Interesting security reads: AI, Typosquatting, and Okta

Increasing transparency in AI security - Google Security Blog - Interesting article on AI security and how it falls pray to the same supply chain attack as the development lifecycle. It goes over how Sigstore and SLSA can help improve the security of the AI development lifecycle.

Have I Been Squatted - This is from the Risky Biz News and looks like a very interesting tool for companies looking to identify if they have any domains being typosquatted that could be used for phishing attacks.

The Okta story continues - Krebs on Security - The plot thickens. All Okta customers were impacted by the breach. Full name and email address were stolen. This is valuable information for attackers looking to phish IT administrators that have permissions into their Okta tenant.

IceKube - WithSecure Labs - This is an interesting tool recently released that checks Kubernetes environments for attack paths. Then it provides a graph as a visual that allows you to see the attack path. This could be very useful for teams looking to understand an environment.

Guidelines for secure AI system development - National Cyber Security Centre UK - AI is a bit of the wild west at the moment but as governments get a better handle on the technology they’ll start putting regulations and controls in place. Guidance is usually the first step and it’s worth paying attention to if products or companies are starting to use AI in a specific company or globally.

This blog post first appear on Exploring Information Security.

Implementing Dynamic Application Security Testing (DAST) Tools into the SDLC

One of the questions that always came up at the end of my API talk was around Dynamic Application Security Testing (DAST) for APIs. I mention DAST in the talk but never really went more in-depth due to time constraints. The questions usually revolved around vendors. In this post I want to talk about how DAST works, I’ll mention vendors from my experience, and finally I’ll go over implementing DAST in the Software Development Lifecycle (SDLC).

HOW IT WORKS

DAST tests an application when it’s stood up and running, usually in a test environment. The test itself looks for the low hanging fruit because it’s running automated tests with no context or awareness of the business function of the application. It will run the same test against a finance system as well as an operational system. This tool is not a replacement for manual testing.

The tool will simulate what an attacker might do to an application. It will check for injection vulnerabilities and weaknesses within connections and protocols to the application. Again low hanging fruit so it will struggle with more involved techniques and misses simple things like URL enumeration and other abuse cases. Overall this tool is a great starting point for applications as it’ll capture a lot of the low hanging fruit but it won’t go much more in-depth than that.

Vendors

OWASP has a list of Vulnerability Scanning Tools AKA DAST available. The main ones I usually recommend are Tenable, Rapid7, and Invicti because I have familiarity with them. I always recommend evaluating multiple vendors before deciding on one. If you’re needing a DAST because of compliance reasons, I’d suggest Tenable or Rapid7 depending on which vulnerability management suite you already own.

If you’re wanting something for more than just compliance look at Invicti because that’s their only focus. This allows them to focus solely on the DAST technology. A Tenable or Rapid7 is looking at providing other security solutions not just DAST. From a low-cost perspective OWASP ZAP or BurpSuite are two free options that can be run manually or setup to automatically run in a CI/CD pipeline. The cost here is a resources time for learning and setting up the open-source tool.

IMPLEMENTATION

DAST is the easiest application security tool to setup in an SDLC. You need a URL, some login credentials, and a timeframe to scan. I recommend scanning as close to production as possible. Scanning in production is never a good thing because it’s throwing a lot of malicious types of attacks at an application. This can cause issues such as taking down the application or putting a junk data into your production environment databases. Scans can be setup to not be as aggressive but then it ends up missing vulnerabilities.

Scanning in a User Acceptance Testing (UAT) allows scans to run at the most aggressive level and not impact production. That is as long as the database isn’t shared with production. The only catch here is finding a time to run the scan so it doesn’t impact user testing. Scans can be setup to run in the afterhours.

The frequency of scanning should be based on how often code is released to UAT. If development is on two-week sprint then it’s reasonable to setup scans to run every two weeks. Some industries only require scanning applications once a month and that’s fine as well because as the vulnerabilities are addressed the need for DAST becomes less important.

Boom! Done!

Not so fast my friend!

Now that we’re scanning we need someone to look at and tune the results. This person should ideally be someone with application security experience because they’ll need to understand how the application woks or willing to dive in and learn. DAST has false positives. Not as many as a Static Application Security Testing (SAST) tool but it will have some. If results are taken from a DAST tool and sent to developers without any sort of vetting it will either tick off the development team or not get addressed. Often times both scenarios are the response.

If an application security person or someone willing to learn isn’t available then setting up a meeting with the development team to share findings and ask questions will go over a lot better. Developers are good people and love talking about their code (baby) and they’ll want to make sure it’s protected from the bad guys on the outside. This meeting will need to be a regular one for any new applications loaded into the DAST. As the vulnerabilities get tuned or addressed the meeting can be less frequent. As trust is built the meeting can become an email unless there’s some misunderstanding or a more complicated vulnerability needs to be addressed.

Summary

DAST is easy to setup but it’s the last tool to be kicked off. As more security tooling get’s implemented and the program matures the importance of DAST becomes less. It’s still a great starting point for any application security program. Always evaluate multiple DAST vendors. If it makes sense to go with a DAST that is already part of a suite of other tools then go with that.

The strategy for implementing DAST is the same for web applications as it is for APIs. You won’t see as many results for APIs because their use is more restrictive than a website. The main concern with APIs is authentication and authorization issues. DAST will be able to call out weak protocols but it will not be able to identify if a person has the access they need. Remember to work with the development team on getting DAST setup because their help will be needed for addressing vulnerabilities.

If you’re looking for an API vendor focused on testing, I’d recommend 42Crunch.

Drop a comment below if there are any questions or other topics you’d like me to cover. If you’re interested in services I have sponsorship, consulting, and speaking engagements available. Reach out via the contact form.

This blog post first appear on Exploring Information Security.

Why Taking a Break is Important

Because we all need opportunities to recharge our brain. Even Bill Gates took a week off twice a year to recharge. I like to take a week in the spring and one in the fall just for myself to recharge. I usually play golf and video games during that week. I’ve found I’m stressed leading up to that week and recharged after the week. This is outside of family trips and vacations which can add a crinkle to taking time off if paid leave is limited. I’ve been fortunate to work at companies where I have quite a bit of time off and I can work from anywhere so I can maximize the time-off when I get there.

At one point I thought some friends and other people I knew who seemed to work all the time were different but eventually they burned out too. I do think tolerances are different and some people need less time away from others but we all eventually do need some time to unplug. And this isn’t going on vacation and answering emails or responding to alerts. It’s getting away completely. This was recently reaffirmed to me in my current role at an incident response company.

Notifications are the devil. Leaving notifications on is very much death by a thousand notifications. In my current role I’ve had email and multiple IMs on at the start. I’ve since reeled that in to just IM notifications and direct mentions specifically because no time of day or weekend was safe. Each notifications requires brain energy. It’s like running a car if you leave it on even in park it will run out of gas. That’s why turning off the car and in this case notification saves some of that energy for when I need to make a trip.

As a leader I need to be conscious of it because I impact a lot more people at work. I remember delivering a performance review to someone in January and they were a little surprised at the exceeding expectations review I gave them. They told me that at the end of the year they were wondering what they had done wrong to tick me off. As I reflected I realized I was burnt out during that time. While I tried to put on a nothing wrong is face and I don’t yell at people it was still pretty clear to the people that reported to me (and probably those that didn’t) that I was in a fowl mood.

I also need to be watching out for my directs and ensuring they’re in the best state mentally. Again, some people are better at it than others, so identifying the people that need to be told to go on paid leave is important. People earlier in their career are usually the ones that will work until they have some sort of breakdown. I know I was and to a certain point I still am based on what happened as a manager. Coming from a military background and getting into the private sector I expected to be told when to go home sick and when to go on leave. By the way if you’re sick go away and if you’re in an office go home.

I had 60 days of leave available when I left the Navy. Now I did take that as terminal leave and enjoyed my last two months of service playing World of Warcraft: The Burning Crusade but it highlights that I really wasn’t taking time for myself. As we get older there are more and more stresses added to our life and career. Starting a family or having family members to take care of takes it’s toll. As we advance in our careers we get better at what we do and gain wisdom from our experiences but new problems like politics and health problems start to creep into our world. It’s more important than ever to make sure we are taking breaks to ensure we’re performing at our best.

This blog post first appear on Exploring Information Security.

Meeting Dug Song - some guy who started up Duo Security

Recently at misecCON I had the pleasure of meeting Dug Song at the speakers dinner. He was the opening key note and I was the after lunch presenter on API security. When he walked in I had no idea who he was outside of being the keynote speaker. As I was scooting down to make room for him I got the sense that the guy sitting next to me was disappointed. I asked him as much and he confirmed that he would love to be sitting next to Dug and that he might fanboy a bit over me.

Something you should know about me is that I’m a bit oblivious at times. I try to treat everyone the same whether they’re a new person in the field or a rock star. And by rock start I mean a literal rock star. I’ve sat at dinner across from Neil Fallon from Clutch and had a genuinely pleasant conversation. Dug and Neil are people too and they wouldn’t be sitting with me for dinner if they weren’t down to earth.

I’m writing about this because I’ve recently started reading “The Daily Laws” by Robert Greene and I think today’s entry fits perfectly, “Assume You’re Misjudging the People Around You.” It’s a great reminder not to jump to conclusions about people. Throughout my career I’ve had people I thought were mentors suddenly stop communicating with me. I’ve also meet people that didn’t leave a great impression on me come around later in my career and make a great impression. You just never know in your career which is why it’s important to remain humble and not make assumptions about the people you meet.

What I loved about my interaction with Doug was he seemed to foster this mindset. He was very gracious and patient when I asked questions about whether he knew about MiSec (he’s the founder of the Song Foundation) and if he had ever been in startup (Duo). He also tried to steer the conversation away from him asked questions of the others sitting around him at the table. We had some great conversations about a lot of different things inside and outside of security.

Networking is huge for anyone in a career. Go out and meet people but avoid making assumptions about people. Give everyone an opportunity because you might end up finding a really great person to connect with.

This blog post first appear on Exploring Information Security.

Social Engineering is making a come back

History always seems to repeat itself.

History of social engineering

Ransomware has been around since the late 1980s. Social engineering has technically been around since the advent of human communication. In the context of technology security it’s been around since phreaking techniques were used in the 1960s and 1970s as a way to take advantage of phone systems. Today it’s phishing, vishing, smishing, and much more. It’s been around but not the main technique used to get into an organization, well until now.

It seems as vulnerability management and incident response improves attackers are switching to social engineering via phone. I recently heard from a friend about another friend who got all their work logins compromised via an attacker calling into the help desk and resetting his password and MFA. This comes on the heels of the MGM and Okta breaches.

MGM

Like the movie Ocean’s 11 attackers used social engineering techniques to obtain access into MGM system by impersonating an employee and calling into the help desk to have their credentials reset. This resulted in ransomware being deployed in their environment and costing the casino hundreds of millions of dollars.

Okta

The compromise of access tokens via the Okta’s customer support unit is probably even scarier because Okta holds the keys to a lot of other organizations. This breach gives attackers information to pivot into other organizations.

What’s next for social engineering

When attacks like the two examples above are successful and result in lots of money and infamy others start copying the techniques used. I would expect us to continue to see attacks like these going forward which means more focus will be needed on security awareness. Groups like Scattered Spider are already starting to pop up and their focus is on social engineering their way into organizations. Then with that access ransomware gangs begin deploying ransomware. This highlights a need for good detection procedures and technologies. We’ll probably also see more difficult controls put in place to protect accounts. This will degrade our account access user experience as a side effect.

Resources for Social Engineering

Social-Engineer: This is a company started by Chris Hadnagy focused on social engineering. They provide resources and also assessments for an organization that focus on social engineering. He’s written several books as well on the topic that I highly recommend.

One of those books:

"Social Engineering: The Art of Human Hacking" by Christopher Hadnagy: This book delves into the psychology and techniques of social engineering.

Krebs on Security is a great blog to follow in general. He covers a variety of topics mostly around breaches.

This blog post first appear on Exploring Information Security

MISSECON thoughts and impressions

Prior to the pandemic misecCON (the conference formerly known as Converge/BSides Detroit) was the last conference in my schedule for the year. Post pandemic I’m happy to see it back because it’s such a great conference. The conference was moved out of Detroit to Lansing, Michigan. I really like the location. It has that DerbyCon type of feel with the hotel as it’s central location. There’s plenty of food and after conference options for people to explore and experience. This version was only one day so time exploring was limited but what I did get to explore was great.

The conference had over 170 people show up so it wasn’t overwhelming but plenty of good conversations with attendees and great presentations to attend. I also really enjoyed the capture the flag (CTF) and even hopped in with a team for a short period of time. The venue was in the Double Tree Hotel Lansing and I was very pleased with the accommodations and rooms at the hotel. For lunch I went to Weston’s Kewpee Sandwich Shop and had a burger that had been sold for the last 90 years. A burger that’s been sold for 90 years is quite delicious. I like to get away from the conference and have lunch with friends as a break from the conference. For the record, the conference provided lunch also looked delicious. Not all conference provide a solid lunch so that’s a huge plus for this conference.

The after party was also great. It was at a place called the Lansing Shuffle which used to be an old farmers’ market on the river. We had a small section of the vibrant scene which included music and plenty of food options. The food provided was very good and the open bar had lots of options.

The rebirth of the conference is encouraging. The location is fantastic and has opportunity for growth into a bigger space which I think it will. I’ve heard there are bigger plans for next year with additions like workshops and other activities. I can’t wait to come back again in 2024.

This blog post first appear on Exploring Information Security

Heading to MISSECCON

I am super excited to be heading back up north to Lansing, Michigan, which is right in between Grand Rapids and Detroit. You might be wondering why I would leave the comfort of Tennessee to head up the soon to be frozen north. It’s MISSECON or #missecon, which is a conference rising from the ashes of Converge and BSides Detroit post-pandemic. MISEC itself is a huge community of infosec professionals with multiple locations across Michigan. I’ve had the pleasure of getting to know several of the members and they’re all quality individuals. If you can make the trip I would recommend it!

This will be my final time speaking on API security. I’ve really enjoyed putting the talk together and refining it over the last few months. I’ve learned a lot and I hope others have as well from my presentations. I’ve put all the resources and content from the talk at https://www.exploresec.com/api. I am working on a blog post about Dynamic Application Security Testing (DAST) because it’s the one question I’ve been asked about after ever talk.

I’m already starting to think about what topic I’d like to present on next year. CFPs are already opening up for the spring. One consistent concept throughout my presentations over the year has been threat modeling but I’d also like to do something like security awareness. Both are really important for an organization. The problem is that it’s hard to get them accepted at conferences. My API talks were accepted because it was a hot topic in the community but also I believe it’s still a hot topic for companies internally. Another topic I’ve found really interesting is how ransomware gangs work. There’s a lot of research that’s come to light over the past few years that makes it a really good topic to present.

More to come! Hope to see you at MISSECON!

This blog post first appear on Exploring Information Security

Reflections on InfoSec Nashville 2023 and BSides Augusta

Recently I attended InfoSec Nashville and BSides Augusta.

InfoSec Nashville 2023

Despite calling Nashville home since 2016, I only recently attended my first ISSA InfoSec Nashville conference. My expectations were exceeded by the event, especially with the opening keynote delivered by Robert Herjavec from "Shark Tank." While I'm not a regular viewer of the show and was initially unfamiliar with Robert, his speech was captivating. As the owner of a security company, his journey from a war-torn country to Canada, and eventually to starring in a hit U.S. TV show, is nothing short of inspirational. He shared intriguing insights into the future of security, particularly the idea of eliminating tier 1, a concept I'm still mulling over since there will always be a need for an initial level of defense.

Unlike at most conferences, I attended several talks at this one. Besides the opening, I was present for the afternoon keynote and a few other sessions before delivering my own at the day's end. The afternoon keynote resonated with me deeply, advocating for the hiring of entry-level professionals. The industry's skewed focus on seeking senior-level experts, as evidenced by LinkedIn job postings and the concerning average security professional age of 35, signals an unsustainable top-heavy structure.

However, hiring at the entry level isn't a panacea. Management must prepare a structured plan for these newcomers. I've seen many organizations lack this foresight, opting for senior professionals in the hope of minimizing their need for involvement. That doesn’t mean all entry level people are the answer. Maintaining a balance is crucial since many young professionals seek mentorship, a dynamic hard to foster in an environment composed solely of entry-level individuals.

The sessions I attended were enlightening, one on vulnerability management at a healthcare company stood out. Having developed a similar program for a mid-sized business, it was fascinating to compare approaches and scales, particularly seeing a dedicated team in action as opposed to one juggling multiple responsibilities.

The conference was overall a rewarding experience. It provided opportunities to connect with a diverse group of professionals and rekindle ties with acquaintances around Nashville.

BSides Augusta

As alluded to earlier, my conference strategy usually involves a "HallwayCon" approach, prioritizing networking and learning through impromptu conversations. This tactic led me to attend just one planned talk, aside from my own, at BSides Augusta. This event is a highlight on my annual calendar, coinciding nicely with a family visit to Columbia, SC, after the proceedings. What sets it apart is not just its impressive scale—with pre-pandemic registrations hitting 1,200 and around 800 attendees this year—but its distinct blue team focus, a nod to Augusta, GA's status as home to the Army's Cyber Command.

At a past ISSA meetup, I was taken aback when I was told attendees included members from the NSA, CIA, and Cyber Command —a moment that made me suddenly conscious of the powered on phone in my pocket.

I was extremely satisfied with the reception of my talk, now available on YouTube. My final presentation of this presentation will be at misecCON next month, where I'll have a full hour—a luxury compared to the concise 20-25 minutes at Augusta. While, like any presenter, I appreciate more time, I also value the challenge of a shorter format. It compels me to condense my speech to only the most crucial points, and enhance the chance of my talk being accepted.

The conference was, as expected, impeccably organized, and I cherished the catch-ups and new connections made. I’m eagerly anticipating next year's gathering!

Edited with the help of ChatGPT

This blog post first appear on Exploring Information Security

The future of AI and security

Artificial Intelligence (AI) is quickly changing the landscape for all of our society. It will significantly change our way of life over the next 10 years similar to how computers and mobile devices impacted our lives. If you’re not getting familiar with it now you may get left behind. This website is really only possible because of AI and more specifically ChatGPT. I’m able to crank out articles and information way faster than if I were creating the website entirely by myself.

I note all the pages I’m creating with the help of ChatGPT at the bottom so people know when it’s me and when it’s AI. I’ll be doing the blog posts and AI will be helping me build out all the other pages. You’ll probably notice the difference pretty quickly. I’m noting because I expect laws to come out in the future that require disclosure if AI was used in the creating of content. This is similar to how bloggers had to disclose if they were getting money from an entity as part of a post or other content on their website. Let’s dive into the predictions.

The government will regulate AI

As mentioned above the government will step in to ensure AI is being used in an ethical way. I’m curious how using AI to create things will hold up in court around topics such as copyright and data usage. I was hesitant to create an entire website and other documentation using AI because I don’t know if it would be considered plagiarism or copyright infringement. Amazon recently came out and limited self-publishing books to three a day. I think there are unforeseen things that will end up in discussion around AI and it’s use that will require regulation.

With any document being able to be feed into AI there’s a question for companies around sensitive data being leaked. This can be intellectual property and more concerning people’s personal information. As we see incidents where AI is leaking this type of information the government will step in and adjust laws an regulations, if not make new ones.

Creators will shift from writing to editing

This includes people like developers who are already using ChatGPT to write code. While AI is not any good at secure code review it can help developers get started with writing their own code. This can be a good thing as long as developers use it as a starting point and don’t just shove it right into production.

There’s no reason not to use ChatGPT as a first draft for things. I’ve written security policies for a company with just a couple hours of using ChatGPT and editing the output. This can be a good thing for smaller companies who don’t have a security team. Also, ChatGPT is able to write things in a much easier to understand format. Reading company policies may get a bit easier. Which leads into the next predication.

This will disrupt documentation

If you’re in Governance Risk and Compliance (GRC) or some other discipline within security that focuses on documentation it’s a good idea to start getting familiar with ChatGPT. There are people already out there using it and their output is going to be significantly more than anyone not using ChatGPT. GRC will need fewer people to complete their work. The ones who embrace it will stay because their productivity level is higher.

Summary

AI is a step forward and I think it’s going to help in a lot of ways. Yes, there will be some bad things and misuses that occur but overall it’s progress for our society. People creating within the tech space will see the biggest benefit. It will reduce the amount of time it takes to get a written piece of code or document out the door.

As far as securing the data their will be the usual growing pains when a new technology becomes easily accessible to everyone. Guardrails and guidelines will need to be put around the data as leaking the data is the biggest concern for AI. It’s benefits though could be significant and so security will again have to balance innovation with keeping people’s information safe.

This blog post first appear on Exploring Information Security

Adjusting to a new job

I’ve been meaning to write blog posts on a regular basis. That’s unfortunately fell to the wayside as I adjusted to my new job as Director Advisor Services as Antigen. I was going to give this as an update but this is a great opportunity to discuss switching jobs within the information security field. I’ve switched jobs within security three times now. Here are a few things I’ve learned.

Observe for three months

I’ve found the most effective thing to do coming into a new role is to speak as little as possible. There’s usually a lot to learn. Listening and asking questions helps to learn the environment and figure out where to help out. I shoot for three months but I’m usually contributing much earlier than that because someone is asking me to help or I volunteer to take on some work that I know will help the organization.

Volunteering can help show initiative and a willingness to contribute to the team and organization. These aren’t the fun tasks either. They’re usually the boring tedious tasks but they’re an opportunity to learn and contribute. Also be prepared to get a “no” when volunteering and that’s okay too.

NO organization has it figured out

From onboarding to performance reviews it’s rare to have an efficient and effective onboarding process. The responsibility is on the manager but most will push it off to Human Resources (HR) which is unfortunate because what you need is different from what others in different departments need. Be prepared to sit around and find stuff to fill the time.

I’ve had more candidates start to ask me about my 30-60-90 day plan for starting. I think it’s a great question. Most managers in my experience don’t have this or they’ll have something but never follow through. Not to say there aren’t organizations that have it figured it out. Most of them are a top 500 company on the stock exchange.

GETTING INTO A NEW ROUTINE TAKES TIME

I am no longer in an 8-5 job. The incident response (IR) space is filled with lots of weird hours including evenings and weekends. After having a schedule with some or no IR work, I now have a job where I am 365/24/7. That’s not to say I don’t have time-off. I just have to adjust my hours.

This can be great as I can run errands, workout, golf, and play video games during the day as long as my work is done. The work is just another incident around the corner. I need to make sure to have my boundaries and communicate that with others. That’s very different from an 8-5 where I’m expected to be in the office. Adjusting to that has taken time.

REMOTE VS OFFICE

There’s a lot more sitting around with remote work. If you’re in an office there’s usually someone to talk to or start working with. Being remote everyone is heads down and the manager usually has lots of other meetings going on. Good managers will block as much time on their calendar so they can get you up and running.

Working remote it’s really important to ask a lot of questions and invites to anything going on. Not everyone is going to remember to add you to things. Ideally there’s things lined up to do. If not, don’t stress over it. Do what’s available and then either walk away or work on a passion project.

SUMMARY

Starting a new job can be exciting and stressful at the same time. Looking back at the above patience is a big factor. I like to tell people that I start to get my bearings at three months. At six months I kind of feel like I know what I’m doing. At a year I’m finally comfortable.

Have a questions or want to share your experience? Hit the comment section below.

This blog post first appear on Exploring Information Security

Finding a mentor in books

I’ve never been a big fan of formal mentorship or the push for new people to find mentors. I’m okay with the concept and if it get’s setup properly, then great. I think it puts too much pressure on mentees and it can be frustrating if the assigned mentor isn’t into it. On the flipside I’ve heard plenty of good mentors give mentees recommendations and then don’t see a follow through. I’ve also started seeing young professionals getting hung up on this concept and hold themselves back because of it.

A lot of that is from my own experience. There’s not one individual person or group of people that I can point to as being exceptional mentors for me. They’re out there. I just haven’t had the fortune to run into them. Instead I’ve appreciated the more organic mentors I’ve had. The ones that are peers of mine or even subordinates. Yes, subordinates or people early into their careers are a mentor to me because they bring fresh ideas and perspectives. That’s why I wrote the blog post - Mentorship is a two way street. A year later I’ve discovered that there’s another form of mentor, books.

As I’ve reflected on my career and who I am as a person I can find certain books that have really impacted me and helped me more than any one person. Specifically books about current and historical people. The last several years I’ve been studying stoicism and a lot of that study includes examples of philosophers from the pasts. Their words, their difficulties, and even more importantly their actions. I’ve also read books on Will Smith, Bruce Lee, and Winston Churchill. Churchill in particular has been fascinating for me because he dealt with a lot of politics. His struggles have aligned with some of the struggles I’ve had moving into management. That’s what a mentor provides. Experiences and difficulties they’ve had and how they handled them.

Again, not saying mentors aren’t important they are but it doesn’t need to be a person. Below are some books I’ve read that I feel have helped mentor me in my career (and still are).

Mentor Book Recommendations

The Official Biography of Winston Churchill - This is the current series I am going through. It covers the entire life of Winston Churchill and everything he or others have written about him. The shortest book is 700+ pages. I’ve found these books helpful as I’ve moved into management and run into the same type of politics at the companies I’ve been employed.

Man’s Search for Meaning - This is a powerful book by Viktor E. Frankl who lived through the worst conditions during World War II. It covers survival and the psychology around it. If you’re struggling at work this will highlight how insignificant a lot of it is when surviving a concentration camp in WWII required a mindset and luck. I spent several years trying to figure out my purpose. This book flips that on it’s head and says I get to make that determination.

The Supreme Commander - This is about Dwight D. Eisenhower and his leadership during World War II. It covers all the planning and execution of the Allied invasion of Europe. From this I learned about leadership, planning, and the higher up the chain the less control you have over individuals and the execution of your direction.

I Was Right On Time - Buck O’Neil is a fascinating figure in baseball. A lot of that is because he had such a great attitude towards life and the trials he went through coming up as a player through the Negro Baseball League and Major League Baseball. I’ve tried to foster a more positive approach to work and life though I am no Buck O’Neil he is someone to look up to as a positive influence. Also, check out The Soul of Baseball: A Road Trip Through Buck O’Neil’s America.

Final thoughts:

As you can see I have a very heavy lean towards World War II. Anything by Stephen E. Ambrose is excellent and covers individuals and leaders in tough situations and how they handled them good or bad. I’d also recommend Bernard Cornwell if you’d like some fictional mentorship. He writes historical fiction and looking back on my career I’ve modeled my professional career around two of his characters: Richard Sharpe and Uthred Ragnarsson.

You don’t have to read my recommendations. I would recommend identifying your interests in security and outside of it and look for leaders in those spaces and read up on them. Especially, if you feel frustrated with finding a mentor. There are multiple ways we can interact with a mentor.

This blog post first appear on Exploring Information Security

Hacker Summercamp Fallout

Here’s some of the interesting things from Hacker Summercamp.

Lot’s of news articles on hacking AI because 2023 is the year of AI and it’s overshadowed every other topic (No, I’m not bitter my API talk has since been overshadowed by the dawn of the AI era).

NPR - What happens when thousands of hackers try to break AI chatbots - by Shannon Bond

TL;DR:

• 2000 people over three days participated

• Google, Meta, and ChatGPT provided their AI

• The outcomes from the contest are to strengthen guardrails, help policy makers, researchers, and the public understand how AI can go wrong

If you want the presentation slides from Black Hat they have them on their website.

There was of course some junk hacking. While it’s impractical, it is interesting research. This particular one is on hacking card-shuffling machines at casinos. Which I’m pretty sure they did in Ocean’s 13.

TL;DR:

• Report came out about some controversy around a poker game. Report said machine couldn’t be hacked

• Challenge accepted

• USB + USB port = pwned

Check out the Red Signal list on Twitter created by Jason Lang to see more fallout.

Also signup for the Risky Biz Newsletters. There’s some good nuggets on Black Hat and DEFCON in the one from August 15, 2023.

This blog post first appear on Exploring Information Security

Hacker Summercamp is over; let the fallout commence

Hacker Summercamp is a week long period at the beginning of August where the security community converges in Las Vegas to discuss all things hacking. I’ll have a page up to go into more details. One of the outcomes of the period is new vulnerabilities and attacks techniques are released in presentations. Some of it will be what’s called, Junk Hacking, which is interesting hacking that is very narrowly defined and usually has a small attack surface. Other security research released could have a significant impact organizations.

I’ll be watching for new releases throughout this week and write them up here. If you see anything interesting drop in the comment section below. If you went, drop your experience in the comment section below.

This blog post first appear on Exploring Information Security

Speaking Engagements Fall 2023

I’ve gotten my last letter back on a submitted CFP. I will be speaking three more times this year before looking ahead to 2024. Here are the conferences I will be at for the rest of the year. The topic I’ll be speaking on is API security. I’ll put the abstract below.

Infosec Nashville 2023 - September 26-27 - First time for me. I’m excited to go to a local event.

BSides Augusta - October 7 - I’ve been going to this conference since 2014. This is one of my favorite yearly events to attend. Yes, it’s a bit out there but it’s one of the biggest BSides in the world. For those curious Army Cyber Command is located in the area. It’s a very blue team focused conference.

MISECCON - November 17 - MISEC is one of the most talented local user groups in the country. This is a rebirth of Detroit Convergence and BSides conferences post pandemic. This is another one of my favorite conferences.

Title: The Security Hitchhiker's Guide to API Security

Abstract: API security is so hot right now! Organizations don’t fully understand APIs, how to find them, and secure them. This can feel scary. Don’t Panic. Grab your towel and join me on a meme adventure to explore the API galaxy. We’ll cover the history of APIs. Why people now suddenly care about them and why they’re such a hot topic. We’ll go over some ways to identify APIs within an environment. We’ll cover how API security is different and how to start securing them. We’ll review the API security tooling landscape. Finally, we’ll review resources to get your towel wrapped around API security and answer the ultimate API questions.

This blog post first appear on Exploring Information Security

Being a Security Generalist

I am a security generalist. That’s not something I’ve heard many people describe themselves in the industry. In fact when I got into the industry I was told to specialize. That sort of happened with application security but I continued to get drawn back into more generalized roles. I have a diverse background in the field. I was IT focused for 10 years five with the Navy and five with the State of South Carolina. Then I shifted into security and was one of three people wearing multiple hats. I did eventually get an appsec focused role but then the development team was cut and I now had appsec as well as security engineering and pentesting. Which I was fine with. The company was great and the opportunity was interesting. Plus, I actually wanted to get into management.

I certainly think you can specialize but I think it’s okay to be a generalist too. In fact some people just have that mindset. They enjoy learning a bunch of different things instead of diving into on particularly subject. This website and the podcast are a testament to that. I can certainly specialize. I did it well with application security but I can also shift into other field. I’m now in a incident response role. I’ve never been one to dig to deep. Once I get to a certain level of knowledge with a particular topic I start to get bored. I need a constant challenge.

The downside of course is that there is not generalist role in security unless you consider management. Which has it’s own skillset outside of technical ability. I’ve struggled to prove to people on paper that I can do the job with such a diverse background. This is why networking is so important within the field. My current role came about because I knew several people on the company and they knew me and had no qualms about my ability to contribute to the company.

After 20 years of being in IT and security I’ve seen a lot of roles start to specialize. When I came up we wore many different hats across multiple fields. So, it may become harder to be a generalist. The issue I have with that is if someone goes down a path and then discovers it’s not for them. I do not want to be in a security operations center looking at logs all day. I did the job fine but four months in I was ready to be out because I felt like I was chained to my desk. Some people are fine with that. I’m just not one of them.

I encourage everyone just getting into the field to be okay with not knowing and to explore options. If something clicks then stay if not move onto something else and try that. If you do that (or have done that) enough times and nothing really sticks or you keep getting drawn back to other fields then maybe you’re a security generalist. That’s okay because we need security generalists too.

This blog post first appear on Exploring Information Security

Blog updates: Pages and really old pages

I’ve completed the starting sections with the exclusion of vendors. I’m still figuring out what I want to do with that section. I’d like it to be a sort of sponsor page for vendors supporting the site. I’m open to ideas in the comment section below.

I am starting to build out the deeper dives pages for the main pages. Some are already up. More will come and will continue to come over the foreseeable future. I’ve focused on the media section and created a few recommended pages as that’s where I think a lot of value will come from this site.

I’ve gone through my old blog page and moved over anything infosec related from several years ago. I had more content than I thought. That’s a good thing but also highlights I used to write a lot more. I’d like to start having more regular updates on this blog. Not sure what all that will entail. I did infosec links for a while with some other more short and long form editorial pieces. I’ll end up trying all of these again along with some other ideas. Again, comments on what you’d like to see would be appreciated.

Things have come together slower than I expected. That’s due to the kids being out of school and enjoying time with them. I also picked up a part-time job that has eaten into some of my intended time for this site. With school about to start and me getting more settled into work I should start making some more progress.

I haven’t done much work on the podcast because I wanted to get the site in better shape. I’ll be starting to reach out to some people to start setting up interviews. Once that is set we’ll be cruising.

More updates to come.

This blog post first appear on Exploring Information Security

New beginnings for Exploring Information Security

I’m not sure if anyone still comes to my site. I haven’t posted anything in over a year. There are pages that end up in search terms so I guess it may get some traffic. I should probably look. Either way the site has changed. It is no longer my personal blog. I have decided to expand it as a website that I want people to come to when they need help researching a topic in the infosec/cybersec* space.

*Yes, I’ve come to terms with cyber in our vernacular but that doesn’t mean I’m giving up infosec either. Especially, since that’s what I started with.

I am planning on bringing the podcast back. First, I want to get the website in a better spot. I’ve changed the design and spent some time the last week getting that organized. I feel it’s in a good spot and now want to start building out the content. This post is the first foray into that. Consider it a soft open if you will. I would love suggestions. You can either hit me up or leave a comment of what you think should be on this website.

The idea is that this is a website for new people and people looking to learn more about a certain topic. One of my first bits of advice to people looking to get into the field is that they have to learn to sift through all the content in the security space. This site is meant to help people with that. It’s not just for new people though. I want to also address new things that come out in the space. New vulnerabilities or ideas or hot topics. Those will probably end up as more blog posts to start but I want to be able to speak to those things quickly while I then build out the content on the website.

I’m excited to be back!

This blog post first appear on Exploring Information Security

Mentorship is a two way street

Mentorship is a big topic in the security industry. There are programs setup to connect a mentor with a mentee. I believe they’re great programs. I also believe mentorship is more than just a program. We can be mentored by people above us, below us, and within our peer group. I once said this to a friend and co-worker of mine. He responded that he saw mentorship as one way. I agreed that it is one way. I mentor him and he mentors me. There was a look of confusion and then a realization. 

He’s a director and I’m a manager. At one point he was an analyst fresh out of the military. Within two years he went from analyst to manager to director. I’ve helped him along the way mentoring him on his hiring practices. He’s mentored me by encouraging me to climb the corporate ladder. At the time I wasn’t really interested in going higher than manager. We’ve confirmed each other's beliefs in management and also challenged each other. 

I’ve done well for myself in my career. I’ve never really had a designated mentor. I’ve had to pick and choose lessons throughout my career from my managers and peers. I’ve asked mentee questions of several people because I like learning and gathering different perspectives on things. 

They’re all ages and experience levels. The new generation has new ideas that could help us be better. The older generation has lessons from their own experiences that can help us avoid pitfalls or holes they fell into. There are peers that help us confirm or challenge our beliefs. They’re all around us. To me mentoring is organic. You can certainly have a designated mentor but don’t overlook the mentors right in front of you.

This blog post first appear on Exploring Information Security

Information security is a journey not a destination

It’s actually two journeys or two parts.

Part one: Getting into Infosec

This is where the journey begins. Usually with a desire (or need) to get into the information security. Sometimes you didn’t even know you were on the path. Which was my case. I joined IT because it seemed interesting and did a pretty good job of paying the bills.

I’ve been thinking about this more, because I’m going through the hiring process for a junior level position. I’ve noticed a variety of backgrounds of people trying to get in. Some people are coming from the military, others college, and yet others from working in IT. The junior positions don’t require security experience, it does however require some kind of college or IT experience.

Another observation I have is that, the candidates that are sticking out are involved in the infosec community and taking advantage of the many free resources. There are conferences, forums, slack channels, podcasts, blog posts, capture the flag events, videos, VulnHub, Hack the Box, bug bounty programs, and much more. Being involved in those things is very important because once you get in…

Part two: Being in Infosec

You have to utilize all those resources to keep up with the field. It’s been called a cat and mouse game between attackers and defenders. Technology is in a constant state of advancement and enhancements and with it comes new security challenges. A few weeks ago four vulnerabilities got dropped over a four day period that required me to understand the vulnerability. I had to understand how it is exploited and how we can mitigate it. I used blog posts, podcasts, Twitter, Google, and reached out to some people.

That last one is particularly important. The others are found on Google. Getting to know people requires putting yourself out there. Overcoming nervousness and anxiety to meet some new people. The benefit is two fold: you can ping ideas off people and you’ll increase your chances of finding opportunities within infosec. The perfect first job in infosec is rare. By perfect I mean a place to grow and advance. Even if you find a good organization there may not be a chance to advance or move up.

Below are a some links to help look for conference and other events in the area. I like BSides events because they have a low bar to entry. Usually $10-30 bucks for a day of talks, networking opportunities, and food. If that’s too much volunteer. It’s a great way to help out the community (reflects well on a resume) and be in a position that requires interaction. I only interacted with a few people at my first event as an attendee. As I continued to go to events my interactions with different people and the same people increased. How quickly this happens depends on how many events are attended.

These events also don’t require you to be in the field. You can start building your knowledge and opportunities before you get into the field.

Resources

Meetup.com - Good place to find local user groups in your area

Infose-conferences.com - Pick your state and any adjacent state you’re willing to travel to

This blog post first appear on Exploring Information Security

Management is a shift in mindset

If you ever go into management in the infosec field (or really any field) get ready for a huge shift in mindset.

Finishing the Exploring Information Security podcasts was a great decision for me. I would love to still be doing it, however, it’s just not valuable for me as a manager right now. I am no longer thinking about the latest happenings in infosec. I am still paying attention to what’s going. It’s just that my performance is largely reliant on the people that report to me. That means managing workloads, removing blockers, providing feedback, making decisions, and metrics.

It’s been a shift for me, even though I knew it was coming. I have to delegate or else I get to caught in the day-to-day operations. It’s not efficient for me as a manager. I’ve seen others get promoted into management and struggle. Largely because they still wanted to do the technical things and get paid as a manager. That’s just not possible based on the role. I’ve always wanted to go into management. I find the challenge in how do I get the most of the people that report to me. How do you make someone as productive as possible.

Oh, it’s also about politics. If you can’t, “play” the political game you will struggle as a manager. To get things done as security professionals requires building relationships with other departments. We in security have a big stick. Using that stick to get things done has the effect of making people not like you. Instead I like to build relationships using the techniques of social engineering. It’s much more effective and people tend to like you afterwards.

A resource that helped me prepare for a management role is Manager Tools. It’s a great tool for figuring out how to be an effective management. They’ve been around for several years with lots of topics to dive into. Even if you’re not interested in management they have the Career Tools podcast, which focuses on career advice. There’s resume, interviewing, how to ask for a raise, and much more. The hosts are very direct and to the points, which will rub some people the wrong way. They have data to back up their recommendations, though. I can confirm that using their techniques has helped me shift into management and become a better professional. The most beneficial being how to write a resume and interviewing.

Prior to listening to the Career Tools podcast, I struggled writing resumes and interview. This despite going to seminars and reading books on how to do both. At one point it took me 15 months to find a new opportunity. After listening to the podcast I increased my job offers dramatically and eventually found my current opportunity that I hope to retire from.

I’m hoping to document my experiences in future blog posts. While I’m not as focused on the technical infosec things, maybe I can contribute from the career advice of things.

this blog post first appear on Exploring Information Security