Episode 10 · · 54 min
InfoSteph From Journalism to IT Support to Security Analyst
Security analyst (team of one) at a retail company
Episode summary
Steph is brand new to the infosec field! We go over her interesting and eventful path into Information Security, reflections on her role today, and some fascinating war stories!
BIO:
Steph is a Security Analyst for a retail company makes up the team of one. She has a background in journalism and web hosting. She is the creator and editor of StephAndSec.com, a blog focused on technology, inclusion, and lifetime learning. Stephanie's life work is to encourage and fight for more diversity and inclusion in tech spaces for more innovative and original collaboration. She spends her time mentoring high school students, hosting virtual labs via Women In Tech-a-thons, and learning as much as she can about anything and everything. Stephanie believes that giving back to the community at every stage is very important. In addition to technology, Stephanie has a secondary passion for Psychology, so don't be frightened if you hear her discuss cognitive distortions or attachment styles. She hopes to develop research that explores the dichotomy between human beings and technology. She is currently on a mission to speak at three events in 2019 and has already been booked for one event.
Notes:
Dreams of Creative Writing, but chose Journalism for practicality
Encouraged to Computer Science by her mom
Had her eye on Security, through IT or Web Hosting... eventually.
A story of being so close, yet so far
Was very close to giving up on the whole industry due to the difficulty and lack of encouragement... but was NOT comfortable with quitting.
Quotes:
"You have to talk to strangers about their story... you want me to walk up to a complete stranger as an introvert? Uh.. what?"
"The type of person I am, I can't fully commit to something without getting my hands dirty."
"The way that I learn is situational."
"We had a vulnerability scan tool and so I just tried to work with that."
"It's kind of like what doctors have to do before they [can] become a doctor."
"So many people are trying to get into the industry and facing the same issue. I've done all these things people have told me to and it hasn't gotten me anywhere."
"Just do a bunch of stuff until it sticks!"
"Twitter was one of the best... decision I made."
"Get a champion that is more senior than you."
"Don't count yourself out, before someone else has counted you out."
"The lessons that are best learned are the ones that resulted in catastrophic failure."
"When you want to be a lawyer, you go to law school, you sit for the bar. There ya go! There's a plan."
Before infosec: Journalism student, web hosting chat tech and IT support
Chapters
- 0:18
Intro: InfoSteph, a security team of one
Ayman marks his tenth episode and introduces Steph, a new security analyst at a retail company.
- 1:28
Life as the only security analyst
Steph describes the business and technical sides of her job, the lack of executive buy-in and the roles she wishes she had on staff.
- 5:11
From novelist dreams to journalism to computer science
She recounts the move from journalism to information assurance, then web hosting, help desk and a security department that was outsourced.
- 14:01
Interviews, feedback and the WGU degree
Early interviews fell short, she asked for feedback, worked with a vulnerability scanner and enrolled in an online degree that includes certifications.
- 18:23
Nearly quitting, a mentor and Twitter
Discouraged by friends, she reached out to a mentor, started a blog, joined Twitter and discovered the security community.
- 23:17
Landing the analyst job and what certs really do
She was hired within a week, credits her website, tech-a-thons and Security+, and discusses SANS, CISSP, CEH and CCNA.
- 27:00
Advice to her younger self
Get a second opinion, find a more senior champion and do not count yourself out before others do.
- 29:16
First conferences: HouSecCon and DEF CON
Steph describes feeling overwhelmed at her first con, winning a WISP sponsorship to DEF CON and advice for first-timers.
- 36:42
Curriculum, confidence and imposter syndrome
She wants more practical college curricula and tells people lacking confidence to broaden their community.
- 41:26
Representation and being a Black woman in tech
Steph discusses constant second-guessing, being labelled aggressive for being assertive and why representation matters.
- 48:17
War story and the entrepreneurial spirit
She recounts accidentally taking websites offline with a production device update and agrees infosec rewards a self-selling, trial-and-error mindset.
- 53:37
Closing: Ayman's new community
Ayman thanks listeners and plugs the community he is building.
Key takeaways
- Get a second opinion before accepting discouraging advice, since people often project their own experiences onto you.
- Find a more senior champion or mentor early; a conversation with one changed Steph's trajectory within a year.
- Build visibility with a blog or website, join Twitter and attend local cons, which helped her land interviews and offers.
- A single certification will not get you a job; combine it with hands-on experience, varied tools and any security-related work you can find.
- Ask interviewers for feedback at the end of each interview to learn what you could improve.
- If you lack confidence, broaden your community and talk with people more senior than you to see how much you actually know.
Notable quotes
But there's no way to say, how will I become a security analyst? It's just kind of like, do a bunch of stuff until it sticks.
get a champion that is more senior in the industry than you
But don't count yourself out before someone else has counted you out.
Questions answered in this episode
- How did InfoSteph become a security analyst?
- Steph switched from journalism to computer science, then worked in web hosting, help desk and as a Linux admin while studying. After a mentor encouraged her to start a website, use Twitter and attend cons, she earned Security+ and was hired as a security analyst.
- Is a certification enough to get an infosec job?
- According to Steph, no. She says Security+ helped her profile but was not a silver bullet; her website, tech-a-thons, IT experience and the cert together got her the job. She notes SANS certs and the CISSP are expensive, so not everyone can afford them.
- Is DEF CON overwhelming for first-time attendees?
- Steph says it can be, since it draws tens of thousands of people in busy Las Vegas. She recommends starting with a smaller conference or going with someone you know. Her own first big conference was a smaller one in Houston, then DEF CON with a WISP sponsorship and a roommate.
Show notes and links
Show the original episode notes
Steph is brand new to the infosec field! We go over her interesting and eventful path into Information Security, reflections on her role today, and some fascinating war stories!
BIO:
Steph is a Security Analyst for a retail company makes up the team of one. She has a background in journalism and web hosting. She is the creator and editor of StephAndSec.com, a blog focused on technology, inclusion, and lifetime learning. Stephanie's life work is to encourage and fight for more diversity and inclusion in tech spaces for more innovative and original collaboration. She spends her time mentoring high school students, hosting virtual labs via Women In Tech-a-thons, and learning as much as she can about anything and everything. Stephanie believes that giving back to the community at every stage is very important. In addition to technology, Stephanie has a secondary passion for Psychology, so don't be frightened if you hear her discuss cognitive distortions or attachment styles. She hopes to develop research that explores the dichotomy between human beings and technology. She is currently on a mission to speak at three events in 2019 and has already been booked for one event.
Notes:
-
Dreams of Creative Writing, but chose Journalism for practicality
-
Encouraged to Computer Science by her mom
-
Had her eye on Security, through IT or Web Hosting... eventually.
-
A story of being so close, yet so far
-
Was very close to giving up on the whole industry due to the difficulty and lack of encouragement... but was NOT comfortable with quitting.
Quotes:
-
"You have to talk to strangers about their story... you want me to walk up to a complete stranger as an introvert? Uh.. what?"
-
"The type of person I am, I can't fully commit to something without getting my hands dirty."
-
"The way that I learn is situational."
-
"We had a vulnerability scan tool and so I just tried to work with that."
-
"It's kind of like what doctors have to do before they [can] become a doctor."
-
"So many people are trying to get into the industry and facing the same issue. I've done all these things people have told me to and it hasn't gotten me anywhere."
-
"Just do a bunch of stuff until it sticks!"
-
"Twitter was one of the best... decision I made."
-
"Get a champion that is more senior than you."
-
"Don't count yourself out, before someone else has counted you out."
-
"The lessons that are best learned are the ones that resulted in catastrophic failure."
-
"When you want to be a lawyer, you go to law school, you sit for the bar. There ya go! There's a plan."
Links:
-
Steph's Website: https://stephandsec.com/
-
Speaking engagement next year: https://2019.tabgeeks.com/speakers#steph
-
Steph's Tech a Thon's: https://mailchi.mp/70c8010c3320/tech-a-thon-comeback
-
WISP - Women in Security and Privacy: https://www.wisporg.com/
-
Intro - Cascadia by Trash 80: https://trash80.com/#/content/133/weeklybeats-2012-week5
-
Outro - That Night In Your Car - Spazz Cardigan: https://www.youtube.com/watch?v=1yzuoAOd238
Resources:
-
HackEDU: https://hackedu.io/
-
Open Bug Bounty.org: https://www.openbugbounty.org/
Getting Into Infosec:
-
Twitter: https://twitter.com/coffeewithayman
-
YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
-
Book: https://www.amazon.com/Breaking-Step-Step-Starting-Information-ebook/dp/B07N15GTPC/
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
Hey everyone, I'm Ayman Elsawah and this is Getting Into Infosec. I can't believe this is my 10th episode. It's been an amazing experience for me. No matter who I talk to, everyone has a different experience in how they got into infosec. So I'm really glad I started this project. Today, my guest is InfoSteph.
And every time you ask somebody, how did you get into security? It was not anything like the last person that you asked. Everybody's answer was completely different.
Steph is a security analyst for a retail company as a team of one.
And the type of person that I am, I can't fully commit to something without getting my hands dirty.
She has a background in journalism and web hosting. It's Stephanie's life work to encourage and fight for more diversity and inclusion in tech spaces for more innovative and original collaboration.
There's a lot of times where I will answer a question and it's triple checked or I'm corrected, even though what they've corrected me to is the exact same thing that I said.
She also hosts virtual labs via women in techathons. All right, on to the show. Hi, Stephanie, welcome to the show.
Thank you so much for having me. Glad to be here.
Yeah, very exciting. I think you're new to the infosec industry from what I understand, is that right?
Yep, yep. Only about five months in.
Wow, that's amazing. So let's start there. Maybe you could tell us what you do today in infosec.
Okay, I am a security team of one, meaning I'm the only security analyst on staff. I do the business side of security as well as the technical side. Business side might include Evaluating solutions and trying to make sure that our posture is good, coming up with different policies that contribute to our security maturity plans, internal audits, and that kind of thing. And then the technical side, obviously, is the day-to-day managing of alerts, threats, anything that pops up, more of the reactive side of security. So my days vary, my weeks vary. It just depends on What's going on at the time or what deadlines I have, but that's pretty much the abridged version.
Yeah. I mean, being infosec engineer number one is never easy. I imagine it's a great opportunity, but also you're doing the job of probably like three, if not more people, right?
Exactly. Exactly.
Yeah. If you had the chance, if it was a fully staffed team, what would be all the roles that the team should have at this point for your company?
That is a good question. I would say one of the more important roles would be a CISO, which that might sound a little bit strange to ask for. The issue that I tend to have is getting buy-in from my boss first and then executives second because the company I work for, it's not a tech company. It's a retail company. So the focus is on sales, merchandise, the creative side. So a lot of times when you're asking for different security solutions, it requires money.
Yeah.
Getting the buy-in is very difficult. If I had an executive that was security-minded, I think that would be a lot better, more so because I'm not very equipped to have those kinds of conversations. I try my best.
Not yet, at least.
Right, not yet. I'm working on it. I try my best. I've had some wins, a lot of losses. I think that's the first one. The second one would probably be Now, I think this is cheating because it's more than one, but it would be some sort of managed service provider, someone that could watch the alerts overnight. So it doesn't necessarily have to be one person. It could be one person or it could be some kind of service, like a whole SOC somewhere. And then maybe me what I do I think that's fine so maybe someone junior definitely someone senior and then me in the middle I think would be the perfect formula okay and what about like the compliance stuff is there a need for that are you doing that too right now like policies yes standards yes so obviously we're a retail company so PCI is very important I don't mind it as much as a lot of stuff that you have to gather so it can be a bit
Tedious to deal with.
Right.
It's just like, you know, you're reading up on the standard and then you're trying to find the evidence to support it. You're interfacing with different teams and trying to get them to submit it. But they've got their own projects and they put yours like in the lowest priority. So you have to it's like babysitting sort of or, you know, going around chasing people. But it's not something that I feel like I would need to have somebody on staff that's dedicated to compliance only. That wouldn't be a role I would say is top priority.
Okay. Yeah. Great to know. Great. So maybe you could walk us into how you got into infosec. Tell us about the journey.
Absolutely. So this is going to be a very interesting story because it's not very traditional. So I did not grow up with an older brother or a father that was into technology. I have two immigrant parents. And I think we got our first computer when I was around 10. And then from that moment, I was kind of the family IT person, but that's only because I was the only one interested in trying to figure it out. But it never even dawned on me that IT was important. A career path that I could go after. In fact, I had a dream of becoming a novelist.
So completely different. And then, of course, when it came time to go to college, after graduating from high school, my parents were not supportive of a creative writing major, which, of course, in hindsight is a great thing because What would I have done with that? I don't know. Unless I became like some successful author, I think that would have been a waste of money. But I went to school for journalism instead because I could have an actual job from that with just one degree. And then after about three years, and it's three years because the first two years you're taking like intro classes, you're not really taking any in-depth classes. So in my junior year, when I started taking more journalism classes, I realized that it wasn't
A fit for me i see the reason why is because you have to talk to strangers about their stories sounds familiar exactly right but without you having any kind of vested interest in the subject matter it could be on anything for instance one of my professors literally said i want you to go out and find a tragedy wow And at that point, it's kind of like, what? So you want me to walk, first of all, walk up to a complete stranger and as an introvert, that's like, what? And then you want me to ask them about if they have something tragic that's happened. That was basically the defining point. I was like, I can't do this for a career. So then it was like, okay, well, what am I going to switch to? I want to switch to something that's going to be lucrative, but also that I enjoy.
And then my mom was like, well, what about computer science? And I was like, so you want me to go from an arts degree to computer science? And I was like, oh, no, I can't do that. You know, very overwhelmed. And then... I just said, you know, whatever, I'll try it. And if not, then I'm just back to square one, I guess. So I did try it. I switched schools and everything because the school I was going to, I went there for journalism. So I switched to a much cheaper school. And I was talking to the, I want to say she was the secretary of the department about my major. And she said, well, what do you want your concentration to be? And I said, oh, so what are the options? She said, well, there's software programming, there's just your standard computer science with no concentration, or you can do information assurance slash digital forensics.
And of course, I was like, that sounds amazing. It sounds so interesting. And so that was pretty much the start of My I guess you could say my tech career and then from that point on I needed to pay bills but I wanted a job that wasn't like your retail job or your restaurant job I wanted like a real job in the field that's going to give me real experience especially since I had already spent so much time in school and I felt like I was behind so I started off in web hosting as a like a chat tech okay My plan was to basically get promoted up all the way to the security department because they did have a security department where if customer sites got hacked or basically defaced by someone who had gained access to their website, then they basically looked at the malware, looked at the coding and cleaned it up and did like post-mortem type reports and stuff like that.
So I've really wanted to Get promoted up into that position.
But I still had school.
And so I did that back and forth for a while. And then they killed the part-time positions at the company. And going to school and working, I had to be part-time. So I ended up going and doing IT for a while, like help desk. Completely hated it.
It was very boring work. I think it was exciting for all of three months. And then it was very boring.
Any interesting IT stories during that time?
No, because like I said, it was really boring. And it was honestly frustrating because sometimes you would be called, oh, my monitor isn't working and it's a loose cable.
Powers off or something exactly or you're doing cable management in a conference room and then they have a meeting and you have to go and do it right after the meeting again because for some reason you either cut your zip ties and you know untwisted your velcros and then you have to redo it like it was just a lot of menial type of work so i was like i do not want to do that so after it you Yeah, so I went back to web hosting because it seemed like the best way for me to get into security. By this point in time, I had realized from talking to different people that it was a challenge, that it was going to be a huge undertaking trying to get into the field. And the type of person that I am, I can't fully commit to something without getting my hands dirty.
And I'm also kind of a learner person. The way that I learn, it's situational. I need to be able to draw conclusions from something that's actually happening. So, you know, tinkering around in a lab definitely got me familiar with things. And of course, the coursework at school got me familiar with things. It didn't quite hit home when I started becoming a chat tech and familiarizing myself with the Linux operating system, which I had no experience with before that job. That is something that even to this day, a lot of the things I learned at that time stuck because of me actually doing it in a work environment. So I wanted to get to security as quick as I can because I wanted to see if this is what I wanted to commit to.
The rest of my life to or a good chunk of it.
So all the while during this whole time, you're focused on getting into security. Yes.
Yes.
Did you try interviewing for jobs in security at this point or not yet? You're just trying the internal path.
Not yet. And, you know, honestly, it was a twofold thing. By this point, I had friends in the industry and one of my best friends had been in the industry for a very long time. And they all kind of were, I want to say, not supportive. Of me doing that because they felt like i didn't have enough technical skill and me being new to the industry i believed them so i didn't even try that i just figured i would learn the skills needed for the specific job and internally try to get into it and that was what they said was my best bet and looking back you think you would have done things differently Oh yeah. Oh yes. 100%.
I'll get back to that question.
Okay. So what happened when I went back to web hosting, I quickly got promoted to a Linux administrator and that's what you had to do. You had to become a Linux admin first and then get promoted into the security department. So as soon as I became a Linux admin, they outsourced the security department. Oh boy great so needless to say i was like well there's no use for this job anymore that's so discouraging it really is and even getting to the linux admin like i spent a long time studying the linux plus material because for the junior techs they used aliases for a lot of Commands or scripts. So really doing things manually, breaking down the alias and seeing how it runs and then doing it manually and not using the wrapper commands.
That was what I did to train myself to become a Linux admin. So I'm like, at this point, I'm like, yes, I finally did this.
And then...
You know, no more pathways. So at that point I started looking and I wanted a security job at that point. I was kind of like, you know what? I kind of wasted time. Let me see if I could just go directly. I had a couple interviews and honestly, most of the time I'd never got a call back. I'd never got a phone screening. I think I had literally two interviews and one was for a Networking position at a security company. And the other one was for a security position at a company that wasn't a tech company. And that one was just like, you're just really green. So we're not going to go with you, which I kind of thought would happen.
At least they gave you feedback though.
Well, I asked for it. I think sometimes if you have the opportunity, you definitely have to ask for it because A lot of people don't, they're uncomfortable anyway telling you that you didn't get it. So they're very uncomfortable telling you why. So sometimes they're not even very truthful. They might say something like, oh, somebody else is better or whatever. And I have a habit of even at the end of an interview saying, is there anything I could have done differently? Like, is there any advice you would give to someone like me trying to get into the industry? Just trying to glean from people, you know, more senior than me.
Yeah.
So I ended up getting a job at a security company, but not doing security as my main thing. My hopes, again, was to get promoted into security. And so there my year began. I was studying and trying to keep myself abreast of security knowledge and talking to people in the security department. There was some politics in the company that kind of prevented me The transition that I wanted. Instead, I was promoted, but within my own department. So I didn't get to go over to security. But what I did was we had a vulnerability scan tool. And so I just tried to work with that. Our SOC at the time didn't really manage or support the scanning tool. So after the scan, it pretty much spits out a report of what your vulnerabilities are and then, you know, do with it what you will.
But sometimes customers would have questions and I would try to equip myself to answer those questions and read about the CVEs that are being caught and what's common, what's not common, that kind of thing. And then I enrolled because I had taken a break from school because I was just like, I'm spending all this money. I still don't know if security is for me. I'm not really sure. And it's really hard. It's kind of like what doctors have to do before they become a doctor. You have to know deep, deep, deep down inside that's what you want to do because you're going to commit an enormous amount of time getting there and to go through eight years of schooling and a year or two of residency and then decide, I actually hate this.
It happens, right? It happens.
Exactly. Exactly. So I didn't want to do that. Both of my parents are in their second careers. Actually, my mom's in her third. So I wanted to avoid that. But I had enrolled again, but this time I enrolled with Western Governors University. It's an online school and it Your coursework is also certification. So the CCNA, you get course credits for that. So at the end of my program, you would have nine certs as well as a degree, which I felt like was better. There's a whole long story I have about What I feel about the curriculum for tech and the options out there, but it's definitely changing. But at the time, the WGU degree program was better fit for me, especially since I was working at the same time as going to school.
It would just help me get better jobs while I was schooling, as opposed to waiting until I finished school to get a So finally, at the top of the year, I get my security plus and my network plus. And last year I got my A plus. It's a part of the school curriculum. It didn't do much for me. It didn't. But last year I was going to give up on the entire industry completely. I was done because I told you about my non-supporter friends.
Oh, right.
Yeah. So and just how they were saying I was, you know, being a little bit too ambitious and that I should temper my expectations, that kind of thing, which can be good advice depending on what the person's attempting to do. But I don't think it was good advice for me. At this point you weren't attending any conferences or anything like that yet right no i was completely unaware right of every one of them i didn't even know they existed i had heard about DEF CON that was pretty much the only one i heard about i didn't know that there were so many and i didn't even know about the community outside of work okay Yeah, so those friends, they never went to conferences. They never really did. It was pretty much their own bubble.
So I thought that's what IT was, was your own bubble that you create from your jobs and your past jobs. I didn't know that there was a whole other way to network outside of that. So when I thought about quitting, I'm not comfortable with the idea of quitting. So I decided to reach out to people in the industry, and I wanted to reach out to a woman in the industry that... You know, what's further ahead. And then I found Kirsten Brazier, who is my mentor. I'm telling her about all these problems and issues I'm having. And she's saying, yep, understand. How about you? Here's my number. Call me on Sunday and we'll talk about it. And so I call her and we have like this really long conversation, exchanging stories.
And I feel like, oh, this person understands. Because at the time, my friends didn't really understand what I was trying to say. So she understood and she kind of said, you know, there's a whole world out here. You know, it's not just this and it's not always going to be such a struggle to get in. You just have to, you know, do a number of different things and change your approach.
Right.
So she was like, you need to start a website or a blog that you can, you know, publish stuff to get on Twitter. There's a community on there. Maybe go to a huge set con, which is the Houston security conference. And so I started doing the things that she told me.
That's awesome.
Honestly, like I said, I was completely blind. I didn't know anything about any of this at all. So I started taking her suggestions and publishing some stuff. And, you know, I went and got the search, obviously joined Twitter to try to see if there are any other people with my same experiences that had any tips.
Yeah. Let me ask you, how did you find her?
She had been mentioned in conversations with some of my friends that went to the Houston Security Conference because she was on a panel there. And they had brought her up when they talked about their experience going. And so I don't know why, but that day I just happened to remember her name because I had one conversation with two different people. So I had two conversations where her name was just brought up casually. And somehow this day, like I just remembered, oh, There's the Kirsten woman that they were talking about. Maybe I can reach out to her. Just hoping that she would be approachable because you never know. So that's literally how it happened.
Awesome. Yeah.
So from that point, things started like ticking up. I went to the Houston Security Conference. I was introduced to the conference lifestyle, which is the whole thing. And I didn't know anything about it.
Yeah.
You know, Twitter was honestly, and I keep bringing it up because it still is one of the best decisions that I made at the time. I was kind of like, isn't Twitter like old?
Isn't Twitter out? Like, I think Instagram was, is still more popular or the most popular. It might be Facebook, but I think Instagram, Facebook are tied. And, Twitter. I hadn't even gotten on there in forever, but when I went on there, you know, it connects you to people all over the world. So then you start to, you know, talk about your experience on Twitter and then other people are like, I feel the same way. And there are discussions that you have and you don't feel as alone in your experiences. You don't feel as alone in your struggles. So many people are trying to get into the industry and facing the same issue of I've done all these things that people have told me to do and it hasn't gotten me anywhere.
And the bar kept moving to people say, if you get a cert, you'll get a job. I would get the cert. And they said, well, we never said that would get you the job, just that it would be good to have, you know, just the kind of inconsistencies about it. And every time you ask somebody, how did you get into security? It was not anything like the last person that you asked. Everybody's answer was completely different. When you want to be a lawyer, you go to law school, You sit for the bar, there you go. There's a plan. If you want to be a doctor, you go to medical school, you sit for your residency, there you go. But there's no way to say, how will I become a security analyst? It's just kind of like, do a bunch of stuff until it sticks.
Yeah, exactly.
Yeah. So then I ended up applying for this one job, the one that I have now, and I just Threw it out there. I wasn't really sure. I had been applying to a bunch of them and I'd had some screenings, but no in-person interviews. So I got this one through a recruiter and I interviewed very quickly. It was within a week. And then they extended the offer. And I was like, what? And I think it helped that I had a website. I will say that because they were impressed during the interview. It helped to talk about my, I have virtual tech-a-thons where it's just like people labbing in their own homes, but we can chat back and forth about what we're doing. It helped that I had those things and it definitely helped that I had the security plus, but all of those things together is what helped, not any one thing by itself.
So when people say get a cert and that's going to get your job, it's false. You need a whole bunch of other things. You'll need more technical experience. You need to work with a bunch of different types of software. You need, obviously, the cert. Any kind of experience counts. Even if you want to just go to your local church or YMCA and just ask them, hey, what are you doing for security? And then maybe play around. Just finding experience in the weirdest ways is the quickest way to show initiative to some people, but it's still not guaranteed.
Yeah. And then I guess you had a couple of years of IT experience in general anyway.
Right.
Before that. So that might have helped. So on certs, do you find getting the certs that are showing up on job descriptions helps? Probably more like as far as a laser targeted approach?
Probably. But the main thing I will say about it is that if you are looking to get into security, part of the allure is the money, right? And whatever job you're doing might not be paying enough. So if you don't have the money to get a sand cert, I mean, let's be very honest, the sand certs are very expensive. If you want to go to the classes, they're even more expensive. If you don't have that money to invest in yourself, then you kind of are SLO with With that opportunity. So a lot of times you'll see sans certs on various different job recs, or you'll see the CISSP. That's also expensive and also very, I mean, vast. I think they cover a multitude of domains and it's, It's a six hour exam.
So that's intimidating to someone who just doesn't have money to birth. So it definitely helps to get the certs that are listed, but sometimes it's just not feasible for someone who's trying to get in, depending on that person's financial situation.
Yeah, I was thinking more of the CEH or some of the more easier certs, Security Plus or any of those. Easier on the wallet, at least.
Okay, yeah, absolutely. So the Security Plus is, I don't regret it for anything, but it's not the silver bullet that some people say that it is. Unless you're trying to work in the government, it's really not. I think I got more eyes on me in terms of making my profile or my resume more attractive, but... In the end, it didn't really cut it. The CEH is so controversial. I think there was a discussion on Twitter the other day about whether or not you should get that. Some people obviously were saying LSEP is better, but honestly, I think they're in two different lanes.
Yeah, certs are such a big thing. We'll just leave it there because there's no right answer.
No.
And that's the reason of this podcast because if you look at every single guest, On the show they all had different approaches towards so i'll let the guests speak for that i don't have any particular recommendations myself looking back if you had a chance to talk to infosec stuff a couple years ago what advice would you give her that maybe would have helped fast track you into the security field the advice i think i would give her is get a second opinion
Because if I had I may have done things a little bit differently also get a champion that is more senior in the industry than you because as soon as that happened like within a year I'm a security analyst you know because it was like a complete mindset shift you know you start to Look at things differently. So getting someone who is older in the industry has kind of, you know, overcome the mountains that you're trying to overcome was definitely an important piece of it. So I would say get that a lot sooner, probably even at the point, at the literal point where I decided to switch from journalism to computer science. That is when I would have gotten some kind of support from someone who had been where I'd been.
So those two things, get a second opinion. People who give you negative advice, it's sometimes to protect you. But you also have to realize that people are projecting their own experiences onto you and it might not be your experience. So definitely, you know, take it and, you know, mull it over and understand what they're trying to say. But don't count yourself out before someone else has counted you out.
Yeah. Yeah. The only one that knows you is you.
Right.
So you had that ambition. You had that drive. Others might not have empathized with that necessarily or realized that, you know, and like you said before, you'd like to take things to completion.
Right.
And do you think once you went to some sort of conferences that kind of helped skyrocket or kind of accelerate?
Absolutely. So HughesSecCon was my first ever security conference. It was very overwhelming. And I say that because, as I mentioned earlier, I'm an introvert and I'm not really good with a bunch of strangers at the same time. So I'm good with one or two, three people. But a massive crowd is just so intimidating to me. So it was very overwhelming.
Walk us through that experience.
Absolutely. So I did go with a friend. But the thing was, the friend, he was... Interested in other talks than I was. So once we kind of crossed over the threshold, we were headed in two different directions. But when you get in there, you see hordes of people, just massive crowds of And you're immediately like, am I in the right place? What is going on? And then everybody's talking to everybody and you think everybody knows everybody. But really, just some people are better at just walking up to strangers and saying hi and just introducing themselves. I actually have a former coworker who's exactly like that. He will talk to anybody. So you just find something. Well, I just found something to do, which was get coffee.
Yeah. You know, stop at a couple of booths and talk to some vendors about, you know, what they had going on. I found that to be less daunting. And then you watch the keynote, the opener. And I think you, if you're like me in any way, which I would argue to say there's a population of
That is like me. You kind of just try to look for someone that you either know that's going or that looks the least intimidating and talk to them and say hello, you know. Because that's what I did. I ended up, you know, having a buddy that I went throughout with, but we had differing, you know, everybody has different interests. Some of the talks were very illuminating. Some of them were very controversial, but all of it was interesting. I think just initially it's like overwhelming. Now that I've been to DEF CON, honestly, I think that's like small potatoes. It's not a lot compared to DEF CON, but at that time I was like, whoa. I even cut out like around I think it went on until like eight because there was like a mixer networking something.
And I was like, oh, no, I can't do that. But it was a great experience. They have really good speakers come through. There was a panel, too, on diversity in the industry, which I feel like is important to talk about. And Kirsten was actually on the panel again. So I got to see her live doing her thing. So it was a great experience. Now, DEF CON was my second conference. I had the fortune of getting a sponsorship from WISP, Women in Security and Privacy. It's an organization that is all about inclusion. And they just basically tweeted, we have enough money to send two people to DEF CON, reply or retweet, something like that. And then a lot of different companies said that they would sponsor people as well.
So they ended up increasing that from like two to 57 or something like that. Yeah. So I ended up being one of the winners and I was so excited because I had just gotten my security job. And so I'm finally in the industry. Now I get to go to this massive conference that I wasn't able to afford at the time. So I think I tweeted about it and I said that it was like the equivalent of a warm hug.
I saw that.
Yeah, it was honestly a life changing experience because depending on what your local community looks like, you may or may not find your tribe in that local community. But going to an event like DEF CON where people come from all over, you end up immediately finding your tribe and, you know, exploring security with them. You know, I participated in A capture the flag, and I did horribly. But I got introduced by one of the other winners of the sponsorship. So it was just a bunch of nerds who are interested in security, who want to talk about what they've done in security and want to hear about what others have done in security. And you're just doing it and This massive hotel. I had never been to Vegas either.
So you're doing this massive hotel. And I think everyone should go at least once. But a lot of people said that this year was particularly different, that it's not always like that. But since it's my only experience, I can only speak to what I know. But it was one of the best experiences ever. A lot of fun. I learned so much and I was very excited about starting my career in security after that.
That's awesome. But if someone has never been to a conference, would you say DEF CON might be a little overwhelming for them?
That is a great question.
Even now, even me with all the experience that I have, I still feel like that sometimes when I go to DEF CON. It's kind of weird because it's just so big now. Yeah. I used to go to DEF CON and it was smaller and it was actually a little fun and, you know, still is fun. But I would meet people. I've met some amazing people from DEF CON. Don't get me wrong. But, you know, it's like a sea. It's like an ocean there.
Oh, yeah.
You know, say you went without WISP or say without a group necessarily, right? It might be a little overwhelming. Would you say or no?
Oh, yeah. If I went there with no one that I knew or had talked to previously, I think I even had a roommate. Oh, nice. Yeah, we split the hotel bill and, you know, she was one of the WISP winners as well. So I was not alone at any point. But if I went and it was by myself, yes, it would have been very intimidating. I want to say I would have spent a good amount of time in my hotel room because of how intimidating it would have been. It's massive. I mean, it's like in the thousands of people, tens of thousands of people that are going. And then Vegas itself is also really busy around that time. So it's the summertime in Vegas. I mean, and then you have this massive conference. It's a lot. If you've never been to Vegas,
And you've never been to DEF CON before, I would say start with a baby con first.
Right.
Or try to convince someone to go with you that you know. It's a very interesting city, but it's overwhelming. Yeah. Even the hotels. I thought everything was bigger in Texas, but no. It's actually bigger in Vegas. Yeah.
It's good that they have a DEF CON 101 track. So maybe starting there would be good.
Yeah if you okay i guess i didn't think of it from that point if you do stick to one track and just like stay in one area and then go to all the talks in that one then you might not be as overwhelmed it's if you have interests all over like if you want to go to the ethical village or if you wanted to go to the social engineering village that's when it gets really
Yeah, I mean, it'd probably be good to watch the DEF CON video, the documentary on YouTube.
Oh, yeah.
Or might not. I'm not sure.
I think any exposure before that is good.
Yeah, go to your local B-Sides or anything like that. Right. So you mentioned something about curriculum. If you had your ideal college curriculum, what would you advise for a college to put in their curriculum?
That is a great question because I'm not 100% sure. That there is one. I mean, tech is already broad and then security is also broad. So there's a number of things to cover, but I think there's no reason why you should pay a bunch of money to go to a university for four years, get out and then realize that everything that you learned or Most of the things that you learn, you cannot apply in the life that you choose.
Yeah.
And then you end up starting from scratch over again. There should be a more practical nature to the curriculum. Now, I'm going to say this. I'm not 100% sure how accurate it is. So I'll just have that disclaimer. But I think a lot of the people that develop the curriculum are academics. Or have been out of the field for some time. So what they tell you to study, what they say is necessary to have a good grasp on things is not always the case. And there's way too many of my friends who have graduated from college and college Pretty much don't even use anything that they learned. So the only thing I will say is if you are a CS major, it will cause you to learn how to think critically, solve puzzles.
But I think that there are more ways to learn how to do that. So rather than spending four years on something, So that's my thing on curriculum. I think the reason why I like WG's program is because it includes real life certs that you will need in your career. So it's practical. When I leave, I have my CCNA, which is a pretty well sought after cert. People that have CCNA, I mean, you can get a job. That is one of the certs that you can get a job off of alone, in my opinion.
Is that still the case? The CCNA?
That's what I've seen.
Oh, really? Okay. Okay. Because I had a different opinion, but that's good to hear from your side because you're out there.
Maybe it depends on locale. I think, yeah, because my coworker, he started or he's no longer with our company, but he started his career in 2015, got his CCNA and like a whole bunch of opportunities came his way.
Oh, that's good to hear. Okay.
I've heard that many times. Now, I did not go the networking route fully. I'm taking the CCNA because of my coursework, and I just think it's good information to have. But yeah, from what I've heard, CCNA at least gets you into networking, and it's a good transition if you're going to go into network security.
Okay. Let me ask you, there's a listener out there that said they have a lot of, you know, they've done a lot of certs. They feel like they have all the technology, but they don't have the confidence. They're like 0% confidence. And, you know, what would you say to someone in that position?
Well, I'm going to make some assumptions about someone who's in that position. It means that somebody or some people around them probably have contributed to that. And the reason why I say that is, you know, there's very few people that will start a career and immediately count themselves out. So typically it's an experience that you have. Now, imposter syndrome is a real thing, but I don't think that imposter syndrome, I wouldn't say that someone with imposter syndrome doesn't have confidence. I would say that they just feel like they're not as far as, you know, the people around them think that they are. Yeah. I would say that if somebody doesn't have confidence that they need to broaden their community, mostly because talking to other people helps you realize what it is that you know and what you don't know.
When you're sitting there by yourself and you're going through your own motions, it's hard to kind of conceptualize how much you've learned and how much you've grown. But when you do different things, like talk to different people in the industry, go to local events, or you... Even go on an interview. You'd be surprised how much you do know and how much value you add. So exposure is best. I would say isolation and kind of trying to figure that out on your own is going to be very tricky, fighting against your own thoughts. But I would say if you lack confidence, find someone who is more senior than you, approach them, ask them how they got where they are, have a conversation. And I guarantee you, if that person is a good person,
By the end of the conversation, you'll feel way more confident than you did before the conversation.
That's awesome. That's great advice. Yeah, thank you for that. So is there anything that you could add from your personal perspective as an African-American and a woman? Advice to others out there.
Yes. Representation is very important. Like I said earlier, I did not come from a tech background at all. I was not even... Presented that as an opportunity growing up, all through elementary school, middle school, high school, nothing. I never, I had no exposure. So I feel like a lot of African Americans and a lot of women, depending on where they went to school, what their background was like, may not have had that exposure. So they come into the industry with other skill sets. When you come into an industry as concentrated in one demographic as tech is, you kind of have to battle against what they have decided is the norm or what they have decided is how people should behave or act or how people should think.
And not all areas of the industry are welcoming towards something different or something unique. A lot of people want to keep it The way that it is because it's comforting towards them. But I feel like if you stay the same and you don't grow, then how can you really truly be the best at anything? How can you say you're getting better? You're just stagnant. So I would say my experience has been very interesting. I think that I have to work 75 times harder to prove that I know what I know. There's a lot of times where I will answer a question and it's triple checked. I'm corrected, even though what they've corrected me to is the exact same thing that I said. There's a lot of times where people are surprised at how I deliver any kind of support or help.
There's lots of, you know, lots of little things like that. And I think a friend, another friend, explained it to me that their experience with women in the industry has been, oh, they're the secretary, or they are the manager, or they are the HR person.
Never...
The equal like a tech person that can talk you know at the same level and so you have to essentially it's kind of like you have to battle that perception until it changes and it can get very exhausting for people who have left because of that people have become discouraged because they feel that they shouldn't have to fight so much just to appreciate Information security, just to appreciate technology. It shouldn't have to be all of this discrimination or maybe not even discrimination, but all of this kind of passive aggressive or micro aggressive type of behavior just so that I can nerd out over something cool that's happening in the industry. I think That is the barrier is that like, I feel like I have to have all my ducks in a row because if they're not in a row, then I'm challenged even more than I already will be with my ducks in a row.
So that personally has been a bit of my experience. Another huge thing is being told What i want by someone else oh interesting yeah and it just constantly happens now we've been on this podcast i have a bit of a valley girl accent so i think what comes with the territory of that is people not thinking i know what i'm talking about just because of how i deliver it I've had to be more stern and aggressive.
Assertive.
Yeah. Well, I would say it's assertive, but I've actually been called aggressive. I've been told my delivery is aggressive and I find that it's anything but that. The reaction I get is a bunch of nonsense. But as soon as I'm what I call assertive or passionate, there's a step back like, oh, wow, this is too much. But then there's also the respect that just comes after that. After that, you know, I don't have any problems. Maybe different in other areas, but that's what I've experienced here in Houston. It's not all groups of people. It's not every single company. It's not even every single manager. But I would like to say that in all of my jobs, I have faced a bit of that. There's like a period where I'm being assessed.
Like, does she even really know what she's talking about? Is she as smart as we think? Does she think she is? Does she have those qualifications that she has? Does she get it out of luck or does she really work for it? There's that. Assessment period before it's like okay she knows what she's talking about and then it goes away but that shouldn't really exist and somebody with less patience than me would say i don't want to
Yeah. Yeah. You know, personally, I've actually found a similar experience. I'll make a recommendation and then the response, it doesn't seem like it's a confident recommendation. I'm like, what did I do wrong? But then I would take a different approach and say, oh no, you have to do it this way. Like be very like sure and aggressive about it. So yeah, it's very interesting.
Yeah, it is. And I hate to Be the person that is pointing it out because I find that there's a lot of people who would roll their eyes and say that and not acknowledge it and say there's this but there's just difference even in my last my last job when dealing with customers we were a security company who supplied security services for other tech departments maybe not tech companies but our customers are typically technical right sometimes I would say something on the phone and they would not Take what I said. Swear was incorrect. And I would grab a male coworker to say the exact same thing that I said. And the person, first of all, their aggression goes all the way down to nothing. And then they take the guy at face value, what he says at face value and everything's all hunky dory.
That has happened at every job where I've had to speak to someone on the phone. I'm always questioned.
As a man, I think sometimes we don't understand this so much. I think it's good that you're saying this because I think there's a lot of people out there that might not understand the situation, right? And it's through education. It's through empathy. People, I think a lot of people have good intentions, but they just might not know how bad certain problems are, right?
Yeah.
So thank you for sharing that. That's really helpful. On a lighter note, do you have any interesting war stories?
Oh, wow. Interesting war stories. Yeah. Huh. Oh.
Yes, I do. In a previous position, there was a moment where they merged two different groups together. One group was more customer facing. That's the group that I was onboarded into. And then the other one was more networking based. And they merged them together. And so the people that had more customer service skills had to learn the networking side. And the people that had the networking skills had to learn the customer service side. So I jumped in headfirst. I was like, I'm going to learn all this networking stuff. Because I had no, I mean, I had primary Linux experience before that. So I had no networking experience. And so I'm like, I'm going to learn everything. I'm going to shadow people.
You know, some of my team members at the time were very hesitant because they didn't want to break anything. They didn't want to, you know, they were just like, oh, we don't want to ruin anything. But I didn't care. I want to learn everything. So there was one particular device.
Sounds interesting.
Yeah, there's one particular device and there was supposed to be a specific fix for it. However, I read the run book a little bit wrong and I updated it. But it was a device that's in production. And the update, obviously, you have to reboot after. So it took so many websites offline.
And I am sitting there looking at this. I'm in the CLI. And I'm looking at the device like, oh my god. I'm looking at the GUI and the CLI. And I'm like, wait. Did I do something wrong? And I immediately get up and I go find someone that was in an escalated team. And I'm like, I did this. This is exactly what I did. And everybody was like, wow, Stephanie, you just go ahead and take down the whole farm, why don't you? And I was mortified.
That feeling. Oh, my God.
Yeah. And then after that, in the runbook, they put in big red letters not to update this type of device.
That's hilarious.
And yeah, I had to live with that. And they would make jokes for months after. And I was like, ugh. So that's one thing I will say is I'm definitely someone who will dive in headfirst to learn something because learning is where I'm happiest if I'm learning. But I'm not going to guarantee. Something's not going to happen, but I will guarantee that I will immediately tell somebody about it. So yeah, after that though, they, I mean, it was funny because the more senior members of the Escalade team would say, You know, at least you're trying, you know, and at least you told us about it instead of trying to hide it. And then next thing you know, we're, you know, having to handle it in a different way.
Yeah. Find out who did it or whatever, if it's in a time.
Exactly.
Yeah. Yeah. I mean, looking back, would you say that there's some sort of entrepreneurial spirit that's necessary for getting into the infosec field? That's what I'm finding out.
Yeah, I would actually agree with that. I probably wouldn't have thought to put it like that. But I think that's actually very accurate because whether you're selling a product or not, I mean, that is what it is. But you constantly sell yourself for a period of time, even when you're in security. I think you have to have that kind of spirit. Yeah, I think you do have to sell yourself. You have to sell yourself on everything. You have to sell yourself to it. Potential employers, to peers, to mentors, to mentees, coworkers sometimes. I think there is an entrepreneurial aspect of being in infosec. And then also a lot of people do consulting on the side anyway to, you know, make extra money or cash.
So all of it feeds into each other. It's a very niche, you know, skill set. And it's in high demand, apparently. So I feel like you have to. You have to have something.
Yeah, I feel like in the pure sense of the entrepreneurial world, where, like you said, you have to try things, break things, try again, you know, that persistence. Oh, yeah.
Oh, you mean like in a startup way?
In a personality trait.
Yeah, absolutely. Because, I mean, that's the only way you learn. And typically, I think that I would like to argue to say that the lessons that are best learned are the ones that resulted in a catastrophic failure. Yeah. That's one you will never forget because you're like, wow, I tried to do so much. I think in technology in general, that's part of the process. Failure, failure, failure, then success. But it's ever-changing, so you'll constantly be looking at one thing or another to learn.
Yeah, that's awesome. Well, we'll leave it there. Thank you, Steph, so much for coming on the show. I really appreciate your time, and we'll talk in the future again.
Thank you so much. I also appreciate you having me on the podcast.
Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.
