[Music]
thank you
[Music]
all right
foreign
ladies gentlemen and fine folks who
identify as neither nice to see you all
it's a wonderful beautiful other Cypher
Cod I uh actually gave one of my very
very early talks at Cypher con one and
it was not this impressively organized
and engineered so this is pretty
exciting for me
there's still some people filtering in
Hello friends
so uh if we
could think I'd met no
but there's a couple new faces here my
name is Leslie Carhart and what do I do
for a living I
I do incident response for a very unique
systems uh industrial control systems to
be specific so when something like a
power plant gets hacked
or a water treatment plant or
manufacturing even trains my team is
some of the few folks in the world who
go out and try to figure out what
happened and try to keep it from
happening again in the future I work for
a company called dragos and that's all
we do is industrial stuff
and I've been doing into the response
for a pretty long time now
um I've been in it for over 20 years now
I've been in ir and differ for well like
12 13 years
um and I speak about this stuff a lot I
blog about it and I tweet and Tick-Tock
and everything prolifically about cyber
security sorry about that
um I retired from the United States Air
Force Reserves in December so after 21
years
and in my free time I teach small people
to hit things in martial arts
so what are we going to talk about uh we
just had a really really interesting
keynote on a completely different
technical topic
um and I just want to take us back to
the beginning and and talk a little bit
about jobs in cyber security because
it's something I get asked about a lot I
get asked about
um
you know different things that people
could do in cyber security and a lot of
times young people come up to me and
they're like
well they want to get into cyber
security and then I ask them well what
do you want to do and they're like I I
don't know what should I do
and that's really a complicated topic I
ended up writing a very long Vlog series
about this it's been passed around the
internet for a while and um
you know in the beginning you know we
try to figure out whether people want to
go the more offense to the the red team
route or the more defense The Blue Team
route
and they're both very very valid and
they're both interesting careers but the
bottom line is there is so much going on
in cyber security that it's it's
difficult to learn everything in one
Niche right and um to learn two niches
is a lot and you just can't learn at all
and uh it's good to Shadow other career
fields and cyber security and learn a
little bit about them we talk about like
purple teaming
um
and and that's an on some concept I'll
talk a little bit about later but in the
end you can only fit so much in your
brain so you kind of have to focus in
cyber security and uh people just they
aren't sure where they want to go so
sometimes they hop around a little bit
sometimes they try to start in a job
that gives them exposure to a lot of
different things
but today I want to talk to you about
selecting a role and which one might be
interesting for you specifically
um and how do we do that right now well
you might come up to a person like me
and be like what job should I get and
I'm like I don't know I don't know you
um what do you want to do
um so we usually make those decisions
based on well first of all what we think
is cool so maybe what we see on TV or at
conference talks or we hear about in our
classes you know there's there's these
like the prototypical hackers out there
available so I'm sorry about that but
you know um we see this this idealized
image of these various roles in cyber
security especially things like
conducting like yeah you're breaking
into stuff you're hacking things it's
really really cool
um and you also hear about things that
are talked about in your circle so maybe
you're at Cypher con today and you go to
a talk and you hear about something that
sounds really neat and you're like oh I
want to do that when I grow up and that
happens to me all the time I want to be
like 14 more things when I grow up
um and you see you see a view of things
from the outside so you see kind of a
view of how you perceive things from a
limited image okay and uh it really
depends a lot on what you personally are
exposed to once you end up deciding to
do and that can be based on kind of a
False Image right because we see these
idealized temporary images of these
various niches in cyber security
so let's talk a little bit about you all
so I want you to think about yourselves
for a moment I want you to do a lot of
introspection during this talk but let's
let's think about
um ways that we kind of characterize
ourselves so
if you work for a large company you will
oftentimes run into team Dynamic models
so you go and you take your little
personality test maybe tells you what
color you are or something or you know
what set of letters or things that you
you are based on their their exam and
hey these these models they they try to
put people in boxes with which never
really works um like we talk about uh
Myers-Briggs and stuff and we say it's
like um Fair analogy for HR things like
that it's it's just kind of artificial
and you really can't put people into a
box like that
um however models that talk about
various aspects of personality can be
useful to understand things about
yourself and the people that you work
with but you're a tool they are not a
magical thing that's going to assign
your your Sorting Hat assignment to
something like that's that's not what's
going to happen there you'll get some
ideas about how you might differ from
other people who are doing a similar job
or a different job and so we're gonna
we're gonna use some of these models
today and I don't want you to get hung
up on them they're all everything's a
spectrum in the world people are
complicated people change over time if
your personality tests today
um in in a year you might come back and
characterize completely differently by
the same test because we change our
lives change we change
um and so so we really can't be put into
a box like that but
um as I said to talk about some of these
roles and who might like them and who
might not like them I'm going to use
some of these as a tool so so let's
start at a high level stuff to consider
about yourself
so introspection time think about this
for a moment so your attention span
this is an important factor right some
of these jobs I'm going to talk about
today I'm going to talk about things
that that are exciting to certain
personality types and I'm going to talk
about things that are often considered
negatives so the downsides of the jobs
um now some people might disagree with
me on that because I have a personality
of my own I ended up in a specific niche
of cyber security
and thankfully there are people who are
very very different from me who think
some of the stuff I find very very
boring is pretty exciting
that said there are always mundane parts
of every cyber security role okay
everyone has stuff that we rarely see in
talks because even the people who really
love their work agree that that part is
kind of dull and frustrating and time
consuming and boring it's the nature of
almost every job in cyber security and
we're going to talk about a whole bunch
of them
um so your attention span how long can
you focus on a single thing
and um you know is that a short period
of time or can you focus on one task for
days at a time and be really happy
and then there's introversion versus
extroversion and all the area in between
the two how much do you like dealing
with humans all right so some of you are
really outgoing and really like talking
to people and meeting people and some of
you really would like to be a little bit
more isolated in your work
balance is between the two there's
people who like to go out and meet
people and then need time to recharge so
they're they're somewhere on the
introvert site a side of things but
they're a little bit further towards
extrovert so that can really play into
where you're going to be happy as a job
as well
analytical versus creative thinkers
again it's a spectrum you can be a
little bit of both
um but again something to consider
your patience
do you get frustrated easily how about
with people how about with people you're
teaching
how about with things that are not
concrete I run into this a lot in cyber
security people who get tremendously
frustrated because the thing they're
doing in cyber security doesn't have a
concrete conclusion or concrete finding
the answer is fuzzy and some people
really can't take that okay
empathy and emotional intelligence for
both nefarious and good reasons we'll
talk about some of these roles where
that's a really important thing
and it's a useful skill
and it can also be a negative in in some
of these cases as well willingness to
travel and work non-standard hours that
can be considered a negative in a lot of
jobs if you're on the road all the time
in them
you're writing and presenting skills
we'll talk about these a lot it's not
something that makes a lot of the
YouTube Defcon talks
it's just not something that we bring up
a whole bunch however it is a really
huge element of a lot of the job roles
we'll we'll talk about today okay
and finally your reaction to stressful
situations do you like being being up in
front of a big audience and giving a
talk or is that like your idea of a
nightmare I see some of you cringing
right now
I think this is fun I see all my friends
they've got sparkly Badges and things
but some people don't think that's cool
so let's talk about a few of these so-so
models that we can use to to talk about
people so the first one I'm going to
introduce you to is curtin's adapter
innovator model so this model is it
assumes the following it it hypothesizes
the following that everybody ends up on
a spectrum between adapters and
innovators
see your adapters or people who like to
take something that's exists already and
change it to do something new so this is
kind of a hacker mentality sometimes
like find something that does one thing
and make it better or change it to do
something different so that's pretty
cool right but on the other side of this
there's innovators and the innovators
are people who like to kind of throw
things out burn them down and start from
scratch
and I bet if you think about this for a
moment if you work on a team in school
or at work
you run into situations where those two
things butt heads it oftentimes happens
between like technical people creative
people and sales people
or Executives Finance people this is
something that people butt heads on a
lot is whether to fix something that
exists or burn it down and start over
and again this is a spectrum you can be
in the middle of it you can be
comfortable with both that's fine but
that can cause conflicts individually
and as teams
learning styles so we generally talk
about three types of Learners okay and
people usually fall into two one or two
of those categories so first of all
there's visual Learners they like to see
there's they're staring at the screen
right now and they they like to look at
the PowerPoint they like to learn by
looking at things
um auditory Learners they are the ones
who are listening to my words right now
thank you very much auditory Learners I
appreciate that
um and uh that's how they like to learn
they like to listen to podcasts
that's that's useful to them uh they can
listen to like on-demand training and
things like that and really learn from
it finally there's kinesthetic Learners
and I'm I'm I fall into this category
the people who like to do things to
learn them so to learn a new task they
want to Hands-On keyboard do the task
and that's how they learn things that's
how things stick maybe they have to take
notes write things down during a lecture
to actually memorize it so people
usually fall into one or two of those
categories and don't like the third but
that's not everybody
now let's get on to William Marston
Marston created one of the early team
Dynamic models for personalities okay he
also happened to create a comic I like
very much Wonder Woman he had a varied
and obscure career
um and uh it goes like this there's
there's different categories elements
that we divide people into and it ends
up that we end up somewhere on this
cervical circular
um cyclical uh map of personality traits
and types
so let's talk about them really quickly
and I want you to think about where you
might fall in here again this is not
scientific it's not a be all end-all it
might change tomorrow but so we have the
Challenger so the Challenger is very
competitive they are high expectation
person they're a good leader they like
to ask critical questions they like to
get into The Fray and lead the situation
very type a kind of person
you have the winner
Winner Takes things as winning and
losing based on a big picture they like
to make big decisions they like to
invest in the stock market they like to
you know see whether something is
successful or fails they can miss small
details they're not very detail-oriented
in the end what matters to them is did
it work or did it not work the Seeker
their strong leader they're assertive
they're fast-paced and they push
boundaries these are like your startup
CEOs the people who really want to just
launch into things and and uh lead a
project to to successful completion
and there's a risk taker they're really
a gambler an adventurer they like
adrenaline
um they're oftentimes bored in
situations if things are not high
pressure and moving fast and exciting
um
they do have the ability to be very
overconfident about themselves and
sometimes they make bad risk decisions
the enthusiasts so they're extroverted
they're really friendly they're creative
they're artistic they're a great
networker but they're oftentimes not a
really good listener
um so they're your social butterfly in a
group who likes to associate with people
but they're mostly concerned about
number one you know the type okay
the buddy so the Buddy tries to make
everybody happy they're that person who
is really uncomfortable letting somebody
down or telling somebody no or firing
somebody because they want to make
everybody happy all the time
okay the other six the collaborator the
collaborator is the person who walks
into an angry team and tries to get
everybody to get along
so when the team is arguing they act
they act as the marriage counselor
they're the person who
stops the argument and makes people
compromise and and tries to play
Diplomat in business situations they're
very supportive and very outgoing
the Peacekeeper they defuse negative
systems but they're very very calm
they're diplomatic and they're very risk
adverse so conflict to them is a risk
the technician is more introverted so
they're analytical they're highly
rational they're sometimes inflexible
they they're very thorough about
processes and they're very calm so
they're mathematicians things like that
Engineers
um they like to work on calm organized
things
the bedrock's a person who just does
whatever needs to be done on a team you
know whatever needs to get done they
stay in the in the background they don't
get noticed and when things are broken
they fix them and they can be a little
bit too introverted and humble they
don't get credit for a lot of the
projects they do
and there's the analyst they are highly
logical and detail-oriented another like
scientist or mathematician type role
they're a perfectionist and they're very
very focused on single tasks so they can
focus on something for a long time like
a project
and finally we have the perfectionist
the perfectionist is the person that is
me
the other person they can be blunt they
could they question everything when they
come into a project as part of a team
they're like hey this isn't going to
work I can see how this is going to fail
here's how this is going to fail they're
usually the person who's seen as kind of
negative because they take everything
apart and say what's going to break
so again these are just
some ways to look at your personality
maybe you grabbed onto one of these or
two of these and you said that's kind of
my personality I'm just using them as a
tool here I'm not like a True Believer
in any of these models again you can't
put human beings in a box but I'm going
to talk about some cyber security rules
now
I'm going to talk about some things you
might be interested in doing in the
future right and various niches that you
can get into as a cyber security person
both on the blue team and the red team
and to do that
I'm going to use these personality
models and learning styles these these
different personality traits we talked
about to talk about where you might be
happy or unhappy because I'm not going
to just talk about what's really cool in
a job you can go on YouTube and watch a
hundred talks about why pen testic is
neat why you want to break into
buildings and rob banks oh my God you'll
go watch Johnny Christmas's talks holy
cow I mean like yeah it's really really
cool but there is 70 of that work you're
not seeing in the YouTube talks for the
most part and it's the part that people
even people who really love the work
might consider boring and that's an
important aspect to consider when you're
deciding what job to take right what is
the the other 70 of the iceberg that I
don't see in these talks all the time
that people aren't plugging to me that
my teachers aren't trying to sell me an
expensive degree program on
let's talk about them okay
so first of all it's red team blue team
purple thing okay
everybody in cyber security hopefully
trying to improve the defensive
organizations they just do it in
different ways all these niches I'm
going to talk about they're all super
important and they all have an impact on
the defense of an organization and even
if you are a pen test or a red team or
breaking into things or you're doing
exploit or vulnerability research your
end goal should be making people more
secure okay so these divisions they're
kind of in the the realm of work that
you'll be in but in the end everybody
has the same end goal and that's to keep
bad people criminals out of net networks
and keep people's information safe right
so the red team they typically do this
more offensively this is your pen
testers your red teamers your exploit
researchers Etc and they are doing
things more like emulating the criminals
to prevent the criminals from actually
being successful so let's go out and see
how the criminals are doing things and
see how it would work in this
environment so that we can catch it
before it actually happens
the blue team is the Defenders so
they're they're kind of they're doing
the monitoring and the forensics and the
you know system configuration to try to
defend the network
they're all in the end contributing to
the defense of the organization and
that's all really really important they
all have the same goal and they should
all be working together but they're kind
of two different tracks for getting into
cyber security
now let's talk about this purple team
elephant in the room
purple team everybody should have
exposure to both you know you should if
you're a blue team or a dedicated
lifelong blue teamer you should Shadow
some of cement testers sometime and see
how they work you'll learn a lot I
certainly have I've learned a ton from
this it's awesome
and same with the red team you're going
to learn a lot about breaking into
things to see where Defenders screw up
you know it's going to help you so yeah
is an important concept and we should be
working together because we are one team
one fight
however to learn both of those things in
great detail is incredibly difficult nay
impossible
um you really can't again focus on more
than one niche in in huge detail in
great detail there's just too much
information our field is changing all
the time each of our niches is changing
all the time so in the end after we get
out of generalist roles you kind of have
to focus a little bit
um and just some example roles for the
two and again they are working together
they should be doing shadowing and
overlapping but you know your blue team
is kind of you started out as maybe a
sock analyst that's kind of your
entry-level defensive role and you may
you may become something like an
incident responder or a malware reverser
or a security architect you might even
get into threat intelligence if that's
something that interests you
and on your red team side you might
become a junior pen tester as an
entry-level role
um and then move into something like
exploit research or red teaming etc etc
so
there's multiple paths into these but
they kind of are their own skill trees
or career trees something to think about
as we continue
my job is digital forensics and incident
response so let's talk about what I do
so I'm a detective when somebody gets
hacked into
I'm the one who goes out and tries to
figure out
forensically
timeline and a narrative of the
intrusion so what's the story of how
somebody got in and what they did
so really cool right that's that's it's
cool work it's interesting it's engaging
you're trying to catch the adversary
find out what they did and build this
granular detailed timeline and story
about how they got in and what they did
and what impact that has on the
environment
and my sales pitch here is yeah it's
cool you're a detective you are
performing an investigation from zero to
understanding a full detailed picture
that the adversary tried to hide of how
the network was intruded into and what
happened to the devices
so you are you are doing an
investigation in CSI stuff it's pretty
neat
now what's the downside of my job all
right
this is Crisis management work it's
incredibly stressful for the person
calling me in and therefore it's
incredibly stressful for me you usually
I'm walking into these situations where
people are sweating bullets and the
executives are screaming
everybody's having their worst day ever
and what what do people do when they're
already stressed out well they lash out
at you they're angry they swear at you
they don't want to cooperate with you
they question everything you do they
don't trust anybody they're they're in a
bad emotional state when I'm dealing
with them already I don't get to see
them on their best day I see them on
their worst day
um that also means that there's a ton of
sudden travel
um my job can mean having a bag by the
door and being gone on an airplane with
a few hours notice at any given time
even over the holidays
um there's a lot of hurry up and wait
too we I talk about crises but crises
don't necessarily mean I'm doing things
constantly it can mean I have to be in a
plane right away but then I have to sit
there for eight hours because the person
who's who needs to let me into the
building isn't there
and I could just sit there on my laptop
and do nothing and just wait and
everybody's panicking and everybody's
screaming and there's nothing I can do
for eight hours or maybe I have to wait
for evidence to transfer or processor
etc for for several hours so there's a
lot of hurry up and wait in the job and
that can be incredibly stressful when
you're already in a stressful crisis
situation so you have to be able to
manage that level of stress and also
being patient when you can't do anything
sometimes you don't get a satisfying
answer in my job either you're doing
detective work and in the movies and in
TV shows and in the books the detective
always figures out what happened and
they have a clear story and they know
how the person got in and what they did
and it all wraps up neatly with a bow
that's not reality
in some cases so much evidence has been
lost or destroyed that there is no way
to figure out who done it and I have to
walk away I have to say to this level of
confidence this is what I can tell you
and this is what I can't and I have to
be okay with never knowing the answer to
the mystery
um so who might this work well for um
the analysts the perfectionist the risk
taker or the collaborator because we're
in these high stress situations with
people who we have to deal with in their
most stressed out situation
you have to be good under pressure
you have to enjoy a mystery and you also
have to be a good investigator so you
have to be willing to follow the
scientific method and you know take time
to build a detailed evidenced timeline
so that takes time and that takes
attention to detail you also have to
thrive in chaos because you are walking
into crises day in and day out
who may it not be for well the
technician the Peacekeeper and the buddy
you have to make some people unhappy and
you have to deal with a very very
unhappy people if that's uncomfortable
for you if getting swore at and getting
yelled at and having people cry in front
of you makes you miserable this is not
going to be the job for you you have to
walk in with confidence and tell people
what they need to do even if they're
really
if you're uncomfortable in high pressure
crises this is not the job for you if
you're not patient
this is not the job for you
if you're easily frustrated with human
beings this is not the job for you
because again tired people on their
worst day ever who are very angry at
nothing in particular or at the wrong
targets
if you fail to recognize your own biases
you can't do the scientific method ball
and you can't do good investigations
it's not the job for you and if you need
your work-life balance it's probably not
the job for you because you might be
working 48 hours straight on an
investigation without going home
I have some quotes here from people for
you you all to enjoy I ask people to
tell me about the stuff they didn't
enjoy in their work but um here we have
a good one um
uh I sometimes put the differ hat for
serious enough incidents in my company
truth is investigating things back to
the initial access sometimes
is it what the customer wants most times
they want enough to be sure that their
environment is clean to get it back up
and running I absolutely agree with this
so this is uh what I'm talking about
sometimes you don't get a satisfying
answer and that is very frustrating if
you like to investigate things you have
to be willing to live with that
okay let's move along to another fun
role that a lot of people want to do
which is pen testing or red teaming I'm
going to find some things together
just for the sake of time here
so the job simulate an adversary to test
the digital security of organizations
and prevent real life crime
um so my sales pitch here is wow you get
to hack into things that's really cool
that's really fun you are simulating the
people who are committing crimes on the
internet and that means you get to break
into boxes you get to pop boxes you get
to get you know shell on boxes it's
really really cool
um you know you're finding stuff you're
you're no exploiting systems you're
moving from system to system maybe
you've got the domain controller wow wow
that's really fun
let's talk about the mundane stuff okay
your job isn't finally in the in the
first place improving security and
celebrating your own losses this is
something a lot of young pen testers and
red teamers don't get when you lose and
you can't get to the domain controller
that's a good day
that means that you have validated that
the security of this organization is
good against the tactics you used hey
that's awesome you should be happy I see
a lot of people really unhappy about
that because they didn't they didn't get
rude on a box
so they were bad hackers right no that's
not the point the point is to do a good
test of the security and hopefully the
organization doesn't have failed it
um you have to explain to execs and
manager how you got in
so um and also how to prevent it in the
future and you have to do that to
multiple audiences so so execs to
managers to technical people you have to
be explained explaining to them how you
got into these systems
what it means how they can make risk
decisions based on this etc etc so
multiple audiences here you're not just
talking to technical people you might be
talking to a CIO and you have to explain
things in different ways to these
different audiences and you have to be
patient with them and answer their
questions that means a ton of report
writing as well
lots of report writing sometimes my pen
tester buddies estimate 70 of their job
is report writing
to convey this information they found
about the intrusion to the correct
audiences to again improve the security
and sometimes the stuff you find will
not be fixed by the time you come back
again so whether you're working
internally or as a consultant you might
come back to the same organization a
year later and this really huge thing
that you thought was really important
did get fixed for various reasons
so you have to be okay with that you
have to be willing to let it go let it
go let it go
um so who might this work well for well
the winner the analyst the Enthusiast
the perfectionist
the collaborator or the Bedrock so a lot
of different personalities can enjoy
this work either from an analytical
standpoint or a creative challenging
perspective
kinesthetic Learners this is very very
Hands-On
um and uh collaborative Educators people
who like to teach people how to do
better security because that is such a
huge part of your role as a pen tester
or a red teamer it's educating The
Defenders the organization in how to do
better Security based on what you found
so if you enjoy that if you're like hey
I can teach them how to do better
security this might be the job for you
and creative Problem Solver so you have
to be very creative to do this job
because you're trying to move from
system to system move laterally get into
different types of systems so yeah you
need to you need to think on your feet
so that's that's great
who might this not be for will the buddy
or the perfectionist because again
sometimes you're going to have to give
people bad news and sometimes you're
going to have to let it go like I
mentioned because you can't change
things
if you're uncomfortable writing detailed
reports
um this is not the job for you or
presenting those reports to a variety of
audience this is not the job for you
if you have to win rather than help
people this is not the right job for you
okay
um if you have an emotional attachment
to quantifiable success so if you have
to win and the systems have to be fixed
and the security has to get better every
single time you do a pen test you are
going to be sorely disappointed over and
over and over and over again
so you need to be able to detach
yourself from that
you cannot have an emotional investment
in the things that you found in your pen
test from last year being fixed when you
come back the next year it is a growing
curve there's a learning curve here it
takes time for organizations to fix
their security flaws and you are part of
that process you are helping them learn
and build their security over time
I see I've got some good ones up here
um contesting and red teaming your job
is not super cool Hollywood hacker
sometimes the customer will do
everything right and frustrate you at
every turn your job is done to celebrate
their victory
uh well temp uh tempering them against
overconfidence and complacency yeah so
that that was very very well said
um a lot of interesting points here
hacking stuff is mostly worthless in
isolation Improvement comes from leading
the org on a journey I love that as well
again you're thinking about the holistic
picture here of improving cyber security
not just hacking into boxes
threat intelligence all right so the job
investigate and collate intelligent
Intel projects uh products on what
adversaries are doing and how for use in
everything from takedown efforts for
malicious servers to detection
so what's the pitch here
you are investigating adversaries you're
getting ahead of them you're finding out
who they really are and what they do and
how they do things you have gratifying
moments of uncovering elusive
adversaries it's really meaningful work
research that will be seen by people all
over the world potentially or huge cyber
security communities it's really cool
investigative work
now what's the the boring part of this
work well it's very very tedious you're
looking through tons and tons of data
and you're trying to make useful Intel
products out of it
so you're doing tons of data compilation
as well
so you must have a very strong sense of
perseverance and be very very very
patient
you're not always once again going to
get a conclusive answer and again you
have to be willing to let that go if you
don't get a satisfying answer about what
the adversary is doing or who they are
you might just not have the data
available to you to make that
determination
um everybody's going to want attribution
too to like a country and you will often
not be able to provide that and in a lot
of cases it's not wise for you to try to
provide that so you will have to tell
people no to that type of thing a lot
even though you might have a good guess
so uh cyber Intel might work well for
the technician the Bedrock the
Enthusiast during the analysts it works
really well for innovators you have to
be very creative you have to go out
there and put things together from zero
to try to understand what adversaries
are doing
you have to be very creative you need to
be able to think outside of the box
you have to be willing to recognize your
personal biases because you're doing
again a scientific investigation
and it works well for visual or auditory
Learners you're reading tons of stuff
and potentially listening to tons of
stuff as well
um you're going through lots and lots of
data and good technical writers this is
an amazing place for you because there
is so much technical writing that goes
into creating these Intel products
who may it not be for so the winner the
Seeker or the risk taker this is arduous
painstaking time consuming work you have
to be incredibly patient and you're not
always going to get a satisfying
conclusion
you aren't necessarily going to get a
clear-cut answer
and if you don't like to write or
present it's just pretty much a no-go
because you are going to be writing so
much in Intel in general various types
of products and reports
if you're I am patient with doing
repetitive analytical work it's not
going to be the place for you either
you're doing again tons of data handling
and you can't be the kind of person who
is unhappy being wrong because you are
eventually sometimes going to be wrong
about things
um another good statement here um Alan
says not every threat and threat
intelligence leads somewhere you may
spread you may spend a few days tracking
an indicator doing weird things only to
find out it's connected to a marketing
tool that's been authorized and vetted
so there's leads that go nowhere and
it's very tedious work but it's very
very valuable and it's very important
work for what everybody else does in
cyber security
okay let's move on to security
architecture engineer to the job design
and Lead implementation of secure
networks and security product
deployments so what's cool here well
you're the one building the security
architecture you're the one installing
the tools you're the one giving people
the ability to Monitor and to do
incident response and to do forensics on
the network you're also building the
defenses for the network potentially so
putting in firewalls putting in
intrusion prevention EDR Etc so it's
hugely impactful work
um it is also a relatively nine to five
job so I talked about an incident
response there's not a lot of great
work-life balance there this is a job
with great work-life balance you get to
go home at the end of the day for the
most part unless you get called out on
some kind of emergency like this is a
normal working office job
so what's the downside of this job
um the basics are
systems work together you have to
understand how to make them do what they
need to do and tune them appropriately
um they're not widely implemented Basics
either so you'll go into a lot of new
environments and find out that the
fundamentals aren't done and have to
start from scratch
the products you buy or where you put
them you might get overruled by
Executives or other other leaders in
your organization or your engineering
team
and it's really kind of a thankless job
too when things are not broken and they
are working as design people don't
notice your existence you know it's just
kind of one of those roles like a lot of
engineering roles where people don't
notice you exist until something goes
catastrophically wrong and then they
yell at you
so who might this work well for well the
analysts the Bedrock or the technician
for those reasons I've described it's
it's uh you know kind of a routine job
where there's not a lot of notice
adapters so you've got to work with
what's there right so if you're more
comfortable adapting existing networks
and systems to do what they need to do
um this might be a great role for you
because you have to think creatively
about how to improve security
if you value long-term success in growth
if you can think about things in terms
of years
um that's that's wonderful
um
I like enabling colleagues again this is
a thing with job so if you like making
people able to do security better even
if they're not singing your Praises
every day that's a great role for you
you are doing really important
meaningful work even if you don't get a
bunch of recognition
good tool development develop scriptures
if you like to build stuff this is a
great role as well
so who might it not be
well the risk taker The Challenger this
is this is uh you know just not a job
where you're going to get a lot of
recognition and you're going to feel
like you've accomplished something every
day you have to be able to think long
term about your success and be patient
with it
um innovators you're not necessarily
going to get to burn down your network
and start from scratch
um if you hate scripting it may not be
the job for you either because you're
going to have to adapt a lot of tools to
do new things you configure your tools
get them working right you're going to
spend a lot of time at the command line
if you dislike gradual change if you're
inpatient with people like users it's
going to be frustrating work
and if you need to be in control of
everything well I got news for you
you're not again not necessarily going
to be the final decision maker on
everything
oh boy what do we have here I work at
cyber security architecture part of my
job is to help teams design Secure
Solutions but too much of the time it
seems to boil down to this conversation
don't be stupid I said don't be stupid
look don't be stupid why were you stupid
of course I don't actually get to say
that
yeah pretty much sorry malware reversing
all right do I have any malware
reversers out there
I got like two oh good okay well I'm
gonna tell you about it all right so the
job you take viruses malware apart to
see what they do so you disassemble them
you investigate them and you understand
their capacity perhaps who made them how
they made them and better ways to detect
them
um the pitch here is wow you get to
learn all about malware you get to it's
a puzzle you get to figure it out figure
out how malware strains are related to
one another and what their capacity is
whether there's something new out there
um perhaps out with the authors get
detections and prevention mother's
measures out there before the
adversaries are able to do something
so what's the mundane here well you have
to know a lot about computer science and
computer engineering
um that means like assembly a lot of
reverse engineering involves reversing
things in Assembly Language
um and a lot of people do not enjoy
doing that
so you're going to constantly need to
learn new coding new programming
languages things like that to keep up
with modern malware
report writing skills once again we come
back to these you need to be able to
report on all this malware you research
and you need to make this stuff this
really technical computer stuff
comprehensible for dumb incident
responders like me so that we can
understand what the malware does so you
need to be able to again write reports
for multiple audiences and you need a
lot of focus because you could be
staring at the same malware piece of
malware for days weeks maybe even months
if it's something really noteworthy and
it has a hugely steep learning curve
like you have to do all this computer
engineering or computer science stuff
you have to understand about how people
build malware you have to understand how
to take it apart and you have to keep
this knowledge up to date so big
learning curve there that's why they get
paid the big bucks and they do get paid
the big bucks there's limited training
out there too I'm relatively compared to
other initials in cyber security
so who might malware reversing work well
for well the Bedrock the analyst or the
technician you need that patience
analytical mind
you need to think about new ways to take
malware apart all the time
you need to be very patient you need to
have good methodology
um you need to be a creative Problem
Solver as well because you're going to
be dealing with people who try to
confuse you and you know break your
decompilers
um during your reverse engineering they
the the malware authors know you're
there and they're going to try to make
your life hell they're going to write
their code in confusing ways and they're
going to try to outwit you because they
know you're going to try to take apart
their malware so you're going to need to
like an intellectual challenge because
everything's going to be a puzzle and
you're going to be thwarted
and you need strong computer science
skills once again you need to know a lot
about
pewter's work and how pointers work how
assembly works
so who might it not be for well the
Seeker or the Enthusiast no quick wins
here
visual Learners because again you
there's not a lot out there in terms of
educational materials and you're going
to be reading a lot of code in a lot of
books if you're impatient or you're
easily frustrated this is not the role
to get into if you don't like lots of
code or particularly purposefully messy
code this is not the job role for you
and if you don't like to write detailed
reports about what you found that again
dumb incident responders like me can
understand not the job for you
here's one
you're gonna you're gonna write you're
gonna write a lot you may believe
writing is not why you got into this but
to be effective you need to do it well
all the work you do is worthless if you
can't effectively convey that work into
actionable writing wow and then somebody
else commented James commented add two
additional hours to whatever reversing
you're planning two additional hours to
the reversing work you do that day oh
vulnerability management so this is one
that a lot of people think sounds boring
but it's actually really really
important so discover a document and
manage patching or exceptions for
vulnerable systems across the Enterprise
pitch here discover the reality of a
network what's really really going on
there okay
um take that network from Zero to Hero
this is a nine to five job again this is
something you can do with work-life
balance you're the one planning for
patching systems understanding what's
vulnerable in your environment etc etc
the mundane the fundamentals of cyber
security often don't exist at all and
sometimes there's reasons they can't
exist in your environment sometimes you
don't have good asset inventory so you
don't know where the vulnerable systems
are so this job requires tenacity
empathy and patience
who made it work well for the
collaborator the Peacekeeper or the
technician you have to work with people
here you have to be cooperative and you
have to be patient
analytical and organized people adopters
people who valid value projectize
Improvement and value work-life balance
who's it not for the winner the risk
taker Enthusiast this is again kind of a
thankless job and it requires a lot of
patience in working with people
it's not a great job for innovators
you're trying to fix things
it's not good if you're inflexible and
it's not good if you're impatient in
general
and if you're easily frustrated with
people not doing what you want or what
you hope for you're gonna be really
really unhappy
so here are what we got um vulnerability
management the worst time is the worst
part is trying to find ownership on
systems that don't show up in the asset
inventory
usually maintenance interfaces trying to
sort out who maintains what
through load balancers is a hoot too
yeah there's a lot of frustration on
this one
um
all right governance risk and compliance
another important job that people think
about a lot so quantify risk and guide
decision making in your organization
around cyber security risk and
the policy
so the decision maker for what you spend
on cyber security and where you put it
and what people you get and how you
train them and what risks you're willing
to accept is an organization and if
you're in compliance with various
standards
and this is important you get to be a
key decision maker to ensure the company
makes the best security decisions
possible you're doing a really important
thing and it's once again got work-life
balance this is nine to five work
what's the boring part well you're
reading a whole bunch of compliance
stuff and regulations and they can be
Arcane I mean read like PCI stuff oh my
God and the other really negative part
here is orbs will think they're secure
because they check the box and you're
like no no you're not secure it's not
PCI doesn't cut it and they don't care
because they check the box and their
lawyers are happy and their insurers are
happy you have to deal with lots of
contracts and you'll have to deal with
lots of politics and be a good
politician to get what you need
it might work well for the Challenger
the collaborator the Peacekeeper or the
Bedrock it's great for adapters it's
great for people focused people if
you're a people person this might be an
amazing role for you because you're good
at negotiating
creative problem solvers absolutely work
with the budgets you've got and valuing
work-life balance who's it maybe not for
the risk taker The Seeker the buddy or
the perfectionist this is a thankless
job it's a Cooperative job and it
requires patience and ability to work
with people innovators inflexible people
people who get impatient with people or
processes people were uncomfortable
making hard calls
when we got here
holy crap I forgot about contract
negotiations I think that's more of a
GRC thing thankfully that's not
that's my regular job I've asked people
on a call before can you just come to my
house and shoot me down please
I understand
yeah contract negotiations
yeah that's part of DRC sorry guys at
second product security the job
see you are the bridge between the
people who make things widgets products
software and cyber security that's
really really really important we can
all agree that having password zero zero
dot on everything that we buy is kind of
not great but it happens
and you could be that person who finally
makes all those smart home devices this
internet of things things or the
software you buy actually secure that's
awesome that's a huge project for the
entire world right now
all right so what's the downside here
well first of all budgets are King in a
lot of these environments and that
relationship between the developers or
the engineers and cyber security can be
super hostile so this requires a
delicate touch and a good negotiator
everything involves creating and
tracking documentation as well because
you're part of the Engineering Process
so it might work well for the
Peacekeeper the Buddy the collaborator
um adapters as well because you're again
trying to work with an existing thing
and make it better good diplomats and
negotiators
and people who have a strong
understanding of product development
life cycles whether that's building
physical Widgets or software development
it might not be for the risk taker the
winner of the perfectionist
might not be for innovators might that
be for anybody who's a poor people
person
people who are not okay with compromise
you will need to make a lot of
compromises in this role and if you're
uncomfortable negotiating this is not
going to be the role for you you need to
do a lot of negotiating to get the
security you can the best security you
can for the budget implemented in this
software or the widgets Etc
all right
roll product security or appsec boring
part chasing tickets you generate work
that another team needs to do to
increase our security and reduce risk in
a ticket but then you actually have to
track that ticket and make sure they
actually do it multiply that one ticket
by a hundred or so
okay
physical pen testing oh this is this is
a sexy job everybody wanted to hear
about everybody's like yeah I heard all
these cool stories about physical pen
testing oh my God these are the people
who break into buildings they get to rob
banks so they test the security of an
organization by physically intruding
into their facilities to conduct to
conduct objectives whether that's
getting into a computer system or just
getting into the building
the pitch is easy here guys you get to
break into buildings oh my God you get
to sneak your way in you get to be a
ninja you get to pick locks you get to
crack safes oh my God
okay let's talk about the boring part of
this really really sexy cool job okay
um first of all you can potentially get
somebody fired in this job very very
easily if you social engineer somebody
to let you into the building and they're
not supposed to you're going to put
their name on the report that's just how
it works and they might get fired
unfairly because of that and then that's
going to be
I mean it's not on you it's not your
decision in the end but you may feel
like it is your decision in the end you
may feel responsible for that
emotionally
um there are still a ton of report
writing again that's 70 of the the job
is report writing
you don't succeed unless you're helping
improve security so just breaking in
doesn't cut it again your job is to make
the security of the organization better
and if you're failing at conveying
change and improving security as a
result of what you've done you are
failing so you need those good report
writing skills and the ability to teach
and convey information
it's not as glamorous as you think and I
cut some good quotes on this one about
how unglamorous it can actually be
sitting outside in the Sun or the rain
trying to get into a building and
there's a high likelihood you're going
to end up in jail
temporarily yes you'll have your get out
of jail pre-card but in reality people
are going to take you to jail before
they start looking for paperwork so you
can definitely and it's happened there's
been some high profile cases in the news
um where people spent substantial
amounts of time in jail as pen testers
who were completely authorized breaking
into buildings so it might work well for
the risk taker The Seeker the Enthusiast
or the perfectionist it's a great job
for innovators can aesthetic Learners
you're always Hands-On you're cracking
safes you're breaking into locks things
like that good social Engineers this is
the job for you man you're going to get
to talk your way into buildings if
you're you're a good used car salesman
this is a job for you strong physical
security skills you've got to be able to
break into stuff and understand how
locks work and understand how doors work
and things like that it might not be for
people like the Buddy the collaborator
the Peacekeeper or the bed rack you
gotta trick people and you can get them
in a a lot of trouble you've got to be
comfortable lying to people you've got
to be comfortable manipulating people
and for a good cause too it's not going
to be a good job if you're impatient
you're going to have to do a lot of
waiting to get into buildings or to get
what you need out of an organization
poor presenters or report writers again
you are not going to accomplish anything
if you're uncomfortable manipulating
people if you're uncomfortable getting
caught and having to face some temporary
consequences if you're uncomfortable
being uncomfortable got these quotes
I've got so many of them from these
people
uh-huh
um sitting outside in the in the rain in
anorak Waiting desperately for a
particular client with a weak signal in
a server room somewhere to connect to
the corporate Wi-Fi trying to look
inconspicuous for half a day that sounds
horrible that sounds awful
um I always thought this job was really
sexy and then I got to read all these
quotes about being stuck in the sun and
the rain and waiting for people and not
being able to pee in things because
they're waiting for their opportunity to
get into a building and you don't see
that part in the movies they don't show
the part where they they don't they
can't go pee for four hours because
they're trying to follow somebody
they're trying to shoulder steer
somebody
um
finally exploit bug and vulnerability
research so the job is research things
to find means for exploitation disclose
with the vendor and security firms so
you are the rock star who uncovers
meaningful bugs and how they can be
exploited hopefully ahead of the
adversaries it can be very well paid and
it can also be self-employed self-paced
what's the downside of this work bug
hunting exploit research vulnerability
research while there's lots of writing
because you have to the only way you're
going to get paid is if you write up
these bugs in vulnerabilities well at
least the very meaningful ones
sometimes you'll be ignored some people
sometimes people won't listen to you
sometimes you'll be scooped by another
researcher and they'll get the Bounty or
the glory and not you and it's not
glamorous for the majority there's a ton
of people who do this and only a small
number relatively are incredibly famous
and successful
it might work well for the winner the
Seeker the analysts or the perfectionist
you have to work hard you have to be
willing to take risks you have to be
willing to persevere
um Visual and kinesthetic Learners
um you have to be flexible you have to
have strong research and computer
science skills both of those so you have
to both be able to investigate things
having to do with computers and
understand at a very rudimentary level
and very fundamental level how computers
are engineered and how they work
it might not be for the Peacekeeper or
the technician because this is not
necessarily study work it's not
necessarily always Glory based work and
if you don't like writing detailed
reports it won't be a happy job for you
if you're overly invested in visible
success you might be going into this job
for the wrong reasons because again the
vast majority of people in these roles
are not the big names that you see
producing the really really famous stuff
a lot of people work for years at bug
bounty hunting and just make a basic
living on it they're not making millions
if you want Study work and income
especially like the the self-employed
work here is not necessarily reliable
you have to be bold and you have to be
working hard
um so Reed says embedded system security
testing hot doing the bug hunting not
writing the report the first part
definitely requires creative thinking
and rapidly or wildly testing theories
the second requires thoroughness and
attention to detail they're very
different brains you have to have both
of those things to succeed in that area
so in summary
I Leslie cannot Auntie Leslie cannot
tell you for sure what job you'll enjoy
I can't tell you what personality type
you are I could give you some clues
about what you might not like and what
sounds interesting I tried to give you a
little bit more of the negative because
there's you could go out on YouTube and
watch a hundred security talks about any
one of these niches and see how cool
they are but I wanted to give you a
little bit of the stuff we don't see in
those talks so you can make a better
decision
what I can suggest now is go explore
find out more about the fields that
stood out to you today watch talks about
them try to Shadow those job roles I
think that you will find a niche that
you enjoy if you take the time to really
explore these and figure out what's
going to work for you
if you want to reach out to me
um I'm hacks for pancakes on all the
various social things feel free to reach
out I'm happy to chat with people as my
schedule allows I also have a public
Gmail a text for pancakes at gmail.com
shoot me an email I'm happy to talk I
have a website with a bunch of blogs on
it that you might find useful it's
called to symphony.net and I run a
conference uh it's a virtual conference
every year called pancakes con our talks
are up on YouTube
uh stop by career Village and see me
while you're here I am doing
interviews and resume reviews uh
hopefully some of you find that useful
it was a pleasure to speak with you all
any questions
no questions
two Applause
[Applause]
foreign