Episode 3 · · 43 min
Christina Hanson From HOA Manager to Headfirst Into InfoSec!
Security Analyst at Truvantis Cyber Security Consulting
Episode summary
Christina Hanson is a security analyst working for Truvantis Cyber Security Consulting and one of my former boot camp students. She has extensive technical experience and a deep understanding of the collaborative nature of InfoSec, not to mention how women and other underrepresented groups in the community have a more difficult time navigating this industry due to institutional barriers.
In our discussion, Christina touches on the wide variety of resources and events that helped her enter information security, why teamwork is just as important as technical work, and why InfoSec's responsibilities will continue to grow in the near future.
Episode Highlights
How Christina's aptitude for IT led her down the path to InfoSec
The "elective" course Christina took that turned out to be career-changing
Why cooperation and group work are so important in InfoSec
The "soft skills" needed to work in security
Infosec was not her 1st or 2nd career!
An overview of Christina's day at Truvantis and how she works with clients
Christina's experience at a SANS women's academy and the Day of Shecurity conference
Why the InfoSec industry needs contributions from people from all backgrounds and how it benefits from diversity in general
The increasing accessibility of conferences and other tech events for those who can't attend
InfoSec's important role as companies have more and more access to users' data
Quotes
"I found that just the general atmosphere of security and the overall focus of what you're trying to accomplish was really helpful."
"Anything you're gonna do in security, you're gonna do as a team."
"Being open to learning new things is really important with this particular field."
"Even if I don't understand everything they're talking about, it gives me at least a start and a basic understanding that I can then research later."
"Being a professional in this field, it's so important that we are able to make other people safe."
Before infosec: HOA manager and recreation supervisor
Chapters
- 0:00
Intro: Christina Hanson, Ayman's former student
Ayman introduces Christina, a security analyst and graduate of his bootcamp.
- 0:43
From HOA manager to the person who handles IT
Christina explains how technical duties at a homeowners association led her to go back to school.
- 2:31
Stumbling into Merritt College's security certificate program
She describes signing up for one class and discovering it was the first step of a two-year career-change program taught by working professionals.
- 4:42
What the classes and bootcamp taught: teamwork and soft skills
Christina says learning the jargon, hands-on bootcamp work and team projects mattered, and that soft skills offset limited experience.
- 8:58
A typical week at Truvantis
She describes compliance work, on-site security for clients, SOC 2 audits and her first pen test.
- 13:21
Two years to a first job: SANS Women's Academy and certifications
Christina tells how a placement test led to the 2017 SANS Women's Academy and three SANS certifications.
- 19:37
Resources for women in infosec: Day of Shecurity and the Diana Initiative
She recommends women-focused groups, meetups and conferences, many of which are streamed or recorded.
- 24:56
Staying current: SANS ISC, CyberWire and local meetups
Christina lists the daily briefings and Bay Area meetups she uses to keep up with the field.
- 27:06
Imposter syndrome, asking for help and why security matters
She says being open to learning and asking for help is key, and shares an anecdote about being optimistic for women in security.
- 33:40
Ways in: self-study, CTFs and Humble Bundle books
Christina outlines different paths into the field and cheap learning resources.
- 37:37
Human-error breaches, free lunch and sticking with the career change
She shares war stories from clients and advice on affording a mid-career switch.
- 42:39
Closing and Ayman's community plug
Ayman signs off and plugs his new community.
Key takeaways
- Translate non-tech experience into the skills employers want, e.g. 'I haven't done that exactly, but here is something I have done.'
- A vendor-agnostic program taught by working professionals helps you learn the jargon and understand real security conversations.
- SANS certifications carry weight with employers, and Security+ and Network+ are commonly listed for entry-level roles.
- Attend local meetups like OWASP and Dead Drop even when talks go over your head; they give you a starting point to research.
- Ask for help early; imposter syndrome is common and security work is done as a team.
- If the career change is financially tough, persist and find a way, such as a leave of absence and cutting expenses.
Notable quotes
anything you do in security, you're going to do as a team.
I think just being open to new things.
if you're really passionate about something and really interested in doing it, you'll find a way to make it happen.
Questions answered in this episode
- How did Christina Hanson get into cybersecurity?
- After years at a homeowners association where she handled IT, she enrolled in Merritt College's two-year security analyst certificate program, then took a four-week bootcamp and the SANS Women's Academy. It took about two years to land her first security job at Truvantis.
- Are SANS certifications worth it for career changers?
- Christina earned GSEC, GCIH and a forensics certification through the SANS Women's Academy and says they helped her get a job. She notes people who dismiss certifications often make an exception for SANS.
- What resources help women get into infosec?
- She recommends Day of Shecurity, the Diana Initiative, the SANS Women's Academy, women-focused Twitter accounts and regular local meetups. Many events are recorded or streamed for people who cannot attend.
Show notes and links
Show the original episode notes
Christina Hanson is a security analyst working for Truvantis Cyber Security Consulting and one of my former boot camp students. She has extensive technical experience and a deep understanding of the collaborative nature of InfoSec, not to mention how women and other underrepresented groups in the community have a more difficult time navigating this industry due to institutional barriers.
In our discussion, Christina touches on the wide variety of resources and events that helped her enter information security, why teamwork is just as important as technical work, and why InfoSec's responsibilities will continue to grow in the near future.
Episode Highlights
- How Christina's aptitude for IT led her down the path to InfoSec
- The "elective" course Christina took that turned out to be career-changing
- Why cooperation and group work are so important in InfoSec
- The "soft skills" needed to work in security
- Infosec was not her 1st or 2nd career!
- An overview of Christina's day at Truvantis and how she works with clients
- Christina's experience at a SANS women's academy and the Day of Shecurity conference
- Why the InfoSec industry needs contributions from people from all backgrounds and how it benefits from diversity in general
- The increasing accessibility of conferences and other tech events for those who can't attend
- InfoSec's important role as companies have more and more access to users' data
Quotes
- "I found that just the general atmosphere of security and the overall focus of what you're trying to accomplish was really helpful."
- "Anything you're gonna do in security, you're gonna do as a team."
- "Being open to learning new things is really important with this particular field."
- "Even if I don't understand everything they're talking about, it gives me at least a start and a basic understanding that I can then research later."
- "Being a professional in this field, it's so important that we are able to make other people safe."
Links:
- Christina's LinkedIn: https://www.linkedin.com/in/christinahanson461/
- Day of Shecurity: https://www.dayofshecurity.com/
- SANS Women's Academy: https://www.sans.org/cyb
- Merritt College: http://www.merritt.edu/
- Dr. Johannes Ullrich: https://twitter.com/johullrich
- SANS Daily Podcast: https://isc.sans.edu/podcast.html
- The Cyberwire Podcasts: https://isc.sans.edu/podcast.html
- OWASP: https://www.owasp.org
- Amanda Rousseau (@malwareunicorn): https://twitter.com/malwareunicorn
- Dead Drop SF: https://www.meetup.com/Dead-Drop-SF/
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
I'm really excited about today's show. Christina was one of my students and I'm really proud of where she is today. She is a stellar example and an inspiration in a variety of ways. And I think you'll feel the same after listening to the episode. As always, if this episode or any of my episodes inspired you, please leave a five-star rating and share with those you think will benefit. I'm your host, Eamon Aswa, and today our guest is Christina Hansen. Christina Hansen is a security analyst and relatively new to the security industry. In fact, she was one of my students at a bootcamp that I had. So I'm really glad to talk to Christina and I'm really proud of where she is today. And let's just jump into it.
So Christina, thanks for coming on to the show.
Sure. Thanks for having me, Eamon. It's nice to talk with you.
Great. Same here. Same here. So tell us a little about how you got into the information security industry.
Well, I had a couple other careers prior to going into infosec. And I had always had, not as a main responsibility, but I'd always been technical. And pretty much every job I'd had, I always ended up being the on-site supervisor. IT person. And my last job, especially, I actually worked for a nonprofit homeowners association. And our IT person left, and I kind of had been doing some technical type things. And I just kind of inherited that, along with working with architectural issues for the HOA. You know, I was there for quite a while, almost 10 years. And I realized while I was doing the technical stuff, that was really the part of the job that I really loved doing. And After a couple of years, I decided that's really what I wanted to do.
I kind of was done with all the HOA stuff, which is as glamorous as it sounds.
So I was really enjoying doing just all the technical and it was mainly network admin and things like that. So I decided I was going to go back to school. I was very fortunate that my boss at the time was really supportive of that and gave me time to go take classes. He actually paid for some of the classes to start with. And then as I kind of switched focus from general IT to security, I just was able to get time to do the classes and things.
That's awesome. And how did you find the transition? Did you find it difficult? Did you find that the classes helped? Some classes were better than others. What were some of the key factors in helping you transition?
The schooling part of it was, I really felt like I fell into it. And I live in Alameda and I started just going to my local community college that had some kind of general IT courses. Alameda College is part of the Peralta College system, which includes Berkeley, Laney, And Merritt College, as well as Alameda. And I was looking at the catalog, and I saw that they were having a class on network administration and server security. And I was up at Merit, and I decided, you know, I work with servers. I'm doing that. Security is really important. I should probably take that class. So I showed up at college at Merit, and it was a Friday-only class, so that was convenient for me. I showed up and I find out that it's the first class in a two-year certificate program to become an information security analyst or to change your career, basically.
So I was really surprised because that wasn't really what I intended to do. And I show up and they're saying, welcome, this is your first step of the rest of your life. And congratulations on making the decision. And I hadn't really done that yet. So it's kind of like, ah, really? Yeah. So the other thing about the MERIT program was that it is co-sponsored by a consortium of CISOs from Silicon Valley. So all of the instructors are professionals in the field. And it's definitely a hands-on experience where you actually know what you're getting into as far as the field of information security.
That's great.
And that was huge. That just made it so interesting and so... Hearing from the trenches, I guess, so to speak, as I was taking the classes, there definitely were some challenges on the material and things. And some folks didn't really get it, but the ones that did, you really just kind of, and myself included, just really kind of fell in love with it. And the rest is history, so to speak. Yeah.
That's great. That's great. What are some of the most critical courses that you felt helped you in your day-to-day career right now?
So most of the classes I took kind of gave a general overview of security and they did go into depth on a few items and different types of vendors and things. They try to be pretty vendor agnostic because you never know where you're gonna end up working if they use AWS, if they use Azure, if they have a seam that they're using that's very specific. You pretty much can learn those. That's something specific to where you end up working. I found that just the general atmosphere of security and the overall focus of what you're trying to accomplish was really helpful. And I loved the technical stuff and getting into different projects and doing that. But I think just learning the jargon, that sounds really funny, but being able to have a conversation and understand what people are talking about kind of helped focus that.
And I don't know if that answer is really what you meant, but kind of, yeah, I think just the general overview of learning about security as a profession really did that. And, you know, I also did a boot camp, which is where I met you. And that was definitely very technical. That was probably some of the most intense technical stuff that I learned. And that was near the end of my two years at Merritt College. So it fit in really well. And I really liked, since it was a boot camp, it was four weeks long. And it was kind of repetitive in the sense that the skills that we're using built upon each other. And that was really helpful as well.
Okay. I hope I wasn't too hard on you. Yeah.
No, you're kind of scary to start with, but... Especially that interview.
Yeah, I want to read out the... Oh, yeah? Which interview?
Well, we had to do the interview to get into the boot camp. You were the technical interview. We had a social or like kind of the professional interview. And then we had the technical interview and you were pretty hard. Everybody was freaking out. But I did okay. But obviously I made it in. But no, that was really good. And also the other thing that I think with all the classes that I took that was really stressed and in yours as well as the classes at Merit is that anything you do in security, you're going to do as a team. There isn't really an individual. I'm sure there are jobs that are for individuals. But from what I was learning, working as an analyst or working as an engineer or any of those types of positions that I was training for really helped.
You're not the only person there. You have to work with other people. And everybody has their strengths and weaknesses. And just working together, you can accomplish so much more. And the job that I ended up taking, that's really been the case. So that's a huge part of it. And I also, you know, I played team sports growing up. And I also, my previous, one of my other careers was I used to do, I was a recreation supervisor. For various cities. So I did a lot of special events and a lot of sports programming and things like that. So I kind of had that already down pretty well, so to speak, the social part of it and the soft skills, as he says.
How important are the soft skills in your job, would you say?
They're huge. Having gone into security as not my first career, technically on my third career now, And when you don't have a lot of experience specific to what the job is that you're applying for, you need to be able to even that out with other skills that you may have. I got to know a lot of students during Merit and the boot camp and things that got really stuck on that they didn't have any skills because they'd never worked in tech before. And I don't look at it that way. I always have looked at it as any job that you have, you can equate the experiences that you do have to the skills that they're looking for. And I try to help people with interviewing and things like that as well. But if somebody asks you something that you don't have any specific skill on, you can say, well, I haven't done that exactly, but here's something I have done.
And it often is really kind of similar. And it's a lot of just confidence and making things work. So... But yeah, that's a huge thing too.
So what's a typical day or week or month in your job? I think you have different environments that you're in and you transition from one end to the other. But maybe describe for the audience, what's a typical week in your job right now?
Okay, so as an analyst, I work for a small company. It's called Truvantis and they're based out of San Jose and we also have a San Francisco office. So we do a couple different things. We do compliance and like PCI and Compliance type stuff. We also work as CISO for hire. So we actually are for small and medium sized companies, we will go in and actually be your security team. And so a lot of that is compliance or security vendors, security reviews for vendors, questionnaires that have things like that for the business side of things. And then the other thing is the technical side of things where we do pen testing as well as vulnerability scanning and pretty much anything that our customers need.
So for me being new, I was still not totally sure what areas I really wanted to focus on. But obviously having good customer service skills was really helpful. And so I've kind of been focused more on professional services now. I currently have three different customers that I actually will go to their site and work at their offices and be their onsite security person. Since most of the companies are small or medium size, they don't need somebody 80 hours a week, so they'll hire us and we go one or two or three or four days a week depending on the customer. So that's kind of my main focus, and it's sales-oriented in the sense that we support sales. So if somebody from one of the companies, if they have a potential customer and they want to look at our security posture, we provide that information.
We just went through our SOC 2 audit. That was actually really interesting on preparing that. We've done that now. This is the fourth year. So it's a pretty strong security mind at this particular company that I'm mentioning that's kind of my main hours. And when they do get a new customer, we review their contracts to make sure that the clients are happy and that we meet all their standards. We also do all the technical side where we're reviewing individual computers and The IT department kind of does the hands-on part, but we supervise and make sure that all of the security programs and things that we have are in place and they're being utilized correctly and all the scanning that's being done.
And we work with engineering quite a bit to make sure that they're secure or if anything comes up with the platform. So a whole lot of stuff. I kind of rambled a little bit there. Sorry.
No, no, no. It sounds like you're busy. Every day seems like to be different, basically. Everything's something new.
It is. I mean, I do like that because I do tend to get bored kind of easily.
Well, third career.
Yeah, exactly. You notice that, huh? And it's funny because not really even being sure exactly where I wanted to focus. I know a lot of people when I was in school wanted to do pen testing. And I wasn't really sure if I wanted to do that. But our pen tester where I work left. And so we had an opening. So I just finished my first pen test. And that was fun. I mean, it was stressful because it's a lot different than the labs that you get in school. It's, yeah.
Not as glamorous as they make it to be, right? Yeah.
No, it's not. It's kind of repetitive stuff. But I find it interesting. I mean, since I'm new to tech, every time anything happens, and for example, one of the companies that I work at got bought out. And they're a startup. Basically, they got bought by a venture capital or not a venture capital, I'm sorry, an equity group. So they purchased them, and I guess when they made the announcement and everything, I was very interested just because I'd never been through anything like that working for nonprofits and cities in most of my other jobs. So it was just very interesting to see how things work and find out what stock options mean. It's just how that affected the people that work there. As a contractor, it didn't affect me personally, but it was kind of an interesting education, I guess, is a good way to put it.
So how long from when you actually decided that you wanted to be in the security industry to when you got your first job? How long did that take about?
About two years. Okay.
And a lot of that was mostly in education. Is that right?
Yeah, one other thing I didn't really talk about with the education is that while I was actually – it's kind of a funny story. You can edit it out if you don't like it. So while I was actually doing the boot camp, one of the options that we had for the boot camp was an opportunity to take a SANS information security course. And they were planning to pay for it, which was really generous because it's very expensive. It's like several thousand dollars for the class. And then there's a certification test, which is also very expensive. During that time, we were talking about taking this test and I decided to do some research. And so I went to the SANS website. And was taking a look to see what was included on the test.
And as I'm looking, I noticed that they have a SANS Women's Academy that they were promoting. I guess at the time they were doing their first year and they were promoting the second one they were doing this. So this was last June. And as I was reading it, I didn't know that I qualified because it was saying you had to be a college student and some other requirements. And I had only been going part time, so I wasn't sure if it included me or not. But they had a practice test or sorry, a placement test. And so I thought it would be a really good opportunity to take a SANS test as a practice for the one that I was going to be taking for the boot camp. So I signed up, I sent them my email and they sent me the test and I took the test and you had to take it within three days of getting it.
So I took it like two days later. And felt like I did pretty good, but I, you know, I was Saturday night at home watching my exciting life. But you know, taking this test and I, you know, I kind of prepared for it, but I didn't, you know, I didn't really know what to expect. So apparently I did pretty well. I ended up getting a call from them and they asked for my resume, which I sent to them. And then I got an interview and long story short, I ended up being one of 24 women selected for the SANS Women's Academy for 2017.
That's wonderful.
That was awesome. And I have to say that, you know, any certifications and things, pretty much any professionals you talk to, they kind of poo-poo the, you know, certifications. They'll say, oh, yeah, it's more experience. But then if you say it's a SANS certification, they go, oh, except for SANS, because those are really good certifications. So I was able to take three different courses and take three certifications that I completed in like a nine-month period last year. So I just finished. Actually, it was a little over nine months. So I finished in the beginning of 2018. And I have my GSEC, the general security, and then the GCIH, which is certified incident handler, and then forensics or certified forensic analyst.
So that really helped get a job.
Yeah, I was going to ask you about certificates, basically. Are there any particular, did you see a lot of requirements for certificates for some of the jobs you're applying to? Were they asking for it a lot? You know, tell me more about the, because a lot of people ask me about certificates, and I'm sure they ask you as well, certifications, so.
Yeah, I think it's a good idea with like Security Plus or Network Plus. Those are, I think, a good starting point for a lot of people. Those were always listed for most of the jobs I was looking at. But the SAN certificates were definitely listed, especially when it came into like the specialty areas. I'm more of a generalist at this point because I haven't really focused on one specific area of security. I'm doing a little bit of everything. With school at Merit, we focused a lot on pen testing and we did a lot of capture the flag exercises and things like that. When I did certifications for SANS, I didn't want to do pen testing because I wasn't totally sure I wanted to work on that. I chose forensics.
I had taken one forensics class. But it was really hard because I didn't feel like I had as much background in that or as much training or whatever. But that was really tough. A lot of people that do forensics only do forensics. I mean, it's kind of like a main focus if that's your career area that you'd like to go into. And it was really tough for me, but I really enjoyed it because it was really new. So everything with the certifications, the first two were pretty much reviews of things I'd already been familiar with somewhat. And I jumped into a SANS class that I really didn't have much experience at all doing. And I'm glad I did. It was really tough. But I think just kind of being open to learning new things is really important with this particular field.
So, you know, that was good.
Yeah. And all the classes were in person or were they remote and virtual?
The first one was in person. And we had of the 24 women, they did three separate cohorts. So there's a Western, Central and East Coast cohort. So we were in the Western one. There were eight of us, and we all went to Denver and met each other. And the other two cohorts that were in the Midwest and East Coast, we all had a Slack channel together and supported each other and kept in touch and still keep in touch during that process. So anyway, the first one was live, and then the second and third certifications were online. So we had the tapes, basically. But it's still... Really well supported. They have subject matter experts and you can call and if you need help, they can help you. But that was one thing I saw you recently at DEF CON.
And that was the first opportunity that I'd had to meet a lot of the other women from the Academy that I hadn't met in person. So that was actually a really fun trip to kind of meet these people that you've been in touch with and relying on and asking questions of for a year and gone through this shared experience. And that was really a highlight, I think, for me.
And now a message from our sponsor. What are some other resources that can help other women in the field that are trying to get into information security? Is there anything that you could share from that regard?
Yeah, it definitely has been growing. You know, being in the Bay Area is really fortunate because there's just a lot of opportunities here. And talking to some of the other women that I've been meeting, you know, it's tough when they're in a smaller town or someplace that's not as forward thinking as the Bay Area. So that's been kind of an interesting thing. One thing that I've done is I started kind of a separate organization. Twitter handle, separate from my just personal one, that I followed as many interesting infosec women that I could find. And you just start clicking on links and you can start following people. And I get so much good information from that of classes that are happening or that opportunities that have come up or conferences, things like that.
And that's been really fun. I mean, I try to go at least once a month to a meetup in the city. And those are usually not focused on women, but there are some that are kind of going that way. But by doing that, I've met other people and you kind of can have shared interests and things. There was recently a women's only conference in San Francisco called Day of Shecurity. Yeah. Security was she. And it's hard to say, but it's still pretty cool. And they did a great job. So Matt Toth was one of the organizers for that. And he's in infosec and a father of a daughter. So he's very focused on being supportive of women in the field. And him and it was a totally volunteer thing. Had a bunch of really awesome people that put that together, and it was a one-day event.
I volunteered, and I just did grunt work, whatever. I didn't really have much to do, but the folks that came in and organized it and took care of everything, it was really nice to see that was the right thing to do. The event itself was pretty amazing. It was about 200 women that were interested in getting into security. That's what they were there for. So there were guest speakers, there were classes, there were interviews, there were companies that were, you know, looking to hire that were helping out and giving information, free swag, all that kind of good stuff. So that was really awesome. So I believe they're doing that again. It was June, I think. So if anybody's interested, that's something you could probably look up.
I'm sure there's a webpage or You know, or Twitter or something. So that was really cool. Another event that I got to go to this year was a two-day conference that was going on while DEF CON and between DEF CON and Black Hat. So on Thursday and Friday of that week, they had what's called the Diana Initiative, which is another pro-women's group to try to get more women involved in infosec. And again, it was focused for women or anybody that identifies as women. And they just had all kinds of talks. All the presenters were women. It was really interesting and just being able to meet people in the field. And that was really empowering as a, I think kind of gets overused a bit, but it really is.
It's wonderful to go and have people that have the same experience and that, you know, have the kind of same issues that they're facing and wanting to be successful in this field.
There's something to be said about just attending a conference in general, but then attending a conference where you could find other people in the same boat as you, that's just even better.
It really is. And I've had a really great experience since I have started in infosec. Even going to school, you know, it was mainly men at Merit, but it was also, we had a lot of diversity there. And that's something, one of the instructors there, he likes a quote by Jesse Jackson that is, he said, infosec is pale, male, and stale. And The instructor that brought that up or that quoted that, he goes, yeah, he goes, everybody looks like me. He's like, you know, white guy in his 50s. He goes, but it should look like you. And he pointed to our class, which was, you know, a lot of diversity and women. And, you know, so that was a nice environment to be in to learn and understanding that's important and needs to be recognized.
That's really good that there's these programs coming up and just really being supportive of the community. I mean, I guess we're lucky in the Bay Area to have some of these programs, but I'm sure other areas in the U.S. could benefit from that as well.
And I think, you know, we're in a technical age where pretty much any of this information is available online eventually. So even if you aren't able to attend, like I know with the day of security, I know that they taped everything. So I do believe they have a YouTube channel now that we're talking about it. So, you know, that might be something if somebody is interested in looking up and finding out about, it's a pretty good place to start.
I think they live streamed it too. Is that right?
I think they did, yeah. I TA'd for the Burp Suite class, so I was kind of back in one of the rooms. But yeah, they had a lot of technical people there doing the... Well, everybody there was technical, but they had a lot of people doing the audio-video stuff.
Yeah, yeah. And I'm starting to see more live streaming of some of the events, so that's kind of cool. So how do you stay on top of current events and news and things like that?
Well, I have a couple... Daily briefing kind of podcast-y things that I listen to. I like the SANS Internet Storm Center. And they do just a quick recap. It's like five minutes. And they talk about kind of current events of what's going on. And Johanna Sulrich, who's the director for that and one of the deans at SANS, he actually was a guest speaker for our SANS Women's Academy. And it's funny when you start meeting some of these folks that you've either studied from or learned from. And you get all excited because it's like rock star kind of status. I kind of geek out on that. But anyway, so he actually came and spoke to us. So I'm a big fan of his. I also listen to CyberWire and I get their emails.
So that's an easy way to follow up with them as well. Just of current events of what's going on. You know, they're not too long. That one's a little bit longer. It's like 20 minutes or so daily. And I also really like, as I mentioned before, going to meetups in the city. I try to go to OWASP. Bay Area OWASP. They actually do one that's South Bay and then they do one in the city. Go pretty regularly to that one. Another one I really like is hosted by Malware Unicorn who is Amanda Rousseau who is a researcher over for Endgame and she's just super intelligent and very interesting and she puts one together pretty much quarterly. It's called Dead Drop San Francisco and that's a pretty fun one too.
It has really good people that are Highly technical. A lot of times with the meetups and things, the talks are way over my head and they'll be really specific to either bug bounty type stuff or reverse engineering and things like that. But I don't really do that yet, but I just find it so interesting. And even if I don't understand everything they're talking about, it gives me a place to start and a basic understanding that I can then research later and find out more about it.
So a combination of meetups and conferences and then also some online podcasts and other resources online. What's one thing that makes you successful in what you do right now?
I think just being open to new things. When I was doing the SANS program as well as at Merit a bit, There's the whole talk about imposter syndrome and that there's so much information out there that you kind of feel like, yeah, you've got some training. You've got a little bit of experience. You feel like you shouldn't be here because you don't know enough. And that was really tough when I first started. I think being able to just be open about that and ask for help. Is something that I've had problems with because I usually pick up things super quick and I don't have to ask for help because I can figure things out on my own. That's one of my strengths. But when you're in working for somebody that, you know, the expectation is that you either know how to do this or you're going to be professional and find out how to do it, you need to be able to ask people for help.
And that's been probably the biggest thing I've learned this last, it's almost been a year now that I've been working. But I do pick up on things pretty quick. So it's, you know, once I do ask, it's, you know, I get it pretty quick. So that makes it, you know, not stressful, but it's just kind of a learning curve. And it's a little different than other jobs that I've had. In the sense that it's always changing and that there's an urgency a bit when you are doing something. You can't just take time to figure it out. You kind of need to know how to do stuff if you're going to be successful. So I don't know if that makes sense.
No, it does. I think letting go of your ego or understanding the reality. I think imposter syndrome is pretty common, even among senior folks too.
Well, it also kind of goes back to... The team player thing that I mentioned before, too, is that you have other people relying on you. So a lot of what you're doing is not just an individual project. So it's just working together. And that's one thing I've been really happy with the company that I chose to work for. The other folks that I work with are very knowledgeable and super helpful. And if you are struggling with anything, they're just, oh, yeah, do you have time? Let's talk right now. And we jump on Zoom and do a quick meetup or whatever. That's been a really positive experience for me.
What was the first computer you ever had?
I think I got a 3.1 version of Windows that was a hand-me-down from my stepbrother. I don't even remember what brand it was. It was like Compaq, I think, maybe.
Or Hewlett-Packard.
Maybe it was HP. I don't even remember, but it was like a But I remember the color scheme and making it unique and it looked awful, but I thought it was really cool. She could change all the colors and do stuff. Yeah, I don't know. Even in school when I, I don't want to date myself, but when I first was in college, we had to go to the computer lab because not everybody had their own computers and working on things. Even then, you know, in hindsight, you kind of look back and go, Oh yeah, I totally, I was like the only one that could figure out how to get that working and I helped everybody else in my class. And yeah, if I realized then that was a really good skill to have, I probably would have been doing this a lot sooner.
Well, you did maintain it. I mean, it seems like you did maintain it, you know, throughout, maybe on and off, but right.
I did. And I did do some design work. So I did desktop publishing and web pages and some things like that. So kind of computer related, you know, and I've always just been able to been the person to call when something goes wrong.
Grandma and grandpa always need some support. Yep.
Yeah.
What are your thoughts on the security industry today? I know you're new to it, but what are your thoughts on it and how it is right now?
It's really the last few years with all the breaches. And I think there's kind of a new accountability for business that they really need to be more careful with. The information that they collect from their customers. And, you know, with everything that's been going on with the elections and foreign powers and things like that, people are going to be a lot more aware of what's going on, which I think is a sense of accountability, which is really important. And, you know, being a professional in this field, it's so important that we are able to make other people safe. So whether it's a business or individuals or I think it's just really important and people are kind of finally realizing that.
Right. We'll be better off as a society collectively if everybody's really taking care of their security.
It's funny. Here's another anecdote. So when I first went to SANS and we were on site for the very first testing, we got taken out to dinner by one of the previous year's graduates for the SANS Women's Academy. And so there's like eight of us or 10 of us that are there having dinner and And we were supposed to go around the room and around the table and introduce ourselves. And I happened to go first. And I had already been taking classes at Merit for about a year and a half. And I think I mentioned before the CISOs that teach the classes are very supportive of diversity and of women and I made the comment that I thought it was a really great time to be getting into security as a woman. I think that's just mainly because of the environment that I had been learning from, had been very supportive and everything.
But half the women had their mouths hanging open and were looking at me like, are you nuts?
It's really difficult for women right now. And there aren't enough women. And that's the problem. And I said, okay, dialing it back a bit, you know, and there were two other women from the Bay Area. So they knew what kind of I was talking about. But, you know, trying to have to explain that, yeah, there's a problem, but we can solve the problem or we can help fix it. I just think that's a perspective of how you look at things as well. I tend to be a little more positive on things. It just still makes me laugh when I think about that, of making the change and hopefully making things better.
What are some things you recommend to people who want to enter the field right now?
I think you have a couple different paths to do so. I personally, having already had a couple careers under my belt, Didn't want to go back for a four-year or a master's degree. That really didn't interest me on the timing of it. I was very fortunate that the program that I found was local, was very strongly supported by industry, and had some other good opportunities with it. You don't have to go that route. I've met other women and other people that are completely self-trained because they are able to find things online and learn it themselves. Pretty much the entire time I was in school, I think I only had one textbook. Because everything is so new and changing all the time that all of our resources were online.
So that's a good opportunity for anybody pretty much that wants to get into security is to check out what's how-tos on different areas. They have a lot of capture the flag type competitions that you can do after the fact. So you don't necessarily have to compete at that time, but you can learn about stuff, whatever interests you. And I just think there's so much out there You know, you just need to kind of look for it. And the meetups are a good thing, too. You can meet people and talk to them and things like that.
Well, YouTube is awesome. There's everything.
Yeah. Well, it's kind of incredible how much just the information that's available. I mean, I still use that when I'm working on something and I get stuck. It's like, oh, just, you know, ask the Oracle and you find out. You pretty much can find anything, you know, if you're determined. Yeah.
Yeah, I was just looking at a video. I just randomly saw a video today. Someone called Engineer Man, or Engineer Guy, and he wrote a Python script to combat a Craigslist scammer. Basically what he does, he just wrote the script from scratch online, and he's walking you through how to write the script. I'm like, this is great. I've got to send this to everybody who's trying to learn Python. I'm like, watch this guy's videos, or learn Python the hard way, or whatever it is. Yeah.
You gave us that when we were in class. It was awesome.
Yeah, I still use it. Yeah, I mean, I still recommend that site. It's just awesome. That's how I learned it.
Yeah, that and I also, another good tip for people, I do like books. I'm kind of a bookworm and a book hoarder, I would say, probably. But another really good resource is Humble Bundle. You heard of that?
Yeah.
Humble Bundle is amazing.
They just had a security one, like maybe during DEF CON, I think they had a security bundle. So everyone wants to know they have a security. Is that what you're talking about? Security bundles?
Yeah. So they do bundles of books. They're online books. And a lot of them are from known publishers like No Starch Press or Wiley is the other one that they have a lot of. And they basically, it's a, you pay like 15 bucks or whatever you want to pay and you get 10 or 12 books that you can download. And they have ones that I kind of learned about it when I was in school and I was just pretty much anything on Unix, on Linux, on Python, on, you know, defensive hacking, anything. I mean, they have different themes and they do them about every other month. I have a ton of books because of that, but it's a great resource.
Yeah. And they're all DRM free or most of them at least. So it's awesome.
And even if it's, I'm kind of at the point now where I've done so many of them that they'll do a new bundle and I have like most of the books, but there's one or two that I don't have. So I'll go, I'll just buy them again. It's just kind of like, okay, I know it's, it's kind of an illness, but that's okay.
You're a digital hoarder.
Much better than the other kind.
That's awesome.
Good stuff.
That's awesome. You got any cool war stories you could share with us from your past year in infosec?
Not too many. I mean, the companies, the clients that I work with are pretty good shape for most of them. We have had a couple breaches. Most of them have been kind of like operator error where a company will call up and ask for details on some kind of analytical data that they wanted for the past year or something. And our customer service team would provide it, but then they'd accidentally, when they were sending it to them, they forgot to change the code on the script and it's the wrong customer data was sent to a different customer. Things like that, human error kind of things. So we really do, a lot of things I've seen have been ways to automate. So to prevent kind of the human error from rearing its ugly head.
But most of them are pretty stable, I think.
Just being new to IT in general or to tech in general, it's just been kind of an interesting, you know, I explain to people or I'll be at an office and the things I take for granted, I kind of, you know, I'm so enamored of or shocked about or whatever. Like free lunch, that's the best thing ever. And then you're working with somebody that's complaining about the lunch and I'm like, it's free lunch, what's your problem?
Well, that's definitely a Bay Area bubble thing, so...
I know it's kind of like, it's like, really, that's your problem today?
Yeah, yeah. I heard that, yeah. When people come from, I mean, there's a lot of transplants when they come out and they see free lunch. They're like, oh, this is awesome. But, you know.
Yeah. I mean, and it's perspective, so I get it. But, you know, and it is part of your compensation. So it is, you know. But it's just an interesting view on things of being new to tech. Yeah, it's been interesting.
Anything else you'd like to share with the audience?
When I first started taking classes, it was an interesting situation because I kind of found out I was at the beginning of this program and it looked like a really great opportunity. And as I started taking classes, I really liked it. And, you know, I'm a working person with a mortgage. And, you know, they started talking about having to do internships and basically working for free for somebody for a while. And actually, most internships in the Bay Area are paid. So it's a little different than my initial expectation. But it was really terrifying to me because I was like, I can't afford to do that. I kind of kept making excuses for myself of why this wasn't going to work. And it's interesting because things just worked out.
And I know that's not always an option for everybody. But I think just if you're really passionate about something and really interested in doing it, you'll find a way to make it happen. So, you know, that's a tough situation if you're currently working and going to school and doing that. But just stick with it and things will work out. That's kind of my advice.
That's great advice. That's great. Yeah, because there's a lot of people in that situation. So where, you know, they're trying to change mid-career, but they still have to pay the bills. So you can't just take this time off for a full-time camp or whatever it is. You know what I mean? So...
Yeah. And, you know, it was tough. I ended up, I did end up taking a leave of absence a bit from work and was very fortunate I was able to do that, but it was, it was pretty tough. I mean, I canceled the cable and I, you know, I had to cut back on everything, but you can do it. And it's, that's what's, I think about even when it first started and they started talking about the expectations for the program. And I was like, there's no way I can do that. And just the, The initial reaction and even other folks that I was at school with kind of had said the same thing or, and some people dropped out and didn't even try or, you know, I shouldn't say they didn't try. They, they weren't able to make it work, but it's just something that might take you more than two years to do it.
But if it's something that you're really passionate about, I think it's worth it.
Okay. Persistence and grit.
Yeah. So those are good things. Yeah.
Yeah. Yeah. There's something to be said about that. Well, Christina, thanks for coming out to the show. I really appreciate your time. A wonderful conversation. And where can people find more about you?
I'm on LinkedIn. So it's Christina Hansen. I think I'm 461 is the number. LinkedIn's great. When I first started, that was one of the things we were told we had to do was get a... LinkedIn profile and it's actually really been a positive thing. So I'd suggest that too. Yeah, I'm pretty active on that.
Good. Well, thanks so much for coming on and have a good evening.
Yeah, well, thanks a lot, Eamon.
Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.
