Episode 2 · · 42 min
0day From "Geek Squad" tech to DevSecOps
Security researcher securing distributed systems
Episode summary
0day (“Zero Day”) is a security researcher who specializes in distributed systems security.
Throughout his career journey through a "Geek Squad"-like service at Circuit City ("Firedog") to trading floors and corporate information security, he’s amassed significant experience in the industry. He is an example of how security consciousness is important even before you're an official security "pro."
In our conversation, 0day discusses getting into computers as an inner-city kid, acknowledging how our hangups can affect the growth of InfoSec, the benefits of older technology, and much more.
Episode Highlights
0day defines distributed systems and how he and his team ensure they remain secure
How his first hacking experience arose out of necessity
The inner-city program that fostered 0day’s early interest in computer systems
How the Modem Age's less-advanced technology gave him a clearer understanding of how computers and the Internet worked
How Circuit City allowed o take his first step into the professional tech world
His first taste of information security dealing with his company’s most dissatisfied clients
Tracking down a security vulnerability through a coworker’s NSFW browsing habits
Thoughts on the modern security industry and how it could be improved
The importance of getting over prejudices and mentoring those coming into InfoSec
Book and conference recommendations for those starting out or interested in the industry.
Average routine at his current job
Why computer science alone isn’t a solid enough background to get into InfoSec
Advice for overcoming shyness at your first security conference
Quotes
“The malware I came across in those days, I still don’t see anything as unique.”
“We should really reach out to a wider swath of society to give them an interest in information security.”
“We, as a community, need to be less exclusionary by default and be willing to look at some of these candidates who we are ignoring just for the sake of our feelings toward a particular certification or particular path.”
“We, as people who are more seasoned in the industry, now have the responsibility to also make ourselves available to those who are coming into the industry.”
“When you take away some of the complexity, it makes it more difficult for someone to understand the underlying constructs, but at the same time, it makes it easier for them to access so there has to be a balance.”
“As you start to get really familiar with anything, you can see both the dark side and the light side of it.”
“We, as professionals, have some responsibility to disseminate correct, accurate knowledge.”
Before infosec: Circuit City Firedog technician, trading-floor desktop support and sysadmin
Chapters
- 0:00
Intro: who 0day is
Ayman apologizes for the audio quality and introduces 0day, a researcher securing distributed systems.
- 1:14
First computer, Novell hack and the nonprofit that gave him a PC
0day describes his 386, becoming a NetWare admin at school and the inner-city program that let him keep the computer he built.
- 6:32
Circuit City Firedog repair tech and certification vouchers
He explains cleaning malware by hand at Circuit City and getting Microsoft certifications to move into desktop support.
- 9:56
Trading-floor support and the long road to a security title
0day describes taking the toughest support role to gain access to everything, and the roughly six years before his first official security job.
- 14:10
War story: the C2 traffic that was a lunch break
Suspicious daily sessions to Eastern Europe turn out to be an employee browsing adult sites at noon, raising a judgment-call about privacy.
- 18:16
Industry gatekeeping, certifications and the OSCP
He argues the community should be less exclusionary about certifications and talks about the OSCP's Linux bias.
- 23:24
Advice: reach out to the community and know the three skill areas
0day recommends BSides and meetups, and building infrastructure, networking and automation skills.
- 25:59
Spoof ad: Back to Bare MetalSpoof ad
A parody pitch for people who miss bare-metal data centers and want to undo the cloud.
- 27:30
Day-to-day: incident response, runbooks and PowerShell
0day describes his malware analysis, automation and runbook work and why he likes PowerShell as a glue language.
- 30:56
Staying current: conference talks and Twitter
He explains following unsponsored conference talks and Twitter, and the responsibility to share accurate information.
- 34:10
Beyond computer science, imposter syndrome and conference nerves
0day says infosec needs people from many backgrounds, and that early conference visits would have shortened his path.
- 41:13
Closing and Ayman's community plug
Ayman signs off and plugs his new community.
Key takeaways
- Build strength in infrastructure, networking and development or automation, then apply security to each.
- Use a non-security IT role as a sandbox: improve security there and show the results to the next manager.
- Certifications can demonstrate interest and satisfy job descriptions, so the community should not dismiss candidates over them.
- Go to BSides and local meetups, and bring a friend if big conferences feel intimidating.
- Learn how the attacker thinks as well as the defender; knowing PowerShell as a sysadmin helped him detect its misuse.
- Do what interests you rather than chasing the news cycle; there is room for everyone.
Notable quotes
we should really reach out to a wider swath of society to get them interested in information security.
we as a community need to be less exclusionary by default and be willing to look at some of these candidates who we are ignoring
infosec is just problem solving, like many other engineering-focused areas.
Questions answered in this episode
- How did 0day get into cybersecurity?
- He started in computer repair at Circuit City, then did trading-floor desktop support, server infrastructure and global server monitoring while quietly improving security. His first official security role, as a security operations lead, came about six years after he entered corporate IT.
- Do certifications matter for getting into infosec?
- 0day thinks certifications show interest and can satisfy a job description, and he used Microsoft certifications to get his first desktop support job. He also notes the OSCP is heavily Linux-focused while client environments are mostly Windows.
- How can beginners overcome shyness at a security conference?
- He suggests starting with smaller conferences like BSides and local meetups, where it is easier to talk one on one. Bringing a friend lowers the barrier to entry.
Show notes and links
Show the original episode notes
0day (“Zero Day”) is a security researcher who specializes in distributed systems security.
Throughout his career journey through a "Geek Squad"-like service at Circuit City ("Firedog") to trading floors and corporate information security, he’s amassed significant experience in the industry. He is an example of how security consciousness is important even before you're an official security "pro."
In our conversation, 0day discusses getting into computers as an inner-city kid, acknowledging how our hangups can affect the growth of InfoSec, the benefits of older technology, and much more.
Episode Highlights
-
0day defines distributed systems and how he and his team ensure they remain secure
-
How his first hacking experience arose out of necessity
-
The inner-city program that fostered 0day’s early interest in computer systems
-
How the Modem Age's less-advanced technology gave him a clearer understanding of how computers and the Internet worked
-
How Circuit City allowed o take his first step into the professional tech world
-
His first taste of information security dealing with his company’s most dissatisfied clients
-
Tracking down a security vulnerability through a coworker’s NSFW browsing habits
-
Thoughts on the modern security industry and how it could be improved
-
The importance of getting over prejudices and mentoring those coming into InfoSec
-
Book and conference recommendations for those starting out or interested in the industry.
-
Average routine at his current job
-
Why computer science alone isn’t a solid enough background to get into InfoSec
-
Advice for overcoming shyness at your first security conference
Quotes
-
“The malware I came across in those days, I still don’t see anything as unique.”
-
“We should really reach out to a wider swath of society to give them an interest in information security.”
-
“We, as a community, need to be less exclusionary by default and be willing to look at some of these candidates who we are ignoring just for the sake of our feelings toward a particular certification or particular path.”
-
“We, as people who are more seasoned in the industry, now have the responsibility to also make ourselves available to those who are coming into the industry.”
-
“When you take away some of the complexity, it makes it more difficult for someone to understand the underlying constructs, but at the same time, it makes it easier for them to access so there has to be a balance.”
-
“As you start to get really familiar with anything, you can see both the dark side and the light side of it.”
-
“We, as professionals, have some responsibility to disseminate correct, accurate knowledge.”
Links
-
0day’s Twitter account: https://twitter.com/0daysimpson
-
Youtube talk about Twitter: https://www.youtube.com/watch?v=vRYOQeJng50
-
Outro: "Cyber Sunset"
Getting Into Infosec:
-
Twitter: https://twitter.com/coffeewithayman
-
YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
-
Book: https://www.amazon.com/Breaking-Step-Step-Starting-Information-ebook/dp/B07N15GTPC/
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
Hi everybody, welcome to the second episode of the Getting Into Information Security podcast. So the audio in this podcast is a little problematic, but I made an executive decision to go ahead anyway. The reason being is that what we talked about had so much value, and so I think the value outweighs the audio issues. So please bear with us in that. I'm really excited about this episode. We talked about some really interesting things, and I'm really excited for everyone to listen to it. Welcome to the Getting Into Information Security podcast, where we talk with information security pros and learn from their experiences and how they got started. I'm your host, Eamon Ossawa, and today our guest is Zeroday.
Zeroday is an information security researcher working on securing distributed systems. Welcome to the show.
Hi, thanks for having me, Eamon.
Yeah, sure. Really appreciate you coming on. So maybe you could tell us a little about yourself and what you do.
So I currently work securing distributed systems. These are Docker containers in AWS Cloud. And we have a lot of interesting challenges, for example, logging and API metrics coding for these systems. And what we really do on my team is to ensure that all the calls being made to these systems are legitimate and that there isn't any rogue code running inside of those containers.
Great. Let's start from the beginning. What was your first computer?
Oh, my first computer was an 386 with 25 megahertz and 25 megabytes of RAM. That's A lot weaker than today's standard iPhone, for example. We have more power in our pockets now than I was ever dreamed of when I started getting into computers.
Was it CGA or VGA or EGA?
VGA.
VGA. VGA, okay.
That's graphics on that one, yep.
Okay. Okay. Awesome. And what was your earliest hacking memory that you could at least talk about?
My earliest hacking memory. It's an interesting one, I think, because it was kind of a situation where I was at school. We, in fact, didn't have, I would say, the best support from the city we were living in, in terms of having them come on site and keep things up to date, things repaired, so we could use them. And it turns out that I had to become an administrator on a Novell system, because we had NetWear at the time, in the local schools, to fix a problem. You had to? I had to. Otherwise, we wouldn't have been able to use the system as a big game. So it was, I guess, a white hat experience. But it gave me a lot more interest in... And, you know, finding ways of subverting controls and systems early on.
That's awesome. That's awesome. And then from there, you just started exploring, huh? From there, was it Novell 4.1 or so? 4.11?
Yep, 4.11, 4.11. Wow, cool. Yeah, again, completely out of necessity. But, you know, I think as far as my interest in information security or, you know, what really got me charged up about it, it went way further back than that.
Oh, go ahead.
In my neighborhood, there was a local nonprofit. Their entire mission was to enable inner city youth to discover their talents through business training and trade courses. And a lot of what they did focused around giving you something at the end of a lot of these courses, right? So in this case, it was a computer repair or operating system installation type course, basic computing. But the perk was when you were finished with this, the computer you built, you took home, it was yours. And at that time, With immigrant parents, you weren't exactly getting a lot of money to buy anything. Anything you asked for, you weren't necessarily going to get. So coming across a computer at that point was pretty difficult.
But programs like this allowed people, in my community at least, to get these resources to play with in a way that would allow them to grow their skills in private where they could Have some experience to get into things a bit more deeper later.
That's awesome. And then that helped you grow.
Right, giving me the lens into what computer science was at the rudimentary level. And being able to take that thing apart and having a general idea of how all the components fit together and how they were working. And I mean, in those days, this was probably the mid-90s to early 2000s. I'd say really the mid-90s. Components were a lot larger on these motherboards. They were easier to see, easier to understand. Not like the thing is so tightly packed together that it kind of abstracts away a lot of the function of what the board is doing.
Yeah, I remember ATX cases and, you know, when was it micro ATX or what was the next step from ATX?
Yeah, I think it was micro at that point.
Yeah, and I was like, wow, that's small. But, you know, we had these huge big metal cases and, you know, you cut yourself on the cases.
Yeah, it's definitely a rite of passage. A PC building and getting cut in the case each time.
Were you ever in the modem age?
I was in the modem age. Actually, that's one of the things that kind of, I think, shines a light into what you can become within technology is what technologies were available to you when you became interested and what were the new disruptive technologies and what were the established technologies. So in my case, the modem technology, 56K, dial-up, all that stuff is established. So I can jump right in, buy a modem, Jack in, dial out. Through doing that, you're forced to learn a lot more about how things worked at a lower level. For example, to play a simple online game, it's not like today where you can install a Steam client, run the game, and you're done. In those days, you had to basically fire up a server on your end, have someone dial in, accept that connection.
It wouldn't always work. So you had to do a lot more troubleshooting, and it kind of forced you to be a little bit sharper, I'd say.
Yeah.
That wasn't abstract the way it was.
I always envied my friends that had multiple lines.
I wasn't one of them.
What was the slowest modem you had?
The slowest modem I had was a 14.4k US for box modem. Because once again, immigrant parents, they weren't buying me anything. So a lot of these devices came from donations or, you know, for example, my school was another huge source of this kind of stuff. It wouldn't need one extra modem or something that we're eventually going to throw out. You know, they give me a lot of this hardware to play with or, you know, get a better understanding of. I think that kind of thing really matters, having a space where especially young kids who are interested in this stuff can go and really see how this stuff works and get their hands on it.
That's good. That's good. Yeah, I think the slowest modem I had was actually a 2400 baud modem. So, you know, kind of dates myself, but I always love hearing modem and BBS stories. So that's awesome. So fast forward now and what made you, it seems like you always had an interest in computers and you just had that hacker mentality where you're looking to take things apart and learn more. At what point did you see you wanted to do this professionally?
Well, in a way I kind of fell into it, I'd say. At one point, I wasn't living at home any longer following high school and getting into college and I needed to find a way to make money. And generally speaking, you could go work at the burger joint or wait tables or whatever it is. But if you plan your strengths, things will be that much easier for you. And I figured, hey, I know a little bit about computers. Let me try and do something computer related. So at the time, the only thing that was available even to get a taste of what that world looked like was, if you remember Circuit City, now defunct, they had a Firedog technician program. It was basically PC repair, AV, and all that kind of stuff, right?
So I applied for one of those jobs since I had previously worked sales for these guys during holidays or something. So I figured at least I knew a few people there. I got through and really that was my first introduction to this stuff professionally, being able to actually work on the machines of other people. And the malware I came across in those days, I still don't see anything as unique today on some level. So all the weird niche consumer malware, all the fake AV clones, and cleaning that stuff off by hand without using antivirus software. So finding all the persistence locations and doing that pretty much day in and day out really gave me more of an interest in doing that side of things professionally and moving away from the traditional general IT support side of things.
That's awesome. So you just got thrown into it, huh?
Really, yeah, yeah. So I began playing to your strengths. I figured I can do a little bit of this. So let's see how far I can take it. Right. But an interesting story about Circuit City since they are now defunct. So I can obviously talk about this openly. They had a system for providing service technicians the opportunity to get Microsoft certifications, which I thought was a really good thing. Actually, I don't see many small shops like even your Best Buy is doing something like this. Right. And on that platform, There was a limit of two vouchers that you could get out of the system per employee. But, of course, I was managing the client side with some JavaScript and cookies. So, lo and behold, I managed to get six of these things.
And these are vouchers that have value. You can taste it for a prometric certification exam. And that's what I did. Got as many of these as I could. Breezed through some Microsoft certifications. I believe it was for either Vista or Windows 7 back then.
Uh-huh.
And took that as my platform to start trying myself out there in the world of desktop support as a first step because they were asking for this particular credential.
Okay, that's awesome. You have any interesting malware stories from those Circuit City days?
None that I'm really too comfortable talking about because people walk into the store, you have a certain view of them, but it's not until you really get on that machine that you see kind of how the exterior doesn't always match the interior when it comes to people. You start picking apart how this infection got onto the machine. Is it persistent? Is it going to come back? Because you don't want the customer returning to the store saying you didn't do your job. But a lot of these were sourced from adult websites, let's say. There's some fairly elderly customers. With this problem, which is a little interesting to me at the time.
Very interesting. Very interesting. Okay.
That's all I can say on that one.
We can leave it there. That's awesome. We can leave it there. So it looks like you started, you know, in the desktop world, desktop support, and then, you know, worked your way up from there. And when was it that you actually had an actual information security focused job, like at a corporation? How did that transition happen?
So that transition came pretty late following that, actually.
Mm-hmm.
After leaving Circuit City, just to give you guys an idea about the challenges you can see in infosec when both trying to define yourself as a professional, saying what area of this do I want to enter, and also... What does it take to get there? The next step for me in this case was getting into a support role at a corporation just to get my foot in the door. But even with that role, my interest wasn't in working desktop support at that point. I did want to get more hands-on with malware analysis, more hands-on with security as a whole. But a lot of these organizations, they're pretty rigid. They have set roles, set people in these places who have been there for years in many cases. And it makes it difficult for people just coming in, whether this is an information security or an IT role, to get that exposure or familiarity.
So in my case, I went to a corporation as their desktop support person for a trading floor. And the reason behind that in this case was no one else on the support team wanted that role, basically. These were the toughest users to deal with, the most unreliable systems at the time, and The least appreciation you got out of the role. You'd be screaming every day, you know, traders are breaking phones, you know, screaming in your face, telling you what you don't know, et cetera. But I saw this as a challenge because, you know, I get access to not only the user-facing problems, but also the server-facing problems that run their backend. So it was one of these roles where I got to be, in a sense, the king of the castle and really get to be hands-on a bit of everything.
And, you know, from having that freedom in that role, I was able to also... Directly impact the security of that part of the organization. And that was kind of my own personal proving ground. So taking the output of this kind of a sandbox, professional sandbox, being able to show that to the next manager or the next person who looked to see what your skill set is, that was kind of how I made that transition. So my first taste of security was really in that role, although it wasn't officially defined. It wasn't until actually eight years later, or I'm sorry, six years later, that my first official security role After consulting, the experience I had in that first desk support role, later moving to a server infrastructure role, and then a global server monitoring infrastructure role after that to kind of combine the two sides.
It was only at that point that I was kind of validated to say that, yes, I can do this type of work, even though it's not directly presented on my resume. Because a lot of these information security roles, people... I believe these days want to present them as introductory roles in the sense of we want someone who's been doing this for two years or we want this level of skill without breaking apart what it takes to do the individual pieces of the role, which in fact bring you the intermediate to journeyman level for most of the other portions, such as infrastructure knowledge, development knowledge, or some networking knowledge, right? And these are the kinds of things that I think... You the experience requirement when they're presenting these types of roles, which often leads to either disappointment on the part of the person going into information security and also on the part of the people who would like to bring more people into information security.
Right. That's where I think the disconnect comes from.
Yeah. We're kind of part of the problem, right?
Absolutely.
A long time, you know, these eight years, you were probably applying to, you know, security jobs, but, you know, getting denied saying you don't have enough security experience. Would that, is that being an accurate assessment?
Yeah, that would be a bit of an accurate assessment. Because they often want to see direct security experience, directly doing this, that, or that, you know?
So you kind of have a chicken and egg problem where we want experienced security folks, but in order to get into a secure organization, you need to have experience. So how do we do that?
Right, that's really the question there. Absolutely.
Yeah. Yeah. So I'm finding even though a lot of colleges are teaching information security and some folks are able to get it off the bat, I am still finding that a lot of people are still transitioning. So, you know, in your case, you were the sysadmin, but you were a security conscious sysadmin and you learned your security from your sysadmin role. You were security conscious and then kept focusing on that goal until you actually had information security in your title. Right. So any interesting stories you could share from industry, you know, any cool war stories you have for the audience?
Well, I can tell you this one. It's a story from when I was doing a lot of security operations work around monitoring forensics and, you know, that kind of deep forensic stuff, you know, looking for C2 traffic on networks and things like that. So it was actually my first week on the job as a security operations lead. My role is basically to build out our monitoring infrastructure, something we'd never had in place before. To detect any kind of network-based threats, and then couple those with data from the endpoints. So again, first week on the job, first two weeks or so, and I started getting the flow data in so I can build some patterns from these to see what's normal with basically user behavior analytics.
I noticed an interesting pattern in one of our remote sites. Basically every day at the same exact time, a number of sessions, about 30 or 40, get established and maintained for about an hour or so. Or so and they drop off, the same thing would happen every day. It was always 12 o'clock on the dot. From my perspective, thinking about a possible malicious and a possible benign scenario for either of these conditions, for these conditions, I should say, it looks a lot like C2 traffic. Something running on a machine, it's dialing out, making a connection, doing what it has to do, and then dropping said connection. In this case, a lot of the IP, the geographic data, and who is information around those address spaces,
These things are in Belarus, Russia, Poland, and we're U.S.-based, so this is pretty odd, right? Okay. So I figured, let me deep dive into this a bit more, start looking into what workstation here is doing in the host, and try to figure out who this thing belongs to, and really unwrap this. And again, I'm thinking of this as C2. I just got onto the job. I'm really excited, charged up. You want to get that first, you know.
Impress the boss, yep.
Exactly, exactly. So I'm pulling these logs. I have full process history going back to, you know, a week or so with every process I'd launched, who launched it. Basically, this entire framework I built out was really proud of.
Okay.
And I pull all these results, start analyzing it, you know, ready to make up this beautiful report. And then I actually get a screen cap back from what these connections were since these were going over HTTP. It was web traffic.
Oh, I see. Okay.
So it turns out A user in one of our remote locations was visiting adult websites every day at the same time.
Every day at the same time?
For about a month and a half. This is basically this guy's lunch break.
That's hilarious. That's hilarious. Now what? Is it an incident? How do you deal with it? That's a tricky one.
In this case, it wasn't an incident. That's something that sometimes comes up in information security work. You know, you see Things you were not meant to see. And that usually comes down to making a judgment call. Does this put the company at risk?
That's right. Wow. I mean, a lot of those sites can be infected. So that is contradictory. But yeah. Yeah, that's really tough. You're right. I mean, when I was a tech at a computer lab in college, the rule was because it's a college and because it's so, you know, information has to be open and people, the users have to be allowed to do what they do. If someone was surfing porn and a user was offended by it, then we had to move the offended user, not the person surfing it. Wow.
Imagine playing with everything. Yeah.
And the problem with as a security practitioner, we get, I mean, we do have access to things and we have to make that call. Is this going to put the company at risk? Is this violating our policies? Does a company have like a market? More liberal stance. I mean, if that person was subverting your proxies and your firewalls, right, then I'm sure that there isn't, there's something there. But, and also same thing with help desk, you know, when, when you look at malware and they say, oh, my computer's infected. Well, we're going to have to take your computer and go through it and see what's, how it got infected. A lot of times users are like, no, that's okay.
That's okay. They'd rather be infected than revealed. Yes. Yes.
And that's, that's the dilemma. Yeah, an interesting topic for another day. So what are your thoughts on the security industry today? Any thoughts, anything we can do to improve how we bring in new talent and things like that?
Wow. Well, that's one of the bigger questions when it comes to this industry right now. And from my experiences, what I can say is we should really reach out to a wider swath of society to get them interested in information security. Because I don't feel we're involving enough of the population, I should say. So in my case, for example, if that nonprofit never existed, if someone had never thought to put that in my town, I most likely would have been doing something else, probably still in the sciences, but not infosec related. So I believe engagement is one side of it. Being willing to put a physical spaces for people to see that these things exist and these technologies are real and they can do this kind of thing.
That's one part of it, seeing is believing.
I think we give a lot of bad advice as professionals or as people who are already at kind of a journeyman state in their career. And certain things will work for some people, but not others. And we should be willing to open our minds to other possibilities in terms of what would work for you may not work for someone else. For example, the certification topic comes up a lot. Many people say certifications are worthless, right? And on some level, I agree and others, I disagree. Yeah. But it's as simple as this. If you have the knowledge, but you might not have the education or something else, and you want a way for this to be proven as you hold some water, and you go through the certification process for any of these certifications, you're learning something along the way.
I believe it demonstrates interest. So, you know, we as a community need to be less exclusionary by default and be willing to look at some of these candidates who we are ignoring just for the sake of our feelings towards a particular certification or a particular path that someone else took that we didn't take.
That's really interesting. Certification is a contested topic where people feel it's worthless. So I'm really glad that you mentioned that because I think some people take certifications to learn. Others take it because it's listed on the job description. I think that if it's listed on job description, then you're better off getting a certification to satisfy the job description, right? As in your case, you proved that with your Windows certifications, right? Your Microsoft certifications. Right. That helped you. So it's kind of like a college degree, sadly enough, but people say, you know, oh, college is not worth it. Well, it's also a double-edged sword. If you're, how do I say this? But in what I tell people, you know, is college going to prepare you for your job and your career?
Might not, but it's going to get your foot in the door, right? It's going to prove that you've done something to someone, you know, it's, it's also a very controversial topic. I think Apple and Google just removed their college degree requirements from some of their job descriptions. And I know someone that was limited from being promoted to a higher architect engineer level because they didn't have the college experience, although they were very, very talented. But when they came to get promoted at this particular company, they were denied that. And so, you know, we shouldn't use it as a denier. For people, we should use it as an entry for folks. And of course, some have more, some certifications have more.
You know, the OSCP, for example, is a great certification for actual learning and proving that you know something, right? That's, yeah.
Absolutely. I mean, this is going to be maybe a hot take for some, but I also have my issues with that certification and I also hold one. But what I feel it prepares you for as a penetration tester is kind of a In a homogenous environment where it's really, really Linux-focused and really web-focused. And more often than not, with a lot of these client engagements, you have a mix of operating systems more often than not Windows. So even with certification aside, just kind of speaking to the shift from hacking to penetration testing as a concept, the rise of sites like Hack the Box and others, again, a lot of these are really Linux-focused. And while they teach you great skills, it Puts you in a situation where what you expect to see in the real world isn't matching what the real world actually is in terms of available systems.
So it's also a good way of kind of looking at that problem. It comes back to the college experience, prepared versus experience kind of situation.
Right, right. I wonder if they've updated their exam, because I know someone that is trying it recently and didn't pass, but all the hosts were Windows. He was able to do provision escalation, but he wasn't able to. So that's interesting. I mean, it could be the vice versa.
So maybe they've heard some of that feedback before. And yeah, the exam as a result.
But all the people that were doing it in Linux and then they go get a pen test job and find out, you know, most corporations use Windows. Right.
It's pretty funny.
Yeah. Yeah. So you're right. Yeah. I think certification is a topic that we could talk about for a while. But I really like what you said about that. And if you have any other thoughts, feel free to add.
I've done things just, you know, come into mind at this point. But as far as I think we as people who are more seasoned in the industry now have the responsibility to also Make ourselves available to those who are coming into the industry, for example. And as far as people getting into the industry, one thing I think they should really focus on, aside from certification, like I mentioned, because that will at least impress some employers, right? At the end of the day, it's not going to impress maybe your fellow hacker. It will impress at least one organization that you took the time to sit down and do this. Something else that can really help, especially early on, and I wish I had known this sooner,
Was to reach out to the community, go to some of these smaller conferences, your B-sides, your local meetups or whatever they are, because you'll meet people at various stages of their career progression. And with a lot of us who are more seasoned, we tend to get maybe bored with some of the day-to-day challenges and take more joy in passing on some of that knowledge or enriching someone else's development. And that's something that You know, we can only really get from a lot of these smaller conferences where things are maybe less intimidating and you can actually talk to someone one on one.
Yeah. Yeah. So on that note, like what are some things you do recommend to folks who are trying to get into information security, either experienced folks or new, you know, college students and graduates?
OK, so I would say for more experienced folks to start out, depending on where your current skill set is, I always look at it from the standpoint of where am I and where can I go? So I've always believed that the infosec skill set is made up of three areas, which are strength in infrastructure, strength in networking, and then being able to do some type of development or automating either of the previous two skills and applying security to them. So if you're, for example, a network engineer coming into information security, you should maybe shore up your infrastructure knowledge because some things in the infrastructure side will trigger ideas or trigger thoughts in your mind that relate back to your original skill set.
It will enrich both. Which will kind of push you in the infosec direction and vice versa. If you're coming from the infrastructure world, you'll learn a bit more about networking and always learn some development, some automation at this point, because at least today, the majority of deployments, the majority of environments are being deployed as infrastructure as code. So there was a time where your network guy, he didn't know any code. He might have to write a bash script or two, but that was it. But these days... You're building infrastructure from the bottom up with just code. And understanding the implications of that I think is important, especially for this day and age.
Absolutely.
Well, I would always say to look for the nearest B-Site security conference. This is put on by the community in your area. And that's a great way to meet people who you can stay in touch with and work with more frequently. As well as getting to know what your location's flavor of infosec is. It's really interesting for me to see the different groups geographically that make up the overall infosec community, especially in the US. So yeah, definitely go to your local B-sides, go to any local meetups around The networking side, the infrastructure side of developments, because you'll meet those security-minded people who aren't necessarily in security roles. And if you bring those people into the information security conferences, like your B-sides, you start getting that, what I mentioned earlier, expanding the reach outside of what you traditionally consider as that's an infosec person or that's an infosec person.
It's the hacker mindset you want to distill into what we now think of as infosec.
Yeah, that's pretty cool. So describe to us, what's your typical week or day or month like at your current job? Give us some insight for the audience as to, are you mostly doing instant response? Are you building tools? Who are you working with on a daily basis? Give us some insight as to what a security researcher securing distributed systems does.
Sure. So I'm actually in a transition point right now. I'm transitioning out of a previous security operations role into this new distributed systems role. So there's a bit of work on both sides to be done in between. So my previous employer doing security operations and IR, and it's basically the same thing I'll be doing at the new employer, just at larger scale and with these systems being distributed. So my day typically consists of lots of malware analysis. Lots of instant response. We'll automate instant response in this case. Designing runbooks for our new analysts we're onboarding so that it kind of takes away a bit of the complexity, which I have mixed feelings on because when you take away some of the complexity, it makes it more difficult for someone to understand the underlying constructs, but at the same time makes it easier for them to access.
So there has to be a balance there. That's what I focus on day to day in terms of getting that mix right when making runbooks and writing tools that others can use. So my day really consists of, again, instant response, tooling where needed to make things easier for others on my team or more accessible for others on my team, including myself. Because who wants to do the same thing 15 times when they can maybe spend half an hour, an hour, and then have that automated after that point.
Yeah. What's your favorite language you're coding in right now?
Right now, I wouldn't say I would have a favorite per se, but there's one that's really helped me out through the years, and I really believe in not biting the hand that feeds you. You know, figuratively, obviously, in this case. And I do a lot of my work in PowerShell, which is, you know, really Microsoft-centric, or at least it was up until a couple of years ago. And the reason at the time was the environment I'm working in was purely Windows, purely Intel. So it was the natural choice, something I integrated, something that was easy to use.
That's interesting.
It's very powerful. Yeah, it is. It's far more powerful than most realize, I think. And that's something that was really interesting to me. So some of the reasons I like using it, I consider it a glue language. I don't consider it something that is de facto better or worse than any other functional language. But what I do like, again, it acts as a glue. You're able to natively run lots of other languages directly inside it and get predictable structured results. So for example, you can run any.NET language natively in PowerShell. You can run JavaScript natively in PowerShell. It integrates with a number of systems natively from a module standpoint. So you're not importing lots of additional modules that are already built in.
And that makes it easy for people who are coming in, for example, after you have to read your code and deal with this. It makes things a lot easier for them, a lot more accessible.
That's awesome.
Other than that, no JS and Python.
Okay. Okay. Yeah, I love hearing what people like to code in or some of their favorite languages. Yeah. Definitely really appreciate that. I think the audience would definitely appreciate that.
That's awesome.
Cool. So how do you... Yeah, I mean, you know, the fact that, I mean, right now malware can be completely in memory running in PowerShell and trying to detect those kind of attacks just boggles my mind sometimes. So, you know, turning on PowerShell logging and things like that. So...
One thing that always kind of comes to mind about some of these languages and also the process of Getting Into Infosec from some of the other information technology skill sets, development, for example, or even, you know, systems administration. Because these days, PowerShell is obviously designed as a sysadmin's language to manage your infrastructure, right? But as you start to get really familiar with anything, you can see both the dark side and light side of it. So for a point before people were really weaponizing PowerShell, I was like, wow, this can really be weaponized. This is coming. But because I had that view as a developer, by the time it was weaponized, you're then able to see how you can detect this because you can think along the same lines of the attacker would in this case.
I think it's important to have both sides of the coin.
That's a really good comment. Yeah. So how do you stay up on current topics?
Well, the conference angle is a big one. People who release some great talks about what they're working on, especially, again, your B-sides, your local conferences, where these aren't sponsored by anyone, so you're not being sold a product. You're more being sold an idea, in this case, I think is really important as a way of keeping on top of what's happening in infosec. Because a lot of these people who are doing the next phase of whatever are also watching these topics and getting their ideas. So if you know where an idea comes from, you can kind of see where things are going without having to do as much digging when it comes down to it.
Okay. Any websites you check on a daily basis or places you like to hang out online that you find really good source of information?
Well, for better or worse, Twitter. A lot of things tend to get released first on Twitter. And it's kind of a shift we've seen from traditional media to this crowdsourced information. Even recently, there was an ASLR bypass that, again, dropped first on Twitter. And there's a community around this where you can get these samples many times ahead of anyone who's reading the news cycle and sort of dig into that before it becomes something that is kind of out of reach. Because all sorts of some of these CVE disclosures or zero-day vulnerabilities end up getting taken down through a cease and desist or whatever it may be. So having access to the information security community on Twitter is a great way of staying abreast to a lot of these topics.
Yep, yep. Twitter is a great source. And like you said, for better or for worse.
Yeah, there's a lot to dig through. Yeah, that's awesome. That's a problem a lot of us, I think, are aware of and are trying to tackle actively. In fact, there's a talk about that very topic, digging through the memes and the shit posting to get to a point where we can actually get content out when needed, but still have the community.
Okay. Okay. Be great to send me a link to that talk. I'll put in the show notes.
I will do it. I think it's a great project, actually. It's something that gave me pause at first because one thing the presenter on this topic said, we as professionals have a bit of a responsibility to disseminate Correct, accurate knowledge. Just because we're not at the stage where we're comfortable and we know how things work, someone coming in new trying to get their foothold, especially when it comes to Twitter, they won't really know where to point their lens in this case. Again, we as professionals have the responsibility to On some level, maintain data hygiene around what this all is about.
Do you think that, you know, teaching computer science is enough to get started on getting folks started in information security? Or do you think we need to do more? So, you know, helping community, you were talking about communities and access to computers. Is that a good start? And then hopefully those who have the knack for security or for hacking will kind of go on their own? Or do you think we need to, you know, it needs to be more than just computer science?
I think it definitely needs to be more than just computer science because the hacking community, information security aside, isn't only made of computer scientists. And that's something I think we need to kind of get away from as an information security community. Because take a look at the hacking community. You have people who have backgrounds in pure electrical engineering. You have people who are woodworkers. It's pretty diverse from a skill set perspective. But they all have a mindset that can generally be applied to some type of problem-solving. And at the end of the day, infosec is just problem solving, like many other engineering-focused areas. So I think the community outreach portion is a good start, more so than teaching computer science, in my opinion, because you...
Give people access to work on this stuff without being restricted to a way of working on these things. Because as hackers, we were never really told you have to use this system this way. Natively, we're more free around how we're going to interact with that. So I think we should let that freedom remain. And that teaching computer science may even be negatively impacting the overall industry by leading things too far in one direction, but not the other. Like leaving lots of stones unturned, so to speak.
Yeah. Yeah. There's something to be said about teaching kids or folks critical thinking. I think critical thinking and problem solving are just key to being successful in information security. It's not, like you said, just having the runbook and just doing the runbook. That's kind of drone mentality. But we need more of that critical thinking and that spark. Wouldn't you agree?
I'd absolutely agree. And the question is how do we cultivate that spark or how do we identify that spark? Perfectly early on because... I mean, it's really a long road for a lot of us. In my own story, even after I was working professionally, it took about six years to go from a technical IT role to an information security role. So a lot of my progression started much earlier before that. And that's something I've heard from a number of people. They started very young. And if we can identify that in our youth more so, we should be able to have that skill set built up in our society.
Okay. Yeah. And what are some steps, you know, if looking back during those six years, those eight years, what are some other steps that you think you could have taken or would have helped you to help shorten that gap?
Yeah, a big one would have been attending conferences or being able to attend conferences regularly. So it wasn't actually, or ironically, until I started attending these conferences that I not only, well, I'll back up a bit. Sure. So after I left my infrastructure role by that six year mark to start the security role, I hadn't gone to any information security conferences, any hacker conferences, anything of the like. So I didn't necessarily know what I knew. I had no one to evaluate my skillset against. And that's something that gives us a lot of us, you know, imposter syndrome. I don't know what someone else knows and that the whole issue comes up where you don't necessarily have the confidence to take that next step.
So I think there are a lot of people out there who are definitely qualified, but they don't have the confidence due to the environment they're in, the status quo or whatever else. So I think going to those conferences, meeting people who were like-minded, being able to talk to them about what they were passionate about, and you realize that, hey, this is something that can work for me. It gives you just that push you might need to take that next step. So it would have started much sooner.
Yeah. Yeah. I think conferences, I think you touched on something really good there where there's some people that have the skills, but they just don't have the confidence to transition. I do see that a lot. Really talented folks. I'm like, listen, you're ready to be an infosec professional. So go ahead and start applying. Just touch up your experience to match some of the JavaScript. If they want Python scripting, learn that. There's some Certifications, okay, maybe we could look into that. But yeah, there's something to be said about conferences. I think for me, it wasn't until going to Hope conferences, for example, that really helped give me the energy. I think energy is really where you're getting at, the energy and the inertia to be in that security mindset.
What did you say?
That's something that's really definite. I mean, any year you leave DEF CON, you always have so much energy, so much drive, To work on your next project because you see that this is real. People are out here doing this, and that's so inspirational.
Yeah. What about the converse of that, though, where you as a newbie are going to a security conference and you kind of feel like it's a little cliquish? What would be your advice for that, for someone in that situation? They might be a little shy or intimidated, in fact, by... All these people around that, you know, say they're, you know, these are experienced security folks, even though the reality is that there's a lot of people like that individual at the conference that are inexperienced and just looking to learn. What would you say for someone like that is going to kind of might be intimidated by a conference, even though the conference doesn't mean to be?
Yeah, it's definitely a problem I've heard. Some others mentioned, and I've seen it myself. I mean, my first DEF CON was only, you know, two or three years ago at this point. And I think... The way they should look at things, the way it should be targeted is smaller conferences where it's maybe less intimidating, less of the crowds and chaos, and more so information talks and good people, really. And even before looking into these conferences that might be intimidating from that standpoint, again, local meetups are great for this because you have a more Familiar environment to get to know these people and maybe one of these people will attend the conference with you to you know lower your own barrier to entry right yeah bring a friend i think that's probably a good scenario just bring a friend to start off with that'd be a good way to start awesome any other tips for our audience before we go stay curious things change at a pretty fast pace and that can intimidate lots of people Getting Into Infosec
A lot of us say, how can you remain interested in something that's basically slipping away from you each day just a little bit? And I think do what you like more so than anything else, something that interests you, invest some time in it. You don't necessarily have to follow what the news cycle or what even the community says you should be interested in. Find your own lane because there's definitely room for everyone.
That's awesome. That's great advice. I don't think it could have been said better.
So that's great.
Well, Zero Day, thank you so much for coming on to the show. Really appreciate your time. How can people connect with you or find out more about you through social or wherever?
I'm Zero Day Simpson on Twitter. A, thanks for having me. This is going to be a great show. And I just hope to, you know, see how it benefits people.
Awesome. Awesome. Yeah, this is for the community. So, you know, we're trying to give back. So I really appreciate you coming on. Great. Thanks so much. I'm your host, Ayman Elsawah. You've been listening to Getting Into Information Security. Our guest today was Zero Day. I will leave his contact information in the show notes. Thank you very much. See you next time. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello.
And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.
