with information security. There are a lot of other great resources out there. I just haven't found them or don't get as much value out of it. There are a lot of great digital forensics and incident response resources. I just don't work in that field. Find what gives the most value. If it's giving very little, ditch it.

Blogs allow me to keep up with daily news and read interesting new content. I have several hobby feeds setup in there so I get a nice mix throughout the day (I sometimes need a break from infosec). I listen to podcasts almost daily. There are general podcasts and more focused podcasts. Some have varying degrees of quality, but most have really good content. Finally, videos provide a visual opportunity to learn and research topics. I don’t use these on a daily basis. Instead I use them when I need to dig deeper into a topic.

There are a lot of great resources out there. Ask around. Find what type of medium you prefer and fits best into your lifestyle. Try something. If it provides value, great! If not, get rid of it. I just realized I didn't even touch on boxes. I may save that for another post.

This post first appeared on Exploring Information Security.

How to start a podcast

I can remember the exact moment I decided I would start a podcast. I was mowing my lawn. It was several months after recording a podcast at the Crawfish Boxes. It was our first podcast where we ranked the players in the Houston Astros' minor league system. I didn't produce that episode but I was excited to take part in more. When more didn't happen I decided to take initiative. I decided to produce the podcast my self.

Five years later I've produced over 200 hours of baseball podcast content. I'm well on my way to replicating that in the information security space. Consistency has been the biggest thing for me. I've managed to produce content on a regular basis. I've done that by getting my process down to a few hours. I prepare, produce, edit, and then release episodes in just a few hours. Getting started took quite a bit more time.

If your week is slammed with different obligations and hobbies reconsider starting a podcast. Starting a podcast is easy. Have an idea and then record it. The challenge starts with distributing and maintaining a podcast. With an emphasis on maintaining the podcast. If there are several obligations that take up time then it will be hard to make a podcast a priority. And that's the key to a successful podcast. The willingness to make it a priority. If you're there, (or at least think you're there) read on.

Have an idea

It took me a couple years before I had my own idea for an infosec related podcast. I didn't want to be like the other security podcasts out there. Talking about the latest news and ideas in infosec. I wanted something different. That's not to say you can't do what others are doing. Your voice is unique enough to do the same thing as others. For me I wanted something that was timeless and would provide value to others.

Once an idea has presented itself, I would recommend writing down the idea and format for the podcast. What is the duration of the podcast? What sections will it have? Is there a co-host? What do you want to cover? Is it focused on a specific topic or more general? What is the description of the podcast? What is the tagline? Who is this podcast for? Answering these questions will help get a clearer picture of what's needed.

Record it

My podcast setup is low-cast. I record using a soundcard that has a "What U Hear" function. With this input I record every sound made on the computer. The one sound that doesn't get recorded is my microphone, because it's a separate input. Which is why I use two Skype accounts and hook my microphone up to my laptop when recording guests. An alternative to this is getting a mixer. I've never used one so I can't provide any tips on using that instead.

A solo podcast is much easier to produce. A microphone and audacity is all that is needed. I use the ATR-2100 microphone and Audacity to record audio. The ATR-2100 is a $35-75 microphone that will provide 7 out of 10 quality. The more expensive professional microphones will provide a 9 out of 10 quality. The ATR-2100 provides a 7 out of 10 quality. The ATR-2100 is well worth the money.

Audacity is free and gets the job done. Software is available with a price tag for editing. That decision usually involves improving workflow.

Edit it

Audacity is where most of my editing occurs. While recording I will use the marker hot key to mark any points I need to review after recording. The default key mapping is CTRL + M. It took me a little time to get used to using it. Once I got used to it, I was able to edit without having to re-listen to the entire recording again. I could just go to the marker and make my edits. When working with markers you have to edit from the end of the episode to the front. Editing from the front will move all the markers.

Of course there is value in listening to the entire episode again. When I first started I would pick-up on things that needed improving on. Some examples include, improving the transition from topic to topic. Do things like reducing "uh" and "um" in our speech.

After editing, export the audio into a .wav file. Then run it through Levelator2. This tool will normalize levels and clean up the audio a bit. This makes listening to the podcast a little more enjoyable for the listener.

Once that's done the convert the .wav file to a .mp3 file for storage reasons. Wav files are big. MP3 files not so much. This will help with storage and improve download times for the listener. I use iTunes to convert my .wav files to .mp3 files. After that's done upload it to storage for distribution.

Store and distribute it

Storage is a cost. There are free options, but those are trickier and add complexity. I've used Libsyn and would recommend them. For me I discovered that I could host and create the RSS feed for my podcast on my own personal site. This made things much easier for me.

The last thing to do is get the podcast setup in a distribution platform. There are a lot of them. The most popular one is iTunes. This will be where you'll see most of your download traffic. Other podcast distributors include Stitcher, BluBrry, and many others. My current podcast is only on iTunes. That is the biggest distributor. I gain a much smaller amount of listeners submitting to other podcast directories. If a listener were to request another podcast directory then I'd submit there.

Submitting to a podcast directory is well documented by each site. You will need an RSS feed. There are many ways to setup one. Most storage providers like Libsyn will create an RSS feed for you. You can also do it yourself. Which is what I did for the four years of the Crawfish Boxes podcast. Currently, I'm using the EIS Podcast page on this site as the RSS feed.

Once submitted it usually takes a few days for the podcast to show up. I recommend having three episodes in the RSS feed before submitting.

Numbers to care about

If a podcaster got past 7 episode he is more likely to stick with podcasting and produce it on a regular basis. I'm not sure how true that is, but I feel like it there is some truth to it. In my experience podcasts stop because they're complicated to produce. Which leads me to my last bit of advice. If you want to keep at it, make the process as simple and as efficient as possible.

Resources:

• iTunes starting a podcast

• The audacity to podcast

• How to podcast: the ultimate guide to podcasting

• Pat's complete step-by-step podcasting tutorial

This post first appeared on Exploring Information Security.

Resources for marketing yourself better

I was recently asked for the resources I use to help market myself and alsowhy I chose Squarespace for my website. I use podcasts, books, and the content I produce to help improve my marketability. As for Squarespace, I like the convenience.

Podcasts

I listen to two podcasts with the intent of improving myself. I listen to Career Tools for business and professional etiquette. For personal improvement I listen to the Art of Charm.

I mentioned Career Tools in the EIS podcast on writing an infosec resume. Career Tools covers various topics. It gives advice on Looking for a new job.  Email usage and relationship building with peers. As well as other basic business etiquette in a work environment. Having a solid resume and interviewing techniques is great for external marketability, but don't forget about marketing yourself in your current role.

To improve my soft skills I listen to the Art of Charm. The tag line of the site is, "Advanced social skills training for top performers." Every guest has accomplished some form of success. The topics range from improving relationships, getting ahead in business, or improving your lifestyle. The podcasts gives me a different angle to think about how I approach life.

These are two of the podcasts I found the most useful and enjoyable to listen to. They are not for everyone. Give them a try, but recognize that if they don't work there are plenty of others to listen to. Find the podcasts that work for you. Maybe podcasts just isn't your thing. Maybe your thing is reading.

Reading

I’ve always loved reading. Several books have had a huge impact on my life. One that I’m reading right now is How to Wow: Proven Strategies for Presenting Your Ideas, Persuading Your Audience, and Perfecting Your Image by Frances Cole Jones. The other I will recommend is What Color is My Parachute by Richard N. Bolles.

How to Wow covers several different topics in the professional world. Presenting, interviewing, managing, and more are all topics covered in the book. It’s helping me refine my approach to different aspects in my professional career. Self-improvement books are a genre of books that I've been reading for a while. I don't think I'd be where I am now without them (which may make for another post).

A more technical option for job seekers is What Color is My Parachute. The book is updated yearly with job-hunting trends and techniques. I used this book to help with writing a resume, performing a job search, and interview techniques. One of the lasting impressions the book gave me was the idea that there is no perfect resume. All that matters is if it results in an interview opportunity.

There are a lot of self-improvement and marketing books available. Asks friends, family, or colleagues for suggestions. Another book I recommend is the Seven Habits of Highly Effective People by Stephen Covey. The book is a classic that helps recognize and change habits in day-to-day life.

Website

I’ve messed around with Blogger and I’ve helped manage a few WordPress sites. I choose Squarespace because all I have to do to maintain the site is post content and pay a monthly fee. The fee is between $9 and $16 a month, depending on how much content you put up on your site. After 20 pages it bumps up to $16. Which is where I’m at (I actually pay yearly for the discount). There’s a two-week trial available for those looking to test the waters.

I wanted a clean simple look for my site and that’s what they offered. I was able to choose my theme and go.  I uploaded my content and setup links to all the external content on my site. The toughest part was writing the about me page. I don’t have to worry about patches or any other maintenance that occurs on other platforms.

WordPress experience isn’t a bad thing for someone looking to get into IT. I’ve had to manage (and cleanup) a few WordPress sites during my time. It’s also a good opportunity for those interested in web development. For me I’d rather pay for the convenience than deal with the hassle. I’ve got several other things going on in my life and website maintenance isn’t one of them.

Conclusion

The resources I rely on to help with that are podcasts, books, and a website. The podcasts I use include the Manager/Career Tools podcasts and the Art of Charm. Manager Tools focuses on business etiquette. Art of Charm focuses on self-improvement. There are a variety of books that have helped me better market myself. I’m currently reading How to Wow by Frances Cole Jones. I’ve used What Color Is Your Parachute by Richard N. Bolles for resume and job search advice.

I started a website because I wanted to collect all my content in one place. It also allows me to control how I am presented on the web. When someone searches my name I want them to be able to find my site and find out who I am and what I’ve done. There are plenty of website options available. I chose Squarespace because it gives me a clean look and convenience.

Marketing yourself is an important aspect of a professional career. It can help highlight experiences but also who you are as a person. It is valuable for getting into infosec, but also for advancing your career.

This post first appeared on Exploring Information Security.

The 7 Habits of Highly Effective People

I just finished the book The 7 Habits of Highly Effective People by Stephen R. Covey. What a fantastic book. I've heard of the book before but never took the time to actually read through the 380 pages or so. The book really helped me reflect and understand what I'm doing right and what I can approve upon in life.

The book deals in seven habits that fit into three different different areas of our live. Being proactive, beginning with the end in mind, and first things first fit into our independence. Essentially, what we can control in our own life. Then thinking about win-win, seeking to understand, and synergizing all fit into the interdependence of building relationships. Finally, there's sharpening the saw in the continuous improvement section. The final habit has four personal areas of renewal: physical, spiritual, mental, and social/emotional.

As I read through the book here are some of quotes that resonated with me:

Really seeking to understand another person is probably one of the most important deposits you can make, and it is the key to every other deposit. You simply don't know what constitutes a deposit to another person until you understand that individual

I've seen success with this approach in implementing security.

Integrity also means avoiding any communication that is deceptive, full of guile, or beneath the dignity of people. "A lie is any communication with intent to deceive," according to one definition of the world. Whether we communicate with words or behavior, if we have integrity, our intent cannot be to deceive.

I have a pair of sunglasses that I had etched with the word "integrity." It's a word that I've always believed in and try to practice in my daily life.

So I recommend reading literature, such as the inspiring biography of Anwar Sadat, In Search of Identity, and seeing movies like Chariot of Fire or plays like Les Misérables that exposes you to models of Win/Win.

Win/Win is something that I've practiced before but never realized I was actually doing it. Win/Lose, Lose/Win, and Lose/Lose are the other variations that I've practiced and never realized. I intend to continue to study Win/Win scenarios and applying it more in my daily life.

Apparent learner disability was nothing more or less than teacher inflexibility.

I've always wanted to teach. I thought it would be High School history or something, but now I realize teaching is something we do daily with the people we interact with. As teachers we need to find more creative and interesting ways to get our message or teachings across. If students aren't picking up on it, that's on us. Not them.

Final thoughts

One of the things I loved about this book is that Covey focused on some of his own failings. In self-help books, authors often focus on successes in implementing self-help advice or strategies. Which of course makes trying to apply those practices frustrating when they fail. Reading about the failures and the lessons learned from helped me to understand that application will take time and that it's a continuous process.

This post first appeared on Exploring Information Security.

CSO panel and thoughts on Cardinals-Astros breach

Last month I participated on a panel for CSO on, "The pathway to the security talent we crave." The audio and transcript from that panel is up for those who have a free account with CSO.

Former St. Louis Cardinals employee, Chris Correa, was in court for his unauthorized access of the Houston Astros database, Ground Control, on Friday. I read through the five-page indictment and shared my thoughts on Astros County in regards to how the breach occurred.

This post first appeared on Exploring Information Security.

Trends 2015 presented by IT-ology wrap-up

Trends 2015 presented by IT-ology was today and I am exhausted.

Every year in the fall IT-ology selects a technology topic to hold a conference on. This year was security, so naturally ColaSec was involved in providing speakers, volunteers, and marketing for the conference. Four keynote speakers filled the morning track and 12 speakers filled the afternoon tracks, which were split into technologist, civilian, and business. I presented a talk titled, "Low cost tools for security challenges" in the technologist track.

For those coming to my site who were in that talk, here are my slides and here are my videos (from previous conferences) of the talk. I got some good feedback from in regards to the talk, which was very much appreciated.

Trends 2015 was the last time I intended to give this particular talk. The recordings are out, my slides are out there, and I'd like to move onto some fresh content. What that is, I don't know yet, but I have some ideas. Before I move onto some fresh content, I want to compliment the video and slides of my talk with some blog posts that go a little more in-depth with the tools I presented. Over the next several weeks I intend to have a post a week, with step-by-step instructions on how to use each of the tools in my talk.

Thank you to everyone that made it to my talk and any feedback is still welcome.

This post first appeared on Exploring Information Security.

Investing in the people who work on a security team

I was recently featured in an article title The support security leaders need for better cloud security on CSO Online by fellow palmettoian(?) Michael Santarcangelo.  I'm working with Michael on improving my writing while exploring various topics within information security. I did not realize moving to the cloud had become such a hot trend for businesses. It makes sense, though, and is probably something that will become more excepted. After thinking about it I realized I've had some exposure to moving certain IT functions to the cloud already. It makes sense for the right technology, and the technology is only getting better, so it will make sense for more and more initiatives.

As I was researching the topic one challenge began to stick out to me. Is everyone on board, specifically those in security, with moving business and IT functions to the cloud? Talking to several IT people I work with and know, I came away with a feeling of hesitation. Hesitation or not, the business is making the call to move to the cloud and doing it at an ever increasing pace. Which is why it is important for all members of a security team to have an understanding and be comfortable with technology moving to the cloud. It is happening whether we like it or not. We could say, "no" but that just means we are being the brick wall that the business will hammer through or more simply walk around or climb over. I have come around to the idea that security needs to be an enabler of the business, but security leaders needs to become an enabler of the people on the security team.

I'm seeing a lot of managers and leaders wanting to do good things, but not finding the time to invest in their people. They are slammed with meetings and projects and spending time with the members of the security team just doesn't fit into the schedule. They were hired to do a job and that's what they'll do, plus they are slammed with a long to do list too. Here's the thing, the people on the security team have wonderful ideas, they have creative ways to solve problems, but more importantly they want to help find solutions to problems the manager is facing. If there's a disconnect all that creativity and input goes to waste.

We often hear about the talent shortage within security. The easy solution is to higher more people and get better funding. The even easier solution is to invest in the people already on the security team. Are security leaders getting the best out of their people? The only way to find out is to invest in the team, not just in training but in mentorship. Sitting down with them to understand their frustrations, provide mentorship, give feedback, and more importantly enable them to be the best they can be. Santarcangelo followed up the article above with one titled The security talent shortage and your leadership opportunity. It's a slideshow format article, which makes it a quick read and it asks some questions on what leaders are doing to address the talent shortage.

Wrapping up (because this is already longer than intended), I'm seeing security teams struggle with finding and then keeping people. As it happens, I was listening to a podcast from NPR's Ted Radio Hour titled The Meaning of Work. The episode explores how we make work more meaningful. Compensation is not something that makes work more meaningful. The environment, the culture, and the challenges are what make work more meaningful. Investing in the security team will help build a better environment and culture. Enabling the security team will help create more challenging opportunities that lead to more meaningful work. More meaningful work makes for a happier security team and a happier security team accomplishes so much more than an unhappy security team.

This post first appeared on Exploring Information Security.

More resources for IT certifications

The latest Exploring Information Security podcast episode, "What certifications are available for infosec professionals?" released yesterday and I've already started getting some great feedback from the episode.

@TimothyDeBlock Also ran across this: http://t.co/eiegAtvxls

— Tyler Neeriemer (@tyneeriemer) October 19, 2015

Tyler Neeriemer on Twitter shared with me a couple links that had certificate roadmaps in them. I really liked this one from CompTIA. The roadmap includes non-CompTIA certs and is laid out intuitively. There's also this article from 2012 by SecureState.

Feedback for the podcast and any helpful links that contribute to an episode are always welcome.

This post first appeared on Exploring Information Security.

DerbyCon talk and impressions

DerbyCon lived up to its top billing as one of the best security conferences to attend. It is amazing how much is going on at the conference the entire time. Five talk tracks, CTF competition, lock pick village, vendor area, and of course LobbyCon. And that doesn't include the evening festivities like Hacker Jeopardy, a showing of Hackers to hackers, or the two nights of concerts (DualCore and The Crystal Method). There was a constant roar coming from the lobby of DerbyCon each day from 8 a.m to 6 a.m.

The con was well located in downtown Louisville, Kentucky. Outside of the venue is a plethora of food choices and entertainment. All within a two block radius. The farthest I ventured away from the con was about three blocks for breakfast with a group of old and new acquaintances. 

Speaking of acquaintances, I got to catch up with people I've meet at previous conferences, as well as meet some new ones. That is one of the best things about attending these conferences, the connections you create and maintain (and I've made a whole bunch in the one-plus year of attending cons).

Below is the recording of my DerbyCon talk and a link to my slides.

DerbyCon talk slides

I was pretty happy with my talk. I wish I wasn't so monotone, but part of that was nervousness and the other part was sitting down for the talk. I believe later speakers stood up with microphone, which is something I should have done. Sitting down to give my talk sucked some of the energy from it. Looking past the lack of energy, I have gotten good feedback on the talk. Everyone that I talked to about the talk said it was good and useful, which was my ultimate goal.

I am very much looking forward to DerbyCon 2016

This post first appeared on Exploring Information Security.