Episode 15 · · 35 min
Adrian Kaylor From Network Admin to Trainer to Sales Engineer for Life
Senior Sales Engineer at Splunk focused on security
Episode summary
Adrian is a Sr. Sales Engineer at Splunk who focuses on security. He has worked for various security startups in the Bay Area for the past 15 years from vulnerability management to endpoint investigation to ML-based threat hunting.
Notes:
Had an interest in security early on, starting with opening binaries on Sierra King's quest games and looking for hints.
Took any opportunity he got to get exposed to security
His job as an instructor was very useful during support and later as a sales engineer
Keeps a Trello board for his lab!
Adrian expenses (deducts) what he spends on his lab from his taxes (consult a tax attorney)
He mentions an awesome hack for installing Kali on a Chromebook (~22 mins)
Quotes:
"I remember the first time I found Phrack, my mind exploded a little bit."
"Experience is experience: everything that you use (skills) will get used later on."
"Figure out what pieces they're missing, so you can fill them in."
"Go through the CIS top 20 critical controls."
"Be less focused on the whizbang fun stuff, and more focused to get you the most return."
Before infosec: Network administrator, Microsoft trainer, technical support engineer and product manager at a security vendor
Chapters
- 0:00
Intro: Adrian Kaylor and his mind-blowing moments
Ayman introduces Adrian, a senior sales engineer at Splunk, with teasers about Phrack and his dislike of vi.
- 1:17
What a sales engineer does at Splunk
Adrian calls himself the nerd brought in to talk to other nerds, running demos and proofs of concept.
- 2:05
Early curiosity: King's Quest strings and Phrack
He recalls reading strings in game executables, finding Phrack on BBSs and learning about buffer overflows.
- 4:30
Experience is experience: from sysadmin to trainer to support
Adrian explains how teaching Microsoft classes and working support prepared him to explain complex products as an SE.
- 5:35
Life hacks, the Ikea Lack rack and the origins of his lab
He jokes about repurposing Ikea tables as network racks and describes building his first network to play Quake.
- 11:27
Moving into security: ISS support, product management and sales engineering
He took a support job at ISS to work with security products, then moved into product management and sales engineering.
- 14:13
War stories: the ILOVEYOU worm and the Witty worm
Adrian recalls a worm that wiped engineering shares when backups had silently failed, and a weekend rushing to notify ISS customers about Witty.
- 16:34
Building a budget lab: Splunk, ESXi, Chromebook Kali and CIS controls
He covers lab tooling, cheap hardware, cloud versus local, the CIS critical controls, JA3 and honeypots.
- 25:48
A funny story about a customer and a turnstile
Adrian tells a lighthearted story from an on-site beta visit in Chicago.
- 27:21
Getting started with CTFs, conference videos and the Holiday Hack Challenge
He recommends Jeopardy-style CTFs, IronGeek and YouTube talks, and describes solving a SANS challenge.
- 33:00
Splunk's internship program and a talk at City College of San Francisco
Adrian describes project-based internships that lead to hires and how a meetup led to a talk on CTFs.
- 34:52
Closing: links and a plug for Ayman's new community
Ayman promises links to the talk and slides, then invites listeners to join his new community.
Key takeaways
- Treat every job as useful experience, because skills such as teaching and supporting customers pay off later in a role like sales engineering.
- Take a job at a security vendor, such as technical support, as a way into security products and conversations with security administrators.
- Build a cheap home lab with a free hypervisor such as ESXi or VirtualBox on old hardware, and keep it isolated from your home network.
- Follow a framework such as the CIS critical controls in your lab, since it gives you a real conversation to have with a hiring manager.
- Try Jeopardy-style CTFs and read write-ups afterward, since even unsolved challenges teach a lot and some employers use them for hiring.
- Watch free conference talks on YouTube and IronGeek if you cannot attend conferences in person.
Notable quotes
Experience is experience. Everything that you use will get used later on.
be less focused on the whiz bang fun stuff and more focused on the things that are going to get you the most bang for the buck
CTFs are a great way to test yourself. They're puzzles you can solve
Questions answered in this episode
- How did Adrian Kaylor become a security sales engineer?
- Adrian started as a network administrator, then became a Microsoft trainer. He took a support job at security vendor ISS to get closer to security products, moved up through team lead, escalations and product management, and then became a sales engineer after realizing he enjoyed talking to customers.
- How do you build a cheap cybersecurity home lab?
- Adrian recommends a free hypervisor such as ESXi, VirtualBox or Proxmox on an old laptop, desktop or a few Intel NUCs, plus cloud instances for anything exposed to the internet. He also suggests keeping the lab on an isolated network and following the CIS critical controls.
- Why are CTFs good for people getting into infosec?
- Adrian calls CTFs puzzles that test whether you have the drive to solve security problems. Beginners should start with Jeopardy-style events, learn from write-ups after trying, and note that some companies use CTFs to find people with aptitude.
Show notes and links
Show the original episode notes
Adrian is a Sr. Sales Engineer at Splunk who focuses on security. He has worked for various security startups in the Bay Area for the past 15 years from vulnerability management to endpoint investigation to ML-based threat hunting.
Notes:
-
Had an interest in security early on, starting with opening binaries on Sierra King's quest games and looking for hints.
-
Took any opportunity he got to get exposed to security
-
His job as an instructor was very useful during support and later as a sales engineer
-
Keeps a Trello board for his lab!
-
Adrian expenses (deducts) what he spends on his lab from his taxes (consult a tax attorney)
-
He mentions an awesome hack for installing Kali on a Chromebook (~22 mins)
Quotes:
-
"I remember the first time I found Phrack, my mind exploded a little bit."
-
"Experience is experience: everything that you use (skills) will get used later on."
-
"Figure out what pieces they're missing, so you can fill them in."
-
"Go through the CIS top 20 critical controls."
-
"Be less focused on the whizbang fun stuff, and more focused to get you the most return."
Links:
Please thank my guests for sharing their time with us and let them know if this episode helped you.
- Adrian Kaylor on Twitter: https://twitter.com/AdrianKaylor
- Adrian Kaylor on LinkedIn: https://www.linkedin.com/in/adriankaylor/
- Phrack Magazine: http://www.phrack.org/
- Lack Rack: https://www.google.com/search?q=ikea+lack+rack&source=lnms
- ISS: https://www-03.ibm.com/press/us/en/pressrelease/20468.wss
- Splunk Dev License: http://dev.splunk.com/
- CIS 20 Controls: https://en.wikipedia.org/wiki/The_CIS_Critical_Security_Controls_for_Effective_Cyber_Defense
- JA3: https://github.com/salesforce/ja3
- Irongeek: http://www.irongeek.com/
- Netsec Reddit: https://reddit.com/r/netsec
- SANS Holiday Hack Challenge: https://www.holidayhackchallenge.com/2018/
- Garage Door Hack by Samy Kamkar: http://samy.pl/opensesame/
- Sam Bowne's Class: https://samsclass.info
- Adrian's Presentation on YouTube: https://www.youtube.com/watch?v=8LF96Oq_pgo (Picture of lab at 24:05)
- Intro Music by Trash80
- Outro Music (Liberation Theology - Exploitation is Sin):
https://open.spotify.com/album/0oc93ZsbMluxL8H994U9MW
Learning Resource Mentioned:
Getting Into Infosec:
- Twitter: https://twitter.com/coffeewithayman
- YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
- Book: https://www.amazon.com/Breaking-Step-Step-Starting-Information-ebook/dp/B07N15GTPC/
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
Hey everyone, I'm Ayman Elsawah and this is Getting Into Infosec. My guest today is Adrian Kaler.
I was always really interested in security from an early age.
His first foray into hacking was as a young kid trying to hack a game.
I remember the moment where I realized I could open up those executables and look for strings in the files and kind of get hints on what items were there. Blew my mind.
Adrian had some more mind explosions as well.
I remember the first time I found Frack, my mind exploded a little bit.
He didn't have a direct path into security, but he really puts it together as to how all his experience in the past helped him in the future.
Experience is experience. Everything that you use will get used later on.
His use of words were just, well, hear for yourself.
As somebody who hates VI with a passion that burns with the strength of a thousand suns.
I just had to include that quote. It was just really funny. Adrian is a senior sales engineer with Splunk who focuses on security. He has some hilarious stories that he shares with us. He also shares with us some tips for creating a lab, which he actually keeps a Trello board for. We had a great conversation. All right, on to the show. Adrian, thanks for coming on the show.
Absolutely. Thanks for having me.
Yeah, let's talk about what you do today and maybe how you got into infosec.
Sure. So I usually tell people, I'm a sales engineer at Splunk. And what I usually tell people is that I'm the nerd they bring in to talk to the other nerds. That usually explains it to people that are less technical or not involved in enterprise sales. But basically, I'm tied with a salesperson or a group of salespeople. And because of the software we sell is a little bit on the complex side.
Mm-hmm.
You don't expect a salesperson to be able to do the sale and explain what's going on or set up POCs. So I'm there to answer questions, to explain the technical aspects of things. If the customer wants to try out the software, I'm there to set up a proof of concept and actually do the install and walk them through things and show them how our software is going to solve problems that they are specifically looking to address.
Okay. And how did you originally get into security?
So I was a network administrator a long time ago. I was always really interested in security from an early age. Tell us about that. Sure. So I'm thinking back, I know I listen to some of your other podcasts. I was thinking back on those first hack type questions. And I realized, I think one of the first ones I had early on, if you remember the game King's Quest from Sierra.
Oh, yeah.
Yeah, that was a great game. It was kind of like a mud, you know, but it was graphical.
Awesome. Yeah.
I remember the moment where I realized I could open up those executables and look for strings in the files and kind of get hints on what items were there. Blew my mind. I mean, it's, you know, it's a pretty cheesy tactic, but looking for strings in a binder is still something we do.
Yeah.
That kind of blew my mind a bit. And just being on BBSs and searching for that type of thing. I remember the first time I found frack, my mind exploded a little bit. So it was pretty early on. I kind of stumbled into it and I was always very, very interested. But in the mid-90s, there weren't a lot of infosections in a career. So you kind of had to get into networking. I wanted to be a programmer early on. So I kind of went down that path.
Can you explain Frack for our audience a little bit?
Sure. Frack is a text magazine from the late 80s through the mid-90s, although it's still around. They've actually published an issue, I think, a year or two ago.
Oh, wow.
But it was an early magazine, a little zine that was distributed on BBSs about different hacking techniques. So that's where I learned what an actual buffer overflow was and how to write them. There was this article, relatively famous article at this point called, he was smashing the stack for fun and profit. I might be butchering that a little bit. Explained buffer overflows and how to write them. It was really a little beyond my skill level, but it was still really cool to
Absolutely, yeah. Even if it's over your head, at least reading it, you'll get something out of it, right? Right. Cool. So you're hacking Sierra games at that point. And you've always had that curious itch, I presume. Is that right?
Yeah, hacking might be a stretch. I'm not gonna claim credit on that. Yeah, I was always very curious. It's kind of that same, you expect something to work a certain way, and a clever hack is something that just puts a little bit of a twist on it. And that surprise and just twist is what I kind of got addicted to, that looking at things just a little bit different, a little skewed. Like I said, there wasn't really a career path for it at the time, or at least not that I was aware of. Whenever we got to do a security audit or something came up at work, I was always jumping to get at that and be the guy that got to do it, even if it meant You know, over time or after hours.
Yeah, a lot of people say that if you can't get straight into security, then try like a sysadmin job and the skills you learn there are going to be very beneficial. What do you have to say about that?
Oh, absolutely. Experience is experience. Everything that you use will get used later on. For a time, I actually kind of segued into training and doing, I was a Microsoft instructor and taught classes. And that's not something that was initially was going to be super useful. But the next job where I was working support, And explaining things to customers was really useful. When I became a sales engineer, it became extremely useful to be able to kind of have the skillset of how do I break something down that's fairly complex into a way that somebody else is going to understand, or more specifically, based on the questions they ask, understand what they're misunderstanding, figure out what pieces they're missing so you can fill those in.
And that became extremely, extremely useful when I became a sales engineer because that's a lot of my job is education.
Mm-hmm.
It's sales, so it's a little slanted. I mean, your product is always the best, but it's still education and showing the customer your way of thinking.
Okay.
So it's persuasive.
So what are some life hacks that you've done, maybe non-technical in your life that you had to kind of use your hacking brain to get out of a situation?
Basically anything involving Ikea. That's always... Okay.
Okay.
You go to that store and it's always, how do I use that piece a little bit different? I think one of my favorite things at Ikea is they have these end tables. It's just a table and four legs. It screws together. It's 20 bucks. They're called Lack, which I have no idea what that's Swedish for. But they happen to be the 19 inches between the inside of the legs. So they make a perfect rack, a Lack rack. And you can screw networking correctly in those. And you've got a portable rack with a nice finish and a table on top. Oh, nice. Yeah, I read about that one. That's not mine. But it was, it's still, you know, just seeing those dimensions out in the real world. Ah, you know what I can use this for?
There's a lot of fun.
Okay. So talking about lab, I saw pictures of a lab that you had or currently have, I'm not sure. Can you talk a little about your lab and You know, maybe a guide for those, how to set up one or, you know, where to start from different perspectives?
Sure. When I first got into networking, actually, the first time I decided to set up a network was to play Quake with my friends. Nice. Yeah, it was awesome. Network Quake. I could play against not bots.
Good motivation.
Oh, totally. Totally. And, you know, I had friends that hadn't played very much, so I got to stop them for a while. So I built my first network to do that. I had to build a second machine. And at the time I was, you know, I was into hardware. I got to, I like to build computers and it was something I could do. But from there, I get so much experience building that network and trying to figure out IP, which I couldn't. So IPX, SPX just works great. I'll use that. Yeah. But I learned so much setting it up that it's still pretty early the value of having a network to play with or something to play with that wasn't work. I couldn't get a job working computers. Actually, I don't think I was 15 or 16.
So that probably had a part to do with it. But having that set up where I could learn and I can experiment for me was just fun. I didn't really think of it as a work thing, although later it became extremely important. It was just kind of who I was, was I want to have a place to play, but I also want to have a computer that's still running. So having a separate workspace became really useful. And initially that was just a second computer, a third computer, a laptop over here that I'm not using. But over time that became, as I got farther in my career, as I got more money to throw away, stuff that was semi-work related and realized I could write it off on my taxes. That was an important discovery that made a huge difference.
Did you have your own business or were you contracting at the time?
No, it's work related. It's an unreimbursed expense. Okay. I think that's professional development. So as long as you're using it primarily for that, not a tax attorney, don't get yourself sued.
Right. That's good to know though.
Yeah. I mean, I've always done it that way. I've never had an issue. I've had a couple of accountants that have gone through my taxes and kind of blessed it. So I think it's fairly safe because legitimately it's very much work related. Yeah. It is for my profession. Yeah. So it started with that and eventually it kind of became, oh, I need a file server. Oh, I need some, instead of having these two computers, I'm going to start using virtual machines and I get a couple of old systems to run ESXi off. And it's evolved to the point now where I actually have a separate lab network with an isolated switch that just has some VMs if I want to download a random image off the internet of a Virtual machine image and run it.
Well, I'm not going to do that on my production network because quite frankly, my production network is not the most secure environment. Some of the passwords are a little weak, but just in general, it's bad practice. You wouldn't do that professionally. You wouldn't just download something you didn't know about or randomly from an unknown source on a Production ESXi servers. Talking to somebody interviewed, you mentioned that and you talk about these things that you do. It also is going to tell an employer, look, I understand best practices. I understand the general IT hygiene that I need practice to not be a liability here. And it kind of communicates that you have the right mindset for that.
And so employers, if you say something like that, will latch onto it as well. This guy is not just
It knows what they're doing. You're eating your own dog food, basically.
Eating your own dog food. That's a great example.
Yeah.
By the way, I don't know how many companies I've worked at who have the term dog food for their own internal systems and actually named them that way. Really? And every one of them thinks dog food. You're not clever. I love the idea. Do it. But everyone thinks they just came up with that joke. It's ridiculous.
That's hilarious. I mean, you get to see a lot of companies in your tenure, right?
I've jumped around a little. Working for startups every couple of years, if you get bored with what you're looking at, it's always fun to go to the next job and look at new technology. I'm very technology motivated, so finding new stuff to play with is fun.
So did you find your lab becoming an obsession in a way?
A little bit. Yeah, I've got a to-do list that is a mile long. I actually keep a Trello board just for lab stuff. And I've got work lab stuff and home lab stuff different, even though it's the same systems. I have had to segregate. This is stuff that I need for work. This is stuff I just want to do. Like I had never really set up an internal CA. I'd set them up before for work, but I've never maintained one at home. Right. And so I decided this weekend or last week, I'm going to set up Let's Encrypt and switch everything over to using real root sign SSL search or PLS search. Nice. And so that was fun. It had nothing to do with work. It doesn't really give me anything other than the experience doing it and realizing, oh, this is crazy easy.
Yeah.
Why was I lazy for so long?
Right. And so when you go recommend it to someone, you can talk from a perspective of that you've done it, right? At least.
Yeah. Yeah. It makes you a little bit more confident what you're talking about. If somebody else mentioned something, you've got a framework to put conversations around. And that's a lot of what I do is just having an understanding of a lot of things so that when a customer says, hey, I'm trying to add this splunk, this data from this switch that I've never heard of. Well, if I've done it for my own and I've got a couple of Cisco switches and I know how that process works, it makes it a little bit easier to make that jump and have an intelligent conversation instead of, I'll get back to you, which is fine, but you still want to be prepared.
Yeah. So let's talk a little bit about your transition into the actual security field. So you were a sysadmin, network admin at one point, but how was the transition into the actual security field? Did you find it difficult? Maybe you could talk a little about that.
Sure. So I had switched from network administration over to training and I was teaching networking classes and hardware classes. I found this company looking for a new job. I wasn't really satisfied where I was at. And I found a company that was looking for support people and the technical support, not desktop support, but they were a security company. And I always wanted to get into it. I'm like, well, this is my chance. If I can get in here and I can work support at a company that is security focused or does security products, first of all, I'm going to be working with security products. Second of all, I'm going to be talking to other security administrators. That's my way in. Because as much as I wanted to be a programmer when I was younger, I'm not a good one.
And so developing tools or writing exploits or any of the things that at the time, you know, in the 2000 timeframe, those were a lot of the ways to get in. Well, if you wrote exploits, you'd get into a company and, you know, et cetera. So I thought that was a great way in. That company was ISS, which is now owned by IBM.
Okay, yeah.
But yeah, I got started in there, I worked in support, kind of worked my way up through team lead and escalations and all that, and eventually ended up in product management of all places when I left support. So I was managing the vulnerability scanner product and some, I don't remember if it was Black Ice, but the derivative of that later on was the, but those products are all gone now, so it doesn't matter.
So yeah, I was in product management. Oh yeah. And I realized the part of my job I liked the most was talking with customers because not all the sales engineers knew the products I was working on. And I'm like, well, hey, that sounds like fun. It's a lot more fun than writing documents and I hear it pays better. So I moved over to become an SE. And at this point, I'm probably a lifer. I love it. I have no intentions of at the moment of doing any other type of work. I just love the job. But it's always been in security products or very security product focused. Splunk is kind of the first time where I've had to kind of actually, I guess, tainting this a little bit too, where you're kind of on the border between ops and security and you kind of go both ways and gives you a little bit broader exposure to other types of interactions.
Okay. And you still get to stay technical, right?
Oh, very much so. Yeah. A lot of my day is not just doing demos, but it's a lot of it is solving problems for customers. Hey, how do I do this? It's driving adoption. We want people that are using Splunk, for example, to use as much Splunk as possible. It's licensed by the amount of data you ingest. So we're big fans. But also, you know, personally, it's just you want to make sure if they already have the tool, how do they use it? How do they get adoption? How do you make it valuable for them? So driving adoption and solving problems for customers is a big part of it.
Okay. Do you have any interesting war stories during your time in security?
Probably the first one, actually, when I was a network administrator, I don't remember if you remember the I love you worm was just a little VBS script that went after JPEGs and things like that. I remember that hit at a company I was a network administrator for. And we were fine because we had VBS turned off on everything. But the one person that didn't was the head of IT for some reason decided he needed VBS and Outlook. And he also had access to all the engineering shares. So it just went through and just obliterated every JPEG that these designers had done. And that's when we found out our backups hadn't been working for two months. Oh, boy. It had been running. Yeah, yeah. It was a fun time.
That was a little traumatic. That was an experience. But I think that was the first real security incident that I had to be involved with. Luckily, backups were my job. So it wasn't too traumatic, but still.
You were responsible for backups at that time? Oh, I was going to say. Okay.
No, I was not. I said, luckily, they were not. To be clear, yeah, that wasn't me.
Wow, okay.
But that was fun. Witty Worm was one that hit ISS-specific products. It was something that was written to take advantage of a vulnerability in our tool. And I was working the weekend that hit. And I remember I came in the morning, and the guy that was on the night shift looked traumatized. And the phones and the whole building basically ran off the hook because it was a worm that just affected our products. And it was pretty nasty. That was an experience.
Walk us through that experience. How was that?
So it was just damage control at that point. It was trying to relay to customers as much as possible about what we knew about what happened, proactively notifying customers, you need to take these systems offline if you have any issues here or you need to block this traffic. It was just damage control at that point. We had plenty of... Developers and researchers that were looking at root cause and trying to dig into past long information. But it was a lot of that. I was really in the front lines on that. So the front lines in front of the customer, not necessarily working on the issue.
Yeah, that's the worst feeling is to come in on Monday morning, whatever you're thinking, everything's okay. And you come in and see everybody with, they're just all hands on deck. I think I've been in that situation once. And that was just a weird feeling coming in.
Yeah, when it was over the weekend, too. So I was doing overtime. I came in on Saturday, ready for a relaxing day of reading and watching movies. And that was not the case.
Wow. So what are some specific things that you would recommend to put in the lab? So those trying to enter the field are probably going to try to enter as a security analyst or similar. So what are some tooling that you would recommend in the lab besides Splunk, of course?
So I always Splunk. Splunk is great. You can get a free license. Actually, if you are using Splunk and you sign up for a developer license, it's a bigger license.
Oh, really?
Yeah. It's hitting the 500 megs free. You can actually get the full enterprise one and get, I want to say it's 50 gigs a day.
Oh, wow.
Yeah. You just have to sign up part of the developer program. So if anyone's interested in that.
Okay. Is there any way that someone could get a trial of enterprise security and get experience with that?
I don't believe we have a trial version of that. Just because of how the architecture works, it's a little bit more difficult. Even for customers, a lot of times we'll stand up a virtual lab to make it easier just because of the setup involved. What you can do, though, is get the Security Essentials app, which gives you kind of a journey to take your data through. So it actually talks about, okay, well, if you're doing kind of level one at this, what do you need to get? Well, you should get this information from your routers and switches. You should get your DNS logs. And it kind of points you at the different types of data sources you can get And then says, here are some use cases around those data sources.
So it's a progressive thing that you can actually work through. There's a lot of overlap between that and enterprise security. Okay, cool.
So continuing on the lab, you know, is it going to cost a lot? Is there a way to do it on the cheap? Is there a cloud version you would recommend? You know, anything, any insight you could recommend would be great.
Yeah, I am exceedingly cheap. So my lab is done very much budget conscious because it's my own money I'm spending. So I'm all about that. There is kind of a path. You really can decide if you want to start doing things cloud-based or you want to do it as a home lab. Personally, I prefer to have things on site here locally because they're not production. If I'm going to host something that I want to have exposure to, it's going to be out in a cloud instance. And I might set up some rules so I can tunnel back, but I'm very much going to host that external. If I'm just doing lab stuff, I don't want to have to worry about securing those things. And so that's why I'd rather have it here on an isolated network that I can just hammer at.
If I'm going to go to a Vuln hub and download a bunch of VMs, I'm not going to have access to secure those because that's kind of the point. So i don't want to necessarily have those hosted externally there's a very much a reason to have a mix and i definitely do i use digital ocean i love those guys and i've accumulated a bunch of credits over the years so everything i host there is free for now so i'm very happy about that cool how did you get those credits or how does one get credits it's a referral program okay so as you refer people with a link and there's various ways to get that link out there and it is very effective when people signing up and paying for it so okay I'm not gonna disclose my techniques, because they're mine, and I want more credits.
You can use your imagination. All legitimate, all above board, everything gotta be legal. There's a different way. You can kinda go down either path. Personally, I think if you're gonna poke and prod at stuff, it's really good to have something local. And a lot of that, it can be a cheap system. You can run ESXi, which is a hypervisor from VMware, on just about everything. It's nice to have something on their hardware list, but you can run it on most things. Personally use a lot of Intel NUCs, which are $400 or $500 complete systems that are more than enough to run a bunch of VMs on. And I've got, I don't know, five or six of those at this point, so I can play with a lot of the VM stuff to move around.
The license for VMware, ESXi, you can get that for free from their site. So the software is inexpensive. But really, if you have a laptop or a desktop lying around, it'll probably run it. And it'll probably run it okay. And there's plenty of other systems. If you want to use Linux and do Proxmox or something like that.
You could do VirtualBox too.
VirtualBox is another one. Oracle's got a lot of free software out there. But there's plenty of ways to get a hypervisor on there that's going to run a virtual machine. And that's really the key. Once you can run a virtual machine, the utility of your lab goes up exponentially because now you're not worried about hardware. Getting multiple systems at that point is fun, but not necessary. Getting a managed switch is fun, but not necessary. Getting a SAN that you can, or NAS that you can attach is fun, but not necessary. There's a lot of things like that you can do. But really, once you have a good virtual server, I can use virtual networking. I can put firewalls that tap into that virtual networking.
I can do very complex things there. And I can emulate any environment I want practically. So the hardware is more of a luxury at that point once you've gotten past that first step.
Cool. So based on your experience, you've seen a lot of companies, you know, as a sales engineer, you get to see a lot of companies and their internal is like, what are the basic components you would use to start off on your lab? Would you start with like a DNS server and LDAP server? Like what are the few basic, I mean, everybody's probably gonna install Kali Linux, right? Which is good for like, you know, using sniffing tools and things like that. But from an infrastructure perspective, what would you do in a lab?
Well, just to note on Kali, one of the things that I recommend for that, especially if you're budget conscious, and I keep saying budget conscious, but I mean cheap, you can get a Chromebook and you can replace the BIOS on that with an open source BIOS, the CBIOS that a lot of the virtualization systems use. And it's a normal system at that point. So I actually got a couple and I've recommended to other people, get a $200 Chromebook, flash the BIOS, and then install Kali directly on that. Not in a change route environment like you've seen people do, but just natively as an x86 machine, you can install Kali.
Oh, that's a good idea. Yep. That's awesome.
You definitely want to have a tech source and not running into VMs kind of nice. I generally tell people, I mean, there's replicating corporate environment, but are you going to set up a full LDAP service to authenticate all your machines? Yeah, but it's, I don't know that you really get a lot out of that. What I would look at instrumenting once you set up systems is just go through some of the frameworks that most corporations go through. Go through things like, I don't know, the CIS, I forget who, they don't own it anymore. The CIS top 20 critical controls or the CIS critical controls. Go through that and look at what you need to set up. If you haven't got an inventory of your systems on your network, if you haven't got an inventory of what software's installed on there, getting down and doing pen tests, testing security environments is pretty pointless.
So you usually, you start with a little bit more mundane, but they're the biggest bang for your buck. If you're doing this on your home network and you follow that same framework, Now, not only have you done the things that make the most sense and what you're going to be implementing customer for your job, but you can also have that conversation with the hiring manager that, oh, well, this is what I like to follow. And if they're an infosec manager or higher, they're going to latch onto that like, oh, well, that's the framework we use. And so it's a good conversation to have. It's a good way to frame things and think about things and be less focused on the whiz bang fun stuff and more focused on the things that are going to get you the most bang for the buck and give you the most return is really
Useful.
Yeah, practical knowledge, that's useful. And I think you hit it right there, where, you know, you want to impress the manager that you've taken the initiative, you've done stuff, you're facing the problems that they're facing. Right? Yeah, good, good.
It's gonna give you a good list of tools to look at. I mean, eventually, you are going to start installing Network ids and things like that and yeah that's going to take you down a path we have to learn about taps and spans and you're going to have to look at that traffic and you're going to do stuff with it you're going to see what's encrypted you're going to look at other ways of dealing with encrypted traffic and like j3 and things like that are kind of fun but it is a little bit further down the road is that a framework Yeah, JA3, it's a project from some guys at Salesforce whose all their initials happen to be JA, so JA3. Oh, nice. Yeah, it's a way to profile TLS interactions. So encryption handshake, if you can profile it and you can get a hash of what that handshake looks like, now you can identify those connections over time.
Mm-hmm.
So just because something's going out to Amazon doesn't mean that it's using an Amazon cert. Maybe it happens to use this one certificate from Candy Crush. Well, even though it's going to Amazon, because you can profile the cert, now you can tell what that connection is because nobody else is going to be using their keys. So it's an interesting project. It's kind of fun. A lot of IDSs have taken it up because it's an interesting way to profile encrypted traffic.
Have you ever set up a honeypot at home?
Not that I've exposed. I've done them at work and I've plugged them in and kind of let people go, but not on my home network. I'm a little touchy about letting anything into my home network.
Yeah.
Yeah. That seemed like the greatest. I mean, if I'm plugging something off the switch, I do have a network that I can plug in that's going to use my internet connection, but can't touch my home network or my lab network. But,
Yeah, I know people that have had separate internet connections altogether for, I'm sorry, a honeypot or something like that. So, yeah, maybe that's where cloud would come into play, you know?
Exactly what I was going to say. I love using cloud for that stuff. Just throwing a system up and testing. If I don't do my normal stuff where I'm going to, you know, auto ban and I'm going to move SSH to a different port and some of the general obfuscation stuff that kind of cut down on the noise. If I keep the standard, does anyone get into it? Is there anything interesting that's happening?
Yeah.
It's a good test.
Yeah, it'd be good to just set up a honeypot, catch something, let them do something for a little bit, and then turn off the network access and then go in and see what was done. Right. Look at the bash history, things like that.
Test your instrumentation, too. If you're using, like, a client or something like that's recording data, see if they're going to go after that.
Oh, yeah, that's true.
Yeah. Record that stuff.
Great. Any funny stories from your travels over the past several years that you could share with the audience?
Oh, funny on command is hard.
Yeah, it is.
The funniest thing, it really doesn't have anything to do with security, but I was working with a customer who was beta testing one of our new products. And so I had to go on site with one of our performance engineers. And this person is kind of a back office guy. You know, he's social skills were not exactly. And the funniest, we go to lunch and the funniest thing I think I'd ever seen anyone do is this was in Chicago. We go into the restaurant and the customer gets in the little turnstile. And I think he thought that it was bigger than it was, but he jumps in and wedges himself in the same one. And they are, Just they're touching the whole way and they kind of have to duck walk through this it was the funny and the guy looked back at him like what is your problem oh man and he just kind of played it off never said anything about it like i thought it was bigger i lost it i hadn't lost that hard in a long time and then you guys still had to sit down for lunch for a whole hour afterwards huh it was very awkward oh my god which i loved i thought it was great because it wasn't me
Yeah.
And what was your role in that meeting?
I was a product manager. So it was my product. They're beta testing. So I was kind of bringing people in just to make sure that everything we were running into other issues, you know, it was kind of the end of that beta cycle. So we're bringing in specialists to go on site. That's right. Yeah, that was fun.
Yeah. So Adrian, any recommendations you have for those looking to get into the field?
Yeah, just, I mean, just get into it. I think CTFs are my favorite thing right now. We were going to do this a couple of days earlier, but I got pulled into the SANS KringleCon where they have their own CTF. It's a lot of fun. I think CTFs are a great way to test yourself. They're puzzles you can solve, which if you're really going to get into infosec and you don't see a puzzle and desperately want to solve it, Maybe that's not exactly for you because it's that, I think that drive that really most of us have. And if you're really going to get into it, I think that's perfect. So CTFs are wonderful. There's a lot of CTFs out there. And unfortunately, a lot of times when people think of CTFs, they think of the things at DEF CON where it's this very regimented, there's tiers and there's teams and these people have gone through all these other CTFs and got points to get there.
And that's those kind of team-based attack and defend CTFs are out there, but that's not what you're going to get started on. You're going to get started in the Jeopardy style. People have put out points. You've got to solve different problems and get different answers and different flags. And you have to do it without Googling that puzzle because people have written up answers for the CPS and how they solved it. You do that afterwards. But just putting yourself through that and going through and learning how to do something like where I got kind of got stuck is I'm not much of a reverse engineer or really any reverse engineer. And learning how to reverse binaries and get through code and disassemble code, I hit a wall, but I learned a lot going through that process.
So even if you didn't solve it, going through that is extremely useful. A lot of companies use those for hiring methods too, so not just polishing your skills. Sometimes those are put out as puzzles to see if there are people with the aptitude for infosec that may not be as involved with it yet. So I think those are great. Speaking of cons, I know people are always comfortable going to those. And it's kind of a big jump because you've got travel. You've got to stay there. It's a little clicky.
Somewhat ominous.
Yeah. Yeah. It's a big step.
Yeah.
All those talks are recorded. I mean, if you don't feel comfortable going to the go to YouTube, go to Iron Geek. Iron Geek's great. They have a whole bunch of even the smaller cons record videos for all those. You can go listen to talks. You can watch talks. They're going to give you a step up. But if you're not watching those videos on YouTube and Iron Geek, you're really missing out. I think that aside from like Reddit and some of the content I rarely even sort through it a little bit better. I think those are probably two of the biggest areas where you can learn a lot for absolutely nothing and get up to date, very current information. That's awesome.
Yeah. Can you share a little bit about your experience so far in the holiday sans holiday hack challenge? This will air actually much later. So by the time this airs, it should be done.
Well, segwaying right along, the first one that I saw once I got in, I mean, there was some, I think the first one as a joke was how do you get out of VI, which is kind of funny. As somebody who hates VI with a passion that burns with the strength of a thousand suns. I appreciated that. Side rant. Why? It's intentionally difficult to use. Vim is huge. It's like an 800K client the last time I looked on a lot of systems. It's just obtuse. It's ridiculous. Why not just use Nano or Pico or something that has just the slightest bit of user... Yeah, anyway, sorry.
I think you're trying to start a sysadmin war, huh?
They're wrong. VI is evil.
All right. Nice. Yeah. When a question, a challenge question is how do you get out of it? Like that's not, it's not accomplishing. Anyway, the first one I actually solved was the, you had a brute force, a passcode to get in the speaker's lounge. And you start typing, it's four symbols, you had to type in the right order. And as soon as you start typing them, as soon as you hit the fifth one, it's kind of clear and start over, it shifts. So it's a bit shift where it kind of shifts everything off. And now you've got this new code. And as soon as I saw that, I realized exactly what it was. Now, if I looked at the names, they had all sorts of other hints that would have gotten me there. But By validating with a bit shift register, you can do combinations of code.
So instead of having four digits and the number, you know, the number being whatever that combination is, by doing like one, one, one, one, two, those five numbers, you validated one, one, one, one. But when you add a two, the one shifts off. Now you validate a second number by only adding one. I know I'm butchering that explanation, but there's a mathematical formula where you can write a string that will come up with all the combinations in a drastically fewer number of brute force attempts. And I forget the actual name of it. I'd seen in a DEF CON video, there was people that were brute forcing garage door openers. And what they found was, at first, I'm like, well, we'll just pin off this four-digit pin.
We'll just brute force it and just run through them all. They realized that it was validating the bit shift register. And they got this attack down to being like three or four seconds. I mean, it was ridiculous how quick it would go through. And I may be off on some of those numbers, but it was a YouTube or a DEF CON video I'd seen from a couple of years ago. And I went out and searched it and I'm like, oh yeah, and that's the mathematical formula. And then I searched for that, found somebody had already written a Python generator for that sequence of characters, ran through it and, you know, 10 temps in or whatever it was, I got the code. Now it turns out the name of the challenge was actually that mathematical formula.
So there's another way I could have solved that. But that's the interesting thing about going back to these is after you've solved it, then you go search on the internet and say, okay, what's the answer for this? And you'll find 10 different ways other people have attacked the same problem. And it broadens your reach. The challenge is not looking at those solutions before you have solved the problem yourself, but you've got some leeway and you've got some follow-up work. A lot of people will write those up and write up their explanations if you come from a unique way. And it's a really interesting way of getting your name out there.
Yeah. CTF write-ups are just amazing. So definitely recommend that. Yep. Cool. So I think you wanted to talk about the internship program at Splunk. Do you want to mention anything about that?
Yeah. I just wanted to throw that out there that Splunk do an internship for a lot of different areas of the company. So we have a Splunk turn internship. We bring in interns for various roles, anywhere from legal to we actually have a couple of SE interns that will come in and do work along the side. So there's a lot of project-based stuff. So you will not just be in there and be running copies, but you're doing projects around that specific career path. And we do hire from those. So we do actually have a couple of SEs. I believe one of the SEs on my team actually came from the Splunk internship program. So it's a great way to get into the company, but it's also a great way to get some practical experience and not just be someone's lackey in doing the grunt work.
All the interns have specific projects that they work on during an internship. At the end, they kind of do a TED-style talk about what they did and what those projects are and how they help the rest of the company. So it's really, really useful. We've searched for Splunk interns, or you have a link for that. There's a lot of great information out there on that program.
So, yeah, interesting way I found out about you is it was through Sam's class. So, you know, I saw that you did a talk and a slide. So, you know, for folks, if they want to find out more.
It was kind of interesting that all came about actually because of a meetup. So I went to a meetup for OWASP. Where they do, every couple of weeks they do training and they'll do specific topics. And I got to talking with one of the guys who's a placement specialist, or I forget exactly his title, City College of San Francisco. And we just started chatting. We started talking about CTFs afterwards. And he actually asked me if I'd come out and talk about being an SE and specifically CTFs. That's what we kind of nerded out about. So that's where that presentation all kind of came from. I actually hadn't examined until the day of the conference or the day of the talk.
Nice. Yeah. So I'll provide a link to the talk and your slides. They'll be there. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.
