[Music]
we do some furniture rearranging here uh
this is the talk on um getting the best
steal on life insurance so we're here to
tell you all about the strategies to
make sure that you have the best whole
life you can possibly be
just uh just kidding no uh this is the
panel talk um I'm I'm the moderator
Chris King from Mutual um we're just
going to be talking really about a day
in the life of cyber secur professional
um we're not going to S Insurance we're
not going anything like that but really
have these uh F individuals here from NM
that are um some of our uh best Cy
professionals that we have they're going
to share their experiences um share kind
of their day-to-day uh and what they
work on um their challenges and uh also
um any sort of insight that they have as
they throw in their careers um at n so
uh without further Ado I have Chris
Becka here um I have Rachel Murray and I
have uh Chester LeBron all part of the
NM team so we're going to go through
kind of a question answer for a couple
questions and then open it to the
audience try and keep it pretty
interactive all right let's get started
so for the first question um so we'll
start with You Chris and then we'll kind
of move move along
uh what is your role and what does your
day-to-day look like from your
perspective uh sure so Chris Becket I am
a uh lead cyber threat Hunter at NM so I
kind of spend my time in the middle of
you know detection engineering uh threat
intelligence and in response team so get
to dabble in all that it's all really
awesome um dayto day though you know you
know I think I spend a lot of time doing
like open source you know keeping an eye
on Twitter getting a pulse on what's
going on
um and trying to find a way to work with
thre Intel folks to fun that to our
detection Engineering Group incident
responders making sure we're You Know
cover for all the right
[Music]
thing hi everyone my name is Rachel
Murray and I am on our Insider risk and
digital friend six team at Northwestern
Mutual um so a day in my life you can be
a little bit different every day um but
I'm primarily focused on our uh data
loss prevention so making sure dat that
is proprietary to Northwestern Mutual
remains internal um I also am involved
with um some of our security assessment
so making sure all of our tooling that
we're using um whether it be open source
or paid is going through the proper
security channels um and I also help
with Insider investigation so in a case
that an investigation pops up with
someone internal um our team will get
engaged so my name is cheser LeBron I am
a lead on our threat detection response
team work very closely with Chris um
also sit right next to Rachel so um I'm
really on the response side but I do
kind of both so detection building and
obviously my day-to-day is a lot of um
responding to alerts and you know
reviewing detections and following up on
any leads um some of the more fun things
to do is is building detection so in the
last few years I've kind of focused on
uh Cloud threat detection and response
and trying to build that out um it's
been a very interesting Journey um
probably can touch on it later but it's
kind of one of those tests on the
shoulder type of thing knew nothing
about cloud and uh since then kind of
changed the trajectory of my career
so just going back to the day-to-day
question is there anything that changes
like is is every day the same is it kind
of the same same thing that happens or
are there things that change that make
each day a little more exciting anyone
yeah so I think there's a lot of um
constants um so like reviewing
detections for example or alerts that's
pretty constant um but the thing that is
different is that always leads down you
know very different paths right like you
may be following up on you know fishing
emails that might lead to um you know
typical credential fishes but then it
might lead into like well this link
leads to M then what type of M then like
you start pulling on these threads and
um just hope that nothing Falls right on
top of you without you being able to
step step aside and actually see what
what is happening U so like there's some
constant things that that happen every
day but I would say like every day
usually has some different uh twist and
you end up learning something new like I
I haven't had too many days where I was
like well I did that exact same thing
that very exact same thing like
yesterday or the day before that there's
always something new that you uh that
you end up learning and you kind of have
have to uh to stay on top of
things I would also agree that every
single day can be a little bit different
when I took this role the first thing my
boss said to me was some days we're
going to be cleaning the fire truck
other days we're going to be dealing
with Farm fire so just kind of keeping
that mindset in place um knowing that
every investigation is going to be
slightly different um kind of is one of
the most exciting things about the
role
so obviously go day-to-day and sort of
like the cool stuff that you're
passionate about that you you want to do
can you can you share a little bit of
like what you think is the coolest stuff
that your team is working on that you're
working on um and then along those lines
you know what what do you think helps
lead to your team success
overall sure so I think I'm really
fortunate in my role that I get to take
a step back and look at the bigger
picture sometimes so I'm I'm really all
about you know doing the threat research
and trying to find the the the fastest
uh cheapest and most efficient way is to
make like a real impact so keeping an
eye on like you know the threat
landscape uh perfect examples like
initial access so the past year has been
like a lot of trend towards moving
towards archive files link files to get
to networks so quickly trying to like
build detections for that or like hey
can we just like not let uh ISO and IMG
files you know open with an archive
utility right could just break that
effectively for our users so you know
really really free inexpensive change
with tremendous impact love doing that
kind of stuff um I love keeping an eye
on the threat actors and trying to do
like choke point analysis right so like
where do they all fall back what's the
weak spot and what can we do internally
how can I work with you know the
appropriate teams to to get that
address um so things that lead to Our
Success I think it's you know ultimately
relationships internally um I'm not
going to have the knowledge to do all of
it and you know having key contact in
the right areas of the business really
goes a long way um other stuff I'm
worried about or I'm interested in that
I think you know is is really kind of
gamechanging for us is our detection
engineering team is working on a
detection is code effort which I think
is awesome uh it's really helping us
build this this resilient detection
engineering function where we can you
know validate code changes uh so that
one person isn't making you know a
change in a vacuum right it's got
multiple eyes on it you know peer
approval we get to lint it we get to
make sure that the search is efficient
and things like that I think that's
really really awesome
I think for one uh for us kind of like
Chris had said um one of the things that
makes our team so successful I think is
our communication um each individual on
our team does something slightly
different right so we're all working on
our um different areas and we all have
our different specializations but we're
constantly communicating whether it's
sending someone a quick slack message to
see what they're working on and kind of
sharing investigations or things that
are going on um just so everyone on the
team can learn regardless of that if
that is your specialty so I think that's
something that really helps us in the
day-to- day um in terms of cool things
that we are working on um it kind of
depends on the day right so something
might come up that's really exciting and
cool um we're also working on ways to
automate more things so um in um in
terms of detecting things as Chris had
mentioned we partner a lot with both
Chris and Chester's team on some of
those things um we're also from a
digital forensic side looking at
different ways to bring in more open
source tools um that can be used in um
specific portions of our investigations
um to help kind of get more granular um
so that's kind of some of the stuff
we're working
on uh one of the things that we're
working on uh which is across a few
teams is risk-based alerting so uh the
concept of uh applying risk to
individual detections and um maybe
there's a few things um like Risk
objects what they're called so maybe you
want to apply risk to the IP maybe you
want to apply it to the host name um so
on and so forth and then like once you
like build out a framework which
obviously means you have to have you
know normalized data um but like once
you build out that framework now you're
not just saying like well this one
detection um popped and now like we need
to care but like there's multiple things
that happen and you start being able to
track that across you know different so
maybe like a few hours 24 hours a week
or 2 weeks um so it it enables that type
of uh alerting so now you're you're not
just saying like this one thing happened
like oh we had execution for I don't
know you know po shell or whatever now
you're saying like these sets of things
happen and now you have context to
provide to somebody that's reviewing
that and then they can like pull on
different uh threads with more context
cuz in our role like you're trying to
make the best decision as fast as
possible but like as accurately as
possible and the more information and
context that you have around that the
better um so that's a really huge effort
that has a lot of moving pieces um uh
that is really awesome going back to the
other question uh what would make your
team successful I mean I think all of us
probably feel this way um everybody's
really helpful so like if you know we
there's multiple things happening and
you know you can't handle something like
you can ask for help right like
everybody's going to be really helpful
um which also allows for like cross
training and things like that and then
just having good leadership I think is
is critical like the trust aspect of it
like it'd be pretty hard to do what
you're what you need to do without like
knowing that you're empowered by your
leadership uh so I think that's a a
really huge piece to make your team
successful and for for those wondering
about risk based learning uh there is a
blond post for like 2019 or something um
that that's blunted ey but they're not
the only company as others that they're
off doing similar type things so if
you're interested just take take a
Google on
that uh so for our next question uh so
we kind of talked about the cool things
we working on we kind of talked about
the D Day a little bit what about the
challenges what are the things that that
you're seeing that um uh are are
interesting from the perspective of of
the adversary so whether it's a
interesting Insider tactics or um cyber
threats that we're seeing on a
day-to-day basis like what can you share
that um generally speaking um that um
might be of interest to to the
audience yeah I think from an adversary
perspective I think there's a lot of
like I think interesting and I dare to
say cool trends that obviously I think
are worth keeping an eye on so um Chris
Merkel did a talk last night on MFA
Vision I think it's fascinating just
like the way that they are weaponizing
the stuff so quickly and and frankly how
inexpensive it is like the the the B to
entry and this stuff is just absolutely
ridiculous at this point so I think
that's really cool um I talked a little
bit about the initial access stuff I I I
love just like sitting on Twitter and
watching things change by the hour and
all the things that they try like
they're just throwing the stuff at the
wall and seeing what sticks and what
doesn't I just think it's it's really
cool to see them like slowly like adapt
like one group will try something and
then a couple others will follow and
we'll Shi to something else the next
week right so keep an eye on how fastly
that stuff changes is kind of the big
challenge for me but um I to solve it I
think it's a data problem ultimately
right like detections that work well for
some Works might not work well for
others so trying to find things that
work at scale I think is is the fun part
for
me I think from an Insider perspective
some of the trends that we're seeing
especially um you know in with our
industry partners and even in kind of
mainstream media um some of the things
we're seeing are um different indiv
idual now with us being essentially a
lot of companies are working from home
right we've transitioned from in person
to more remote environments which bring
on a different set of challenges right
so um a lot of companies are sharing um
and we've even had articles from
companies like fortune or US News um
about um insiders essentially being over
employed are working multiple jobs um so
as we see those Trends across the
industry gives kind of a good place to
start looking um and seeing how they're
kind of pivoting with this new
environment that we're in so I find that
very cool um and I'm sure we'll see it
evolve as as time comes especially since
this is a new direction that we're
headed so I'm going to give like the
least sexiest answer um but is it's
always been a challenge is like Asset
Management just knowing like sometimes
you don't have uh a lot of information
to go off of like maybe um maybe you
just have like a lead that you have like
an IP and some weird stuff that happen
right like knowing like what that IP is
attributed to is sounds great sounds
easy and it should be easy but the
reality is is is not um so like that's
always especially when you get into
cloud like this a whole another thing
but it's a really hard thing to um to
get right and to do it consistently cuz
things change all the time right um
service go up and down right so like I
think that especially on detection side
like when you want to build detections
that um aren't super high fall false
positive or like just contributing noise
right um having that data up front is is
very helpful um but it's doing it at
scale especially depending on the size
of your company if you're dealing with
you know a few hundred machine servers
and that's probably not as difficult but
then once you scale it out 10 100 fold
is very difficult so um I think that's a
a huge huge challenge but it you're
doing it right like it it reaps the
benefits like you know 100 fold
[Music]
right so for uh for the not quite the
last question almost last um what skills
you know so we talked about all these
other things you're doing dayto day but
you had to build these skills over time
um what do you think are are are the
most important skills for someone in in
your role um and you know how did you
how did you build that skill set
sure so I guess for me it's just being
inquisitive like knowing like being
annoy that you don't know how something
works and like the drive to like really
really in depth understand something
like something I think really goes a
long way not taking things at face value
really trying to you know go deeper um
and also say just communication skills
in general that that'll take you along
way um being able to have like
conversations with with you know not
only like your and users but leadership
being able to convey a message in a a
reasonable fashion I think is uh you
know is is often understated I think the
technical skills can be taught uh but I
think it can be much much more difficult
to teach that stuff on like later
on yeah I don't I would also agree with
that I think the communication portion
is extremely critical especially it
doesn't really matter what kind of role
you're doing in cyber security you're
always going to have to either
communicate out an issue or talk talk to
another individual um and going off of
what Chris said too I think um yes you
can learn those technical skills but I
think you also have to be willing to ask
questions and be able to acknowledge
when you don't know something I know
joining you know a new role or a new
field is always a little bit
intimidating to be able to raise your
hand and say I don't know something so
being willing to jump in there ask the
question it's going to help you
immensely and I think for technical
skills it it honestly really depends
what you want to do too like there are
so many aspects of cyber security I
think that there's a spot for everyone
so it's just kind of figuring out where
in cyber security you want to be um and
kind of you know tuning that skill set
based on what you're interested
in communication is a great one um but
since you guys said it I won't take that
one I would say you know thyself um if
you don't know the way you learn best
then you're going to have a hard time in
this particular field picking things up
quickly and what I mean by that is do
you learn by verbal communication right
like somebody tells you something and
once and you're good um if so you're in
the right field cuz you'll be able to
get in and out of meetings like and
learn things really quick by someone
talking to you if that's not it like do
you learn by doing right do you learn by
watching like if you understand like how
you learn then you can access maximize
um you know all the things that you will
end up having to learn on day in and day
out and then picking up new things like
you'll just do it faster um so that was
something that I think I had to learn in
college didn't really care so much in
high school unfortunately but like once
I got to college I was like crap this is
a lot faster just way more content to
like had to have some self-reflection so
like I thought that was really
beneficial uh a beneficial skill or
awareness skill that I picked up the
other thing uh I would say is it's not
necessarily skill but like going back to
Passion um I would not have gotten hired
if it was on Raw skill like in technical
skill I know I know that um but having a
Passion um to learn is really something
that we look forward um and it it you
can see it right like people light up
genuinely right with their eyes and like
their facial expression by language when
they're talking about something that
they're passionate about right for for
me it be Sports cyber security um don't
tell my wife uh but like people light up
right and it's really easy to see that
especially like when you're doing an
interview or you know whatever you're
just talking to somebody so like that
passion is something you can't really
teach you either have a passion for
something or you don't um but it does go
a long way
so and just the last question before we
we go to the audience um what do you
think the future of of cyber security is
what you know should I mention GPT is AI
got take our jobs um what do you guys
[Music]
think you know I I think it would be
silly to not embrace it you know I I
would encourage people to start thinking
about how that can help you do your job
better than worry about being replaced I
mean like like simple stuff like the
other day I had to write reex for me
that we talked about um you know script
diation has been something I had good
luck with you know having start the
shell of a script for me just just
really stupid stuff that saves me five
or 10 minutes is has been really awesome
emails
emails yeah I mean yeah I'm sure all of
you have seen the the demo videos
Microsoft put out recently right on on
the office Integrations and and the co-
pilot stuff I think that just incredible
um you know I guess my one fear is that
you know we're want to make sure that
people like know how to do this without
the fancy AI tools I think we kind of
fell under that rout with some of the
EDR products as well so like you know
knowing how how to do this kind of stuff
without that I I think it's going to be
be crucial in the end but I I can't say
I'm I'm really worried about AI taking
my job
anytime one thing I will say since you
brought up emails is yes chat GPT can
help but I think it stresses the
importance of writing in this career too
you're either writing reports you're
writing you know Communications to
people and just making sure you're kind
of tuning those writing skills um is
definitely helpful now in terms of chat
GPT I think you have to kind of take it
with a grade of Sal and with reason
behind it um you can't just you know
jump in there fully I don't I agree with
you I don't think it's going to take our
jobs but I think it will definitely help
us um but kind of going in and you know
answering asking the questions
personally I've asked questions and kind
of played around with how I'm wording it
and it's just I think right now it's
just a fun tool to play with and we're
all of learning
together so I definitely think we should
embrace AI um one thing I will say going
back to your other point though about
knowing your tools I think we're
probably going to have like a fork in
the road at some point cuz like there's
more like you know SAS eyes all this
stuff coming out um and we're either
going to have a lot of people that just
like oh I use this tool and like have no
idea like what's really going on um or
or maybe people hopefully take take take
this advice and like try to understand
like what's really happening on the back
end and um you know what API are
actually being called so on and so forth
um because I find it that like the more
that we Embrace this stuff the less the
people actually know what's going on so
that is a little bit scary cuz to me
we're just going to end up with more
misconfigurations and stuff like that
cuz um we see that a lot and that's
often what leads to uh the be word
breaches so like uh I think there's
going to be a Divergence um so I say
that to say understand your tools know
how to use them things are going to
break know how to fix them um and I
think I think we'll be all right I I'm
not worried about our jobs anytime
soon awesome thank you for the the
Fantastic answers and uh I think sharing
with everyone here your experiences uh
so I want to offer out we have a couple
minutes but they said not kicking us out
so if anyone in the audience has
questions for for any of these folks um
feel free to yell them out now uh
otherwise you know we can uh stay a
little bit after and have one to one
questions if if you prefer so um
[Music]
anyone don't be afraid
now yeah so you touch a misconfiguration
and how that um continuously going back
to re word so how do you tackle
it that's a good question um there's
vendors now that can help with that um I
I think that goes back to like knowing
your tools like um there was another
talk that we just got out out of not
long ago downstairs I think it was a
cloud Ops red team and they're talking
about like using the goey to like set
things up right and a lot of those are
kind of building in default
configurations that are good um so like
if you understand like what's actually
happening happening then you can like
stop those things as you are deploying
it and if you move a step back and you
like start building infrastructure as
code for example then you can just
programmatically have those things
happen so I think that's ultimately
going to be the the answer is you know
if you're not already doing uh deploying
uh your code is infrastructure or sorry
other way around deploying your
infrastructure as code then you can just
build those best practices in right away
versus and then like make it'd be make
very easy to understand like when
somebody's deviating from that pattern
so I think that's probably the best way
to go about it um if you don't want to
do that then I guess you can certainly
go with vendors or pay somebody to do
that um but I think that's the best
way any other questions yep in the back
what are your favorite resources for uh
keeping up with the latest things that
are happening in the
industry RP
um Twitter used to be really great um I
still use it U depending on uh who who's
tweeting but uh there's podcast there's
a ton of podcasts out there um uh blogs
you know s there's point to me like Red
Canary like the threat reports um are
still pretty good
um those are probably the ones that I
well RSS feeds um stuff like that is
pretty much how I'm keeping up um
talking with people who are much smarter
than me uh those are pretty much my
day-to-day things
[Music]
now I was just going to say I agree with
you a lot of my stuff I look at comes
from s whether it's through you know
their articles that they provide or
through their webinars um I also focus a
lot on like learning new tools so a lot
of my stuff will be Focus so I will
watch some videos from vendors um or
sign up for their webinars or training
but I think to your point just talking
to the people around you I think it's
really interesting for me to talk to
someone who does something completely
different so that I can kind of learn
how their space connects with mine so a
little bit of
everything uh yeah I'm really big into
Twitter and M it on and things like that
um you know you may work for a firm and
be lucky that you have like a paid
intelligence provider but not everyone
has that um you can get a pretty pretty
good piig for buck on Twitter um just if
you don't have an account High you to
get started um bu build your following
right just just start to collect the the
people that do research for security
vendors um the people that are are doing
blue team work red team work purple team
work all the things um cultivate that
feed and I think you will be more than
in on what's going on
today um yeah so I actually have like a
a pattern how I do things so like if I
see something on Twitter um and I know
that I can't read it right like I tag it
bookmark it for like a read Now read
later or that type of thing and like you
got to stay disciplined with it cuz you
could obviously like that could outpace
you very quickly but like I have certain
rhythms like when I know I have 5
minutes of time or you know I'm I'm
sitting down just sit down like I'll go
scroll through give me 5 minutes see if
there's anything interesting do I have
time to read it no put it right here and
then then I have time in the morning
before before I get to work before I
check any emails before anybody tells me
that something's on fire um I'll go
spend the time to read it um and as long
as you're disciplined about it um is a
really good way to to stay up on it if
you're not disciplined about it then
kind of just wasting time but uh that's
something that's work for
me thank you any other
questions all right we'll be up here gra
more thank you very much to all the
panelists and thank you all for
[Applause]
coming
[Music]