Episode 7 · · 35 min
Clay Wells From SysAdmin to Security Architect to Con Organizer!
Information security at the University of Pennsylvania School of Arts and Sciences; Blue Team Village coordinator
Episode summary
Clay Wells has been living in kernel/userland since Red Hat 4.0 Colgate. Worklife has primarily been in academia and has included programming, system administration, and information security. He's a point of contact for the DC215 group and one of the Blue Team Village coordinators at DEF CON. He also created unofficial CTF challenges for local hacker cons and organizers for the first annual WOPR Summit this March 2019 in Atlantic City.
Clay, a security architect, musician, Defcon Blue Team Village Co-Organizer, and organizer of the first annual WOPR Summit, shares some really insightful tips on making it Information Security, as well as a fascinating recent war story.
WOPR Summit is March 1st, 2019, in Atlantic City!
Quotes:
"My heart was racing... that was a huge rush, and that's when I was like yea... blue side F*** rocks!!"
"Take a holistic approach to InfoSec, dive into the culture, different cons, music, people...volunteer, get out, get involved."
"Learn a little about everything, then find what really interests you... and go for it!"
"It's great to apt-get stuff... but try compiling a custom Linux kernel."
"I'm a strong believer in embracing that creative side."
"[Blue Team] certainly hasn't been the sexiest infosec job to have... yes, defense is what people want... there's a lot of defense work out there."
Before infosec: Programmer and Linux system administrator in academia
Chapters
- 0:00
Intro: Clay Wells and his blue team story
Ayman introduces Clay as a Penn security professional, Blue Team Village coordinator and WOPR Summit organizer.
- 1:07
Twenty years in academic IT
Clay traces his path from computer support and Windows 95 rollouts to programming and Linux system administration.
- 3:55
The security reading group
He describes the weekly lunch reading group that alternates technical and non-technical books and his exercises for co-op candidates.
- 8:41
Commodore 64 and his first hack
Clay recalls typing in magazine code on a Commodore 64 and getting hooked on BBSs at a friend's house.
- 12:22
War story: taking back a compromised server
He finds a SQL injection, cracks the changed root password with John the Ripper and kicks the intruder out.
- 16:14
Why blue team work is overlooked
Ayman and Clay discuss how most jobs are on the defensive side even though red team gets the glamour.
- 16:48
Blue Team Village at DEF CON
Clay describes the first Blue Team Village, its OpenSOC defensive CTF and its community-built resource page.
- 20:00
Advice: be holistic, script and compile things
He recommends getting involved in the community, learning Python and sysadmin basics, compiling Nmap and a Linux kernel, and reading old Phrack issues.
- 22:44
Founding the WOPR Summit
Clay explains why he started an affordable, hands-on Atlantic City conference and what the March 2019 schedule looks like.
- 29:48
Introducing kids to infosec
He suggests Minecraft modding, No Starch books and community outreach for young people and privacy awareness.
- 32:04
Sponsors, volunteers and nonprofit plans
Clay lays out sponsorship levels, the need for volunteers and plans to become a nonprofit.
- 34:25
Closing: Ayman's new community
Ayman thanks listeners and plugs the community he is building.
Key takeaways
- Take a holistic approach to infosec: attend cons, volunteer, meet people and learn a little about everything before choosing a focus.
- Learn basic system administration and a scripting language such as Python, even just through small exercises.
- Go beyond package managers by compiling tools like Nmap and building a custom Linux kernel to understand how your systems work.
- Join or start a security reading group; alternating technical and non-technical books keeps learning steady and builds a local network.
- Do not overlook blue team work, since most security jobs are defensive and the work can be as thrilling as offense.
- Embrace your creative side, such as music or art, to recharge and stay motivated.
Notable quotes
take a holistic approach to infosec. Dive into the culture, different cons, music, people. Volunteer, get out, get involved.
It's great to apt-get stuff or to yum install things, but try compiling a custom Linux kernel.
I think it certainly hasn't been like the sexy infosec job to have. But yeah, defense is that's what people want. There's a lot of defense work out there.
Questions answered in this episode
- How did Clay Wells get into information security?
- Clay spent about twenty years in academic IT, starting in computer support and moving into programming and Linux system administration. Security was a growing part of those jobs, and about eight or nine years ago he moved into it full time after joining a university security reading group.
- What is the Blue Team Village at DEF CON?
- It is a village dedicated to defensive security that Clay helped coordinate. It featured talks, volunteers and an OpenSOC defensive capture-the-flag from Recon Infosec that used free tools such as Graylog and Kibana, plus a community-curated resource list.
- How can a beginner learn infosec the way Clay suggests?
- Clay recommends learning basic system administration and Python, compiling open source tools and a Linux kernel, reading both technical and non-technical books and going to cons or local meetups. He also suggests volunteering to meet people in the community.
Show notes and links
Show the original episode notes
Clay Wells has been living in kernel/userland since Red Hat 4.0 Colgate. Worklife has primarily been in academia and has included programming, system administration, and information security. He's a point of contact for the DC215 group and one of the Blue Team Village coordinators at DEF CON. He also created unofficial CTF challenges for local hacker cons and organizers for the first annual WOPR Summit this March 2019 in Atlantic City.
Clay, a security architect, musician, Defcon Blue Team Village Co-Organizer, and organizer of the first annual WOPR Summit, shares some really insightful tips on making it Information Security, as well as a fascinating recent war story.
WOPR Summit is March 1st, 2019, in Atlantic City!
Quotes:
-
"My heart was racing... that was a huge rush, and that's when I was like yea... blue side F*** rocks!!"
-
"Take a holistic approach to InfoSec, dive into the culture, different cons, music, people...volunteer, get out, get involved."
-
"Learn a little about everything, then find what really interests you... and go for it!"
-
"It's great to apt-get stuff... but try compiling a custom Linux kernel."
-
"I'm a strong believer in embracing that creative side."
-
"[Blue Team] certainly hasn't been the sexiest infosec job to have... yes, defense is what people want... there's a lot of defense work out there."
Links:
- Clay Wells on Twitter: https://twitter.com/ttheveii0x
- Clay Wells on LinkedIn: https://www.linkedin.com/in/clayball/
- Clay Wells Blog: http://www.cwells.org/
- WOPR Summit 2019: https://www.woprsummit.org/
- WOPR Summit Sponsorhip Prospectus: https://static1.squarespace.com/static/5b81b8f745776e48dcfb884d/t/5ba666dbf4e1fc68321a7a27/1537631964367/wopr-summit-2019-sponsor-prospectus.pdf
- DEF CON Blue Team Village: https://blueteamvillage.org/
- Opensoc by Recon Infosec: https://opensoc.io/
- Recon Infosec: https://reconinfosec.com/
- BsidesDC: http://bsidesdc.org/
- Graylog: https://www.graylog.org/
- Kibana: https://www.elastic.co/products/kibana
- H.O.P.E Conference: https://hope.net/
- No Starch Press: https://nostarch.com/
- Outro Music by Clay: https://soundcloud.com/clayball/0x41-2-version-b
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
Welcome to Getting Into Infosec, where we talk with information security professionals and learn how they got into the field. I'm your host, Ayman Elsawah. My guest today is Clay Wells. He shared with us a really exciting story that he encountered in his travels as a Blue Teamer.
But I had it all prepped up as to what I was going to do exactly so I could just execute, execute, execute. And yeah, my heart was racing and that was a huge rush.
Clay Wells is a point of contact for the DC215 group, one of the coordinators for the Blue Team Village at DEF CON, and the creator of unofficial CTF challenges for local hacker cons.
Some of the inspiration behind it grows out of communicating with people that are within the local communities here.
He's also an organizer of the first annual WOPR Summit taking place March 1st, 2019 in Atlantic City, New Jersey. All right, on to the show. Hey, Clay, thanks for coming on the show.
Hey, thank you. Thanks for having me. Happy to be here.
Yeah, thanks for coming on. So can you tell us about what you do today and how you got into the field?
Yeah, absolutely. So I work for the University of Pennsylvania doing information security for the School of Arts and Sciences. And I've been there in my current role for about just over four years. Been at the university for 10. I've been in academia. For 20 years, or a little bit more than 20 years now. So most of my career has been in academia. Worked for a local ISP back in the late 90s. So I've had some exposure to non-academia work environments. So been doing IT for 20 years. But not exclusively information security. I started out doing computer support, installing a new CD-ROM or back then we were rolling out Windows 95 machines. Started out doing that, but then quickly found out that a professor, he had a side project or a project that he used as a teaching tool.
And it was a PHP application. And a guy that I was working with was developing it and running the web server and running the DNS server and running the mail server and running the file server. So it was back then Novell, but we had a bunch of Linux machines also. So I quickly fell into programming and system administration right away. So doing both. And he had some good skills. Learned a lot about Linux from my colleague. He'd show me stuff like sniffing network packets and, oh, look at all this plain text stuff going over the wire and stuff. So right away, security was part of it. Right. You know, we had to worry about firewalls and those sorts of things. We were developing a web application.
So we were, you know, being mindful of how we were developing as well. So it was always sort of part of my role to some extent anyway. Yeah. Then I bounced around into a just programming exclusively role. And then I've held positions where I was just doing system administration and, of course, writing scripts and automating what I could. So I've done a lot of both. And it wasn't until about eight years ago, eight or nine years ago, where I started to focus on security. The position that I was in wasn't really a system admin role or a programmer role. I was doing other sorts of things, working with the SunGrid engine, helping researchers run their MATLAB jobs or our jobs, stuff like that.
Yeah.
At the university, I found security groups. There was also a security reading group that I started going to. And that was cool. I learned a lot. And I started to meet people across campus.
What's a security reading group like? What was that about?
So I lead that group now, which is nice. Kind of fell into that. But we alternate a technical book and a non-technical book.
All in information security.
Yeah, all in information security.
That's awesome.
So we just alternate back and forth. When the Verizon DBIR comes out, we'll talk about that.
Nice.
For one week. And we meet once a week over lunch. And we'll just knock out like 50 to 75 pages, give or take. Okay. You know, depending on the book, if it's a nonfiction, we'll usually go quicker. If it's like something like the Art of Memory Forensics, we'll go much slower and sort of take our time with it.
Very thick.
Yeah. And we try to do hands-on stuff when we can. When people have time to do it. So yeah, so that's been a great learning experience and a great outlet.
I noticed the reading list on your website. Pretty good amount of books there. Yeah. Is that what inspired it from the reading group? Basically that list as it goes on?
Yeah, so I do maintain or I try to maintain a page for the reading group with all of the previous books we've read. Yeah, so I try to post some things there. I work with a small team, supervisor, project manager. We're with the Linux system administrators. For a while there, we had a co-op, a Drexel co-op. And so I would interview them, make a selection, bring them on, and they would be with us for six months. So one thing that I did post was... A little exercise. I think it was HPing or Nping. I think it was HPing. But the gist of it was to capture the TCP handshake. So it's a technical exercise. So for the candidates that came into the interview, I would mention that to them, you know, or if they were asking for more information that I knew they would really be interested.
So I'd throw that at them and see if they did anything with it. And the ones that did, of course, you know, got ranked a little bit higher, naturally. So that was part of the motivation also to have them. Sort of small digestible posts, especially if there's any one thing I'm particularly doing for something at work, then maybe I can sort of roll that into a quick little post.
How do people find out about your reading list on campus? And have you found that reading list to be helpful for some of your students that are trying to get into the field?
Yeah, I think so. We'll send out blasts across campus. We use Slack. The IT staff uses Slack. So I'll make announcements there between books if we are coming up with a new book and a mailing list. So we use that to get the word out there.
Is it mostly part of the computer science departments and engineering? Is that how we'd find out?
Yeah, mostly IT staff. There are a few people over in the CIS department that they might be students. Yeah, mostly IT staff.
Okay, this is mostly an IT staff internal thing. Yes. Oh, I see. Okay. Okay, not one for the... Greater demographics. Okay.
Okay.
Yeah. Cool. So my limited knowledge of information security at a college, I understand that it's a little different. It might have changed now, but like it was a little different where a lot of times you had to be hands off.
Yes. Yes, that's true.
Yeah. Can you talk about where the freedom of data and students to be able to browse and things like that? And like, how do you balance that?
Yeah, it's definitely more open, a more open environment. Desktops are mostly managed, you know, but there's always the challenge of... We can never really see everything on our network or know about everything on our network because there are little pockets of labs doing some sort of research. And we're just not always aware of that. So it takes a lot of communication between management teams. And the higher-ups to just let people know that, hey, we're here. We're here to help. Let us know if we can't help in any way. And people tend to be responsive to that. Okay.
So tell me about your first computer.
My first computer, yes, I still have it. It doesn't work exactly, but it's a Commodore 64. I have the tape drive. The tape deck, the floppy drive. Awesome. I don't have the old printer, but that's, you know, no worries there and have the old like monochrome monitor. So yeah, I got that and I had a big sort of what the moment because my stepfather at the time set it up, had this up in my room. It's all great. And then he's like, all right, let me show you how to program this thing. I'm like,
What?
Oh, okay. Cool. Okay. And he's like, 10 space prints. Hello, return. And I'm like, what is this craziness? And so that was like my knee jerk reaction.
It's all this work that I have to do.
Yeah. I was like, where are the games?
Yeah.
But I also had this magazine that I was subscribed to. And in the magazine, they had code examples of games or other little tools and things. And so I would type those in, save those to disk or cassette, and then play them or run them. Most of the time, there was some sort of bug somewhere. I mistyped something. And so I had to go back and find it. So looking back on that experience, very fond memories and very thankful that I had the opportunity to be exposed to that sort of technology at such a young age, really. Fourth grade.
Okay, fourth grade. That's awesome. What was your first hack in life, whether it be technical or non-technical? Where'd you get that bug?
I guess you could, you know, consider some of those programs that I was writing and then, you know, making little tweaks to kind of hacking. I remember I have a distinct memory of being at a friend's house and he had a modem and that was amazing. I didn't have a modem, didn't have one until much older, but that was awesome. He starts dialing in and Joins us bbs and there's like games and stuff and i was that's when i was hooked nice yeah cracking games or whatever maybe yeah and it wasn't i'm a musician also so then my you know start hitting puberty and then it's like drums and music becomes my life and computers sort of go by the wayside until college then it was i was right back in programming so that's that's where my heart's always been
That's awesome. That's awesome. I'm really finding a lot of information security professionals to have this really creative side to them. So it's really cool. There's got to be something to that.
Yeah, I'm a strong believer in embracing that creative side and just being artistic and That's like take a break if you're if you're into because a lot of people in our field sort of go down different rabbit holes and they're like it's so hyper focused on like one topic for a while and that's like that's all you do which is cool and it's awesome but sometimes you just need that break or have music on while you're while you're hacking away at stuff Or figuring stuff out. It just helps get you in that mood, that mindset. And sometimes I'll just take a step away and watch some sort of art documentary thing on TV or go to an art museum or something just to sort of stay in tune with that creative side.
And sometimes, you know, you can find little bits and pieces of motivation or inspiration in those things.
Do you have any cool war stories from all your time in information security that you could talk about at least?
Sure. This doesn't happen very often. So when it does, it's a big thing. And it's happened twice. The most recent time, it's just a few years ago, a system was compromised and it wasn't at work. It was for stuff I do on the side. And so the Linux server was compromised. Acting funky, it was compromised. So I'm like, all right, let me see what's going on. Can I SSH in? All right, I'm in. Now start looking at different processes, looking at Open ports. Can I SUD root? No, I can't. The password's been changed. Crap. You know, we're hosed. So what am I going to do? The person was on the machine at the time. Now, were they in front of their terminal actively doing something? I have no idea. But I have to assume so.
And so my heart starts racing. How can I get this person out of here? What am I going to do? The root password's been changed, and it's in a remote location, so I can't just go to this machine and boot into Linux single mode and change the root password or whatever. Or do I have to call the people and have them yank the network out and then rely on our backups? I still have access to the machine, so there's that. So I said, all right, well, let me think about this. I said, well, let me see if I can crack his password. Right. So I went ahead and ran John the Ripper on that. So let that go. And I start thinking about other stuff I can do. How did this guy what happened? How did he get in? Found that pretty quickly.
It was a SQL injection. So we pretty much owned that and got in that way. Okay, great. Let me find a way to block that. So I did. I found the file or two files that had this vulnerability and just removed them, basically. And I think I probably did some other thing to help shut that door, essentially. So I was like, all right, cool. And then I look back, and it's like, boom, the password's found. I was like, this can't be right. But yeah, and I still remember it. It's Mark 2002. I was like, this is too good. This is too perfect. So I have root password. Now what am I going to do? How can I su to root, kick him out, change the password, make sure the door is locked, Maybe apply some firewall rule or something, limit everything to my known IP.
I basically did all of that really, really quickly. But I had it all prepped up as to what I was going to do exactly so I could just execute, execute, execute. And, yeah, my heart was racing, and that was a huge rush. And that's when I was like, yeah, blue side rocks. You know, this is, you know, you can't get that. You know, you have to be, you know, if you can defend and get someone off your system, it's such a great feeling. Now, it took a lot of work to go back and make sure no crap was left behind. Yeah. You know, look back through his bash history. Stuff wasn't erased. So it was, you know, kind of sloppy and they really weren't. Doing much like we got lucky in that aspect so yeah so that was a few years ago certainly doesn't happen every day but yeah when those moments happen it's like yeah it's pretty awesome that's cool that's that's a good one that's really good so tell me more about the blue team village at DEF CON from my understanding you're one of the organizers and you know there's a lot of talk from what you see out in the conferences and everything it's all focused on the
Yeah, and for me, I'm a builder. I mean, there's definitely the breaking side, but for me, I'm naturally a builder. And I see that, you know, most of the jobs out there are for builders. You're looking for security analysts, security engineers. We're on the inside. Yeah. So, yeah, so you keep telling me more about that because I really want to talk about the blue team side. And what I'm seeing is a lot of people that are trying to get into the infosec field are really attracted to that red team, the pen testing part.
Yeah.
Absolutely. I feel like the blue team part is overlooked. And that's where, you know, a big need is.
Yeah, I think it certainly hasn't been like the sexy infosec job to have. But yeah, defense is that's what people want. There's a lot of defense work out there. And it's really awesome that there was talk on Twitter and one thing led to another. And Before I know it, yeah, there's a blue team village being organized, and that's awesome. It was the first at DEF CON. There's been some blue team elements there, quite a few over the years, but it's... Notorious for being a hacker con a red team red team side event so by no means was this like the first ever blue team thing but a village dedicated to it yeah that's pretty awesome and a long time coming and there's a lot of interest in it and we had a lot of volunteers which was awesome we were pretty much just like yeah come on by hop out when you can and just meet people and hang out and
Learn and share and one of the great things about the village aside from all the great talks and people was the open sock from recon infosec they run a defensive where a blue team capture the flag so we had them there and that was they did a phenomenal job So definitely go check them out. And they're at, as we're speaking, B-Sides DC, if I'm not mistaken. That's where they are now. They're going to be back next year at DEF CON, Blue Team Village. Looking forward to that. They're going to have a lot of new things lined up. But that's how that works is there are different scenarios. And you can start at the top if you want, and you can work your way down there. Through that scenario, and as you go along, it gets more complicated and more points for each of the challenges.
And it utilizes different tools. So there's packet stuff, there's Greylog was used, and what else? Kibana... There were a few others, but they all do sort of different things on the forensic side of things. And having exposure to all those different tools, and they're all free and open source software, that alone is a great experience. I wasn't aware of half of those tools, and I had certainly never used them. So that was great to be able to kick the tires on that as we were setting up the night before.
Yeah, it's pretty cool. The resources page on the Blue Team Village, blue team village.org is chock full of links.
Yes. Yes, we reach out to the community, people that were interested in helping out and just blasted them to send us all the tools you find useful. And so we just compiled the list that way. And, of course, we want to keep that up to date so it doesn't go stale. We'll keep that updated each and every year.
Okay.
As new tools come out and maybe some sort of things sort of retire or fall off. Yeah, so a lot of good resources on there.
So what are some things that you would recommend to folks getting into the field?
Yeah, so some general advice. One thing I think is important is to have, especially if you're new, is take a holistic approach to infosec. Dive into the culture, different cons, music, people. Volunteer, get out, get involved. That's important. Learn about a little bit of everything. And then find what really interests you. And... Go for it. You never know what it might be. And it might not even be technical. So there's that side. There's the non-technical side of things also. I would say try to learn to do some basic things with system administration and learn some basic programming.
Scripting in whatever language works.
Yeah. Python is huge. There are lots of examples out there. Learn little exercises. Just try a few just to get a feel for it and see if you even like it, but also just to learn a little bit about it because you never know when that might come in handy. Right. I would also recommend, especially if you're on the Linux side of things, I guess you can do some of it on the Mac, too. I don't use the Mac that much. I did for a few years, but mostly, primarily Linux. I would say compile stuff. There are a couple, you know, package managers are great. It's great to apt-get stuff or to yum install things, but try compiling a custom Linux kernel. Try, and if you don't, if that seems like too much of a daunting task, that also helps you learn a lot about hardware.
Try Nmap. Compile Nmap.
Yeah, any tool that's out there.
Yeah, exactly.
If any of the open source security tools, it might have a release, but instead of...
The release you know try to compile it yourself yeah exactly just to see what it's like even just to go through the make you know configure make install right and you can install it anywhere it doesn't have to be user bin or user local so yeah try that a little bit reading is i've that's extremely helpful you can learn so much from so many different books technical and non-technical yeah And learn about some of the history. Go back and read some old Phrack issues. Yeah, and just kind of go from there.
Have you read Masters of Deception? I have not. Oh, good read. Very good read, especially if you're in the BBS days. Okay.
Yeah, I'll have to check it out.
Yeah, I saw on your list that you had Kingpin, so that's on my to-read list. Something more modern, but Masters of Deception, really good book. That's awesome. You are one of the organizers of the WOPR Summit.
Yes.
Tell me how that came about. What drove you to do that? What's the purpose? What should people know about the WOPR Summit?
Some of the inspiration behind it is Grows out of communicating with people that are within the local communities here. I'm in Philly, and we have a bunch of different meetup groups, and they all do things a little bit different. But leading up to DEF CON, we were like, Wouldn't it be pretty badass if we kind of all got together somewhere before we go and just kind of hang out and party and, you know, whatever, do stuff, do the CTF or something. That's where some of the inspiration came from. One thing that I always enjoy doing is just participating. That's actually one of the... I went to my first DEF CON two years ago, and I went to the... Not to talk too much about DEF CON, but that's where a lot of inspiration has come from.
The DC 101 panel, so the DEF CON 101 panel that I went to, was probably... The most memorable and fun part, at least that I can talk about, from that DEF CON. They were all about, every one of them on the panel was about participating and doing stuff, be part of it. And it is what you make it. And life is like that as well. So that was inspiring. And so I sort of ran with that. And was I doing this before? So I started doing creating my own CTFs also. And that helped me learn a lot about different things or it allowed me to dig deeper into different topics. So that's where the inspiration came from. You don't see any – at least I'm not aware of really immersive, hands-on learning experiences at an affordable price for people.
There's a bunch of trainings you can go to, and yeah, you can spend thousands of dollars easily. So that's not really accessible for a lot of people. And I'm in academia, so I tend to be around a lot of students. And so I see this. How do they get into it? Well, yeah, you could go to this training and spend five grand, but wait to let your employer do that for you. Wouldn't it be nice if there was something... Conferences or trainings that had primarily workshops and hands on things to do that you can really go and learn and sink your teeth into different topics without spending a whole bunch of money. So that was part of the motivation as well. And I just reached out to a few people, see if they might be interested in helping with that.
If they thought, hey, does this seem like something like a good idea? You know, should I do you think I should pursue this? So it sort of gained steam enough to keep going. It's like, all right, cool. Let's do this. And so started reaching out to more and more people. And there was at some point, probably two months ago, roughly, where it's like, all right, we're going to do it. Let's do it. That's awesome. Yeah. So I'd already been talking with people at Atlantic City. Caesars Entertainment in Atlantic City. So we were already going back and forth with what it would take to have some sort of conference that we could organize. And they've been very helpful and a pleasure to work with so far.
Yeah, so it's slated for March 1st. Which is Friday through the 3rd. And we're just going to open with a welcome reception Friday night. So people can just come hang out. We'll probably have some on-the-spot CTF stuff going. So if people want to get their hands dirty doing things, that's going to be there. And then we'll kick off Saturday. We'll have a track of talks and a track of workshops. And... Will end Sunday afternoon. So we'll do that Saturday and most of the day on Sunday.
That's awesome, man. It's very exciting. That's really exciting. Yeah, it seems to be a good gap between Hope, which is every other year, and then New York, right? And then DEF CON, which is in Las Vegas. I know as a former East Coaster, it was hard to get out to DEF CON, right?
Yeah, yeah, it is. That's common. Yeah. I hear that a lot.
So this is an annual conference?
Yeah, this is our inaugural year, so this will be our first year. But yeah, the plan is definitely to... Do this every year. We're going to be at Bally's in Atlantic City. Me and one of the other organizers went out for a site visit this past weekend. And that was great. We got to see the rooms. They showed us another room that would give us more space. So they sort of included that also. And the contract's already been signed. So that's awesome that they're willing to add a little bit more space for us. Yeah, so we're moving right along.
Good stuff. Good stuff. What is it that you need from the community? Or if you have the community's attention right now, what is it something that you're looking for from the community?
Just to help spread the word. And if you're interested in volunteering, we need volunteers. So please, by all means, reach out. We're on Twitter. DMs are open. Or clayball at woprsummit.org. Or even volunteers at woprsummit.org. That way the group will get it. So, yeah, just reach out, spread the word. We're all about doing things and making stuff. We're also focusing not just on like red team hacking stuff or blue team stuff, but hardware and hardware security. I think it's really important for us to bring in like that aspect of like the maker community. And like the people that are out there making badges and stuff and the people that are doing the hardware security, I don't think we hear enough about them and enough about what they're doing and how we can be involved or how people new can sort of get involved in that aspect of the field.
So that was a huge inspiration to really bring in hardware as a main focus. That's awesome.
That's really good. So what does WOPR mean? What does it stand for?
Yeah, so it's a movie reference. People should be aware of it. If not, all you youngins out there. Nice. Yeah, there are a handful of hacker movies that everyone should watch, right?
Yeah. You know, I'm putting together a list lecture like that.
Sneakers, hands down, one of my favorites. And of course, hackers and war games. So yeah, those are the top three.
Because I'm looking all over. I'm like, where's WOPR? Yeah.
Yeah. And some people on Twitter, they'll have it like as part of their avatar and stuff. It's like, all right, there's, you know, free advertising.
Do you have anything specific for younger folks for learning more about infosec?
A lot of the B-Sides events are doing, and even DEF CON Roots, getting the kids involved. It's awesome. I've got a little one also, and he's getting to be about that age. I mean, he can read and write and stuff, but it's like getting into the... Yeah, he's almost there, I think. So, yeah, like Minecraft. Write your own Minecraft mod. Little things like that. Keep it fun. There are plenty of books out there. No Starch has a lot of good ones. I love No Starch. They're a sponsor for WOPR Summit. We should be getting some books in the e-vouchers to give away. So big shout out to them. They're very active in the community. There are a number of books out there for kids, even hardware-focused and electronic-focused for kids.
I know my son has a computer club thing, but it would be nice if there was some sort of outreach with community groups, whether it be Boy Scouts or Girl Scouts or whatever. Any sort of after school activities just to get them exposed to information security. And they're the ones that, especially with privacy, they need to be aware of what things are like in perspective to what they were like 10 years ago. And of course, I don't think they're going to get that until they're Older and, you know, maybe even not until they're in their twenties, you know, I'm not sure how much thought teenagers really give to that. I don't know. I'm sure a lot do, but I'm sure a lot don't just like society. Yeah.
My wife doesn't care. The NSA is watching her through her camera. Like she's like, whatever, they're not doing that. I've got nothing to hide. And it's just like, Oh no, let's just not, let's just stop talking. Yeah.
So yeah, any exposure to online privacy and safety, yeah, is important. And yeah, just trying to get that out to the kids. Yeah, I mean, I think we're doing it little by little, but yeah, it's important.
What about sponsors? Do you guys need any sponsors? How's that going?
Yes, absolutely. No Starch has been awesome, and they're sponsoring us with in-kind gifts of books and e-vouchers. But we do need sponsors. We're a first-time conference, so I know it might be a challenge for us to get. But yeah, any sort of sponsorship or donations at all, Are greatly appreciated you could just go and donate 20 bucks i mean every little bit helps because we do have to cover costs yeah what are some incentives for companies for their sponsorship like you know what are some maybe we could talk about the prospectus in format Yeah, absolutely. So we have three different levels, if I remember correctly. It's been a while since I looked at it. From like very basic, like less than $500, you know, we'll shout out on social media, a post on our website, logo on our website.
You can even have a table set up for a larger sponsorship. You can have a table.
Do you guys have a vendor area?
We could. So we have a large room that is just a big social room. We'll have music and stuff going on there. A contest, BSEC Lab is one of the contests. She's awesome. And I think she's like 11 or 12. Her father's part of a local DEF CON group. So yeah, we're thrilled to have them. So yeah, we could set up some vendor tables in there. Then we have two or three breakout rooms that are just off of that big room.
Okay.
Yeah, the sponsorship prospectus has all the details. And we're willing to take creative sort of sponsorships also. So if it's not mentioned specifically, just reach out. And we're more than happy to work with you and try to make something happen.
That's awesome. That's awesome. Are you guys a nonprofit?
Not yet. So it's all run under an LLC, but maybe next year. That's where I would like to take this. Right. Just to have it be a nonprofit. Okay. Awesome.
Awesome. Yeah. Good stuff. Well, Clay, this has been really fun. I've had a good time talking.
Cool. Yeah. Well, thank you. I have too. I appreciate it.
Yeah. We'll leave details about the summit in the show notes.
Okay. Awesome.
Cool.
Thanks a lot. Awesome. Thank you.
Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.
