Episode 12 · · 48 min
Jack Rhysider From Odd-jobs to Network Analyst to SOC Architect to... Darknet Diaries!
Host and creator of the Darknet Diaries podcast, formerly SOC architect
Episode summary
With an engineering background, Jack found himself doing odd jobs at first. Looking to get back into tech, he certed up and got a job in the NOC (Network Operation Center) and eventually became a SOC architect building a SOC from scratch. Looking to do something different, he started Dark Net Diaries, and it's been an adventure since! This is Jack Rhysider's origin story.
BIO
Jack Rhysider started his professional career in a NOC. He then became a network security engineer doing a lot of work to harden the network and detect threats in the network. He became a security architect and successfully built a SOC for a MSSP. He's currently the host of the podcast Darknet Diaries, where he interviews hackers or those who've suffered a major attack. The podcast has experienced phenomenal growth, so Jack now works on it full time.
Notes
A glimpse into the life of a security analyst and a Managed SOC
Takes about 3-6 months for an analyst to baseline and come up to speed
His first hack was hacking the Sim City savegame file. Dad was thrilled!
Several years of blogging his journey in Infosec helped Jack with his communication skills and explaining difficult concepts to people.
Quotes:
"As a security engineer, I need to know a little bit about everything."
"I would do things like remove (rm -f /) the whole root directory just to see how many files I could delete before the whole operating system would crash!"
"Be fearless, grandma!"
"I think there is a lot of shaming that goes on if people... do security wrong... that kind of makes things stressful."
"I think what [we], as security people, lack sometimes is good communication."
"Taking on tasks when nobody asked them to take it on... is amazing!"
"I would keep corrupting files over and over, but eventually, I figured out which byte in the file was for the amount of money, and I was able to give myself a billion dollars!"
Before infosec: Casino dealer and pharmacy worker, then NOC technician, security engineer and SOC architect
Chapters
- 0:00
Intro: Jack Rhysider's origin story
Ayman introduces Jack with teaser clips about rm -rf experiments, hiring advice and a late-night firewall swap.
- 1:16
Odd jobs, a CCNA and a job in the NOC
Jack describes struggling to find work after college, getting certified and moving from a NOC to security engineer and SOC architect.
- 5:27
What life is like for a SOC analyst
He explains triaging SIEM alerts, false positives versus true positives, and why it takes three to six months to get up to speed.
- 8:33
Childhood tinkering: Apple IIe, Linux and rm -rf
Jack recalls early computers, chat rooms and wrecking cheap machines on purpose to learn how to fix them.
- 11:28
First hack: SimCity save files and early mentors
He hex-edited SimCity for a billion dollars, then found mentors online and encourages helping on open source projects.
- 16:00
Blogging as a creative outlet and a way to learn
Writing up lessons learned built his communication skills, and explaining things clearly deepened his own understanding.
- 22:26
Hiring: experience, certs or passion (and CTFs)
Jack looks for one of three things in candidates and recommends CTFs, home labs and shorter, more focused entry-level job postings.
- 29:06
Quitting to build Darknet Diaries
He explains how a side-project podcast became a full-time job after a three-month sabbatical.
- 34:07
Explaining security in business terms and eating your own dog food
Jack argues security people need better communication, and describes a coworker who adopted new technology fast to stay ahead.
- 39:02
War stories: the admin account and a midnight PIX firewall swap
He recounts ignored alerts about shared admin accounts and rebuilding a hospital's end-of-life firewall from seven boxes.
- 45:06
Junior versus senior: taking initiative
Seniors take on work that nobody assigned them, and that is how juniors move up.
- 47:04
Closing plug for Ayman's new community
Ayman thanks listeners and invites them to join a new community linked in the show notes.
Key takeaways
- A broad degree plus a few certifications such as the CCNA can get you into a NOC, which is a realistic stepping stone into security engineering.
- Blog your lessons learned and notes, because writing forces you to explain concepts clearly and helps both you and strangers searching for answers.
- When hiring, Jack looks for experience, certifications that prove drive, or demonstrable passion such as CTFs, home labs and projects.
- Help on open source projects as you learn, since it can lead to mentors and big opportunities.
- Translate technical risk into dollars and business impact so bosses and clients understand why to act.
- To move from junior to senior, take on tasks, research and projects without waiting to be told.
Notable quotes
Be fearless, grandma.
I think what us as security people lack sometimes is good communication.
the senior is always taking on tasks when nobody asked them to take it on.
Questions answered in this episode
- How did Jack Rhysider get into cybersecurity?
- After struggling to find work with a computer engineering degree, Jack earned a CCNA and got a job in a network operations center. Further certifications moved him into a security engineer role, and he later became the architect who built a SOC from scratch.
- How long does it take to become effective as a SOC analyst?
- Jack says it takes roughly three to six months for a new analyst to get up to speed. By then they can recognize false positives, spot true alerts and add value to the team.
- How can you show passion for security when you have no experience?
- Jack suggests showing a home lab, projects you built, or CTF challenges you completed, which can be found on sites such as CTF Time. He says any one of experience, certifications or passion is enough to get his attention in an interview.
Show notes and links
Show the original episode notes
With an engineering background, Jack found himself doing odd jobs at first. Looking to get back into tech, he certed up and got a job in the NOC (Network Operation Center) and eventually became a SOC architect building a SOC from scratch. Looking to do something different, he started Dark Net Diaries, and it's been an adventure since! This is Jack Rhysider's origin story.
BIO
Jack Rhysider started his professional career in a NOC. He then became a network security engineer doing a lot of work to harden the network and detect threats in the network. He became a security architect and successfully built a SOC for a MSSP. He's currently the host of the podcast Darknet Diaries, where he interviews hackers or those who've suffered a major attack. The podcast has experienced phenomenal growth, so Jack now works on it full time.
Notes
-
A glimpse into the life of a security analyst and a Managed SOC
-
Takes about 3-6 months for an analyst to baseline and come up to speed
-
His first hack was hacking the Sim City savegame file. Dad was thrilled!
-
Several years of blogging his journey in Infosec helped Jack with his communication skills and explaining difficult concepts to people.
Quotes:
-
"As a security engineer, I need to know a little bit about everything."
-
"I would do things like remove (rm -f /) the whole root directory just to see how many files I could delete before the whole operating system would crash!"
-
"Be fearless, grandma!"
-
"I think there is a lot of shaming that goes on if people... do security wrong... that kind of makes things stressful."
-
"I think what [we], as security people, lack sometimes is good communication."
-
"Taking on tasks when nobody asked them to take it on... is amazing!"
-
"I would keep corrupting files over and over, but eventually, I figured out which byte in the file was for the amount of money, and I was able to give myself a billion dollars!"
Links:
- Darknet Diaries Podcast
- @JackRhysider
- CFP Time
- Intro Music by Trash80
- Outro Music by Mid-Air Machine
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
Hey everyone, I'm Ayman Elsawah and this is Getting Into Infosec. My guest today is Jack Reciter. You may know him from his excellent Darkened Diaries podcast. We talk about Jack's origin story and how he got started in infosec.
We do things like move-rf the whole root directory, right? Like, just to see how many files I could delete before the whole operating system would crash. And then what would happen if it crashes?
He offers a lot of advice from his career in infosec, from what he looked for when hiring to how to excel in your career.
That's how you can move into that senior role is to find projects and tasks to do and just take it upon yourself to do it.
Jack also walks us through a really interesting moment where he had to replace a firewall for a client really late at night.
I give them my address. They send me this firewall. It comes in seven boxes. Power supply in one, the network adapter card in another. I think there's a fan in another box. Like I had to assemble this thing because it had some old clients config on it.
All right, on to the show. Hey, Jack, welcome to the show.
Hey, thanks for having me. Really excited about being here.
Yeah, thanks for coming on. I really appreciate it. Definitely very exciting. We're going to kind of talk about either Jack 2.0 or 1.0, like before Darknet, right? Want to kind of find out what Jack was doing, you know, how he got into information security, kind of the Jack origin story. So maybe give us some background on what you were doing professionally before Darknet.
Yeah. Way back a million years ago, I did go to university and got a degree in computer engineering. And these are always really general degrees. They never teach you like a lot about something, just teach you a little about everything. So it's like one course in assembly, one course in Perl, one course in operating system. What can you really get out of one course, right? So coming out of that, I didn't really have like a specialty and I had a really tough time getting a job. I don't know like if I had this expectation that, oh, I'm worth like $80,000 a year now and I should just go in as like a senior or something. But like I just had a really tough time finding anything that's coming out of college.
Really? Yeah. Even just a regular entry-level engineering job, huh?
I thought, yeah, it just, I couldn't find it. Okay. And so I just took odd and ends jobs. Like I was working in a casino for a little while as a dealer. I was working in a pharmacy for a while and just doing whatever I could to get by. Okay. And then I was like, you know what? I need to go back to my roots and get a tech job. So I re-certed or I certed up. I got a CCNA, the Cisco cert. And from there, I was able to land a job in a NOC.
Okay.
A network center monitoring. It was a multi-managed service provider. So we monitored about 80 different clients, their network. And so we'd monitor up-down status of all these routers and switches, as well as phone lines and, of course, security stuff.
Mm-hmm.
And from there, they had engineers that worked there too. And I always wanted to be an engineer. I'm not just watching the up-down status all the time. So I eventually was able to get a bunch more certs. I got a CCNA, CCNA Security, CCNP. And they said, oh, wow, you're really dedicated. You had an engineer position. So I moved over as a security engineer. And that's when... It kind of all clicked to me. Oh my gosh, all the stuff in university that taught me a little bit about everything in tech is now coming back to me as a security engineer. I need to know a little bit about everything. I need to have a good, solid understanding of operating systems, of programming languages, of all those things that they taught me in university.
But now I can become a little bit more specialized in security, but still having that wide knowledge was so helpful.
Nice. Okay. And did they ask you to go into security or did you proactively ask or how did that transition actually happen?
Yeah, I was just kind of desperate to do any engineer position. Okay. And they were really hesitant to be like, are you sure you want this one? And I'm like, oh yeah, yeah, definitely security. Sure. Right. And I'm so glad I did because if I would have taken like just a data network engineer, I would just been doing BGP for the rest of my life, you know? Right. So having to go into security, I think, was just kind of coincidence that opening was open and I got into it. And so from there, I was able to really start up a lot more and just specifically security, CCMP security, checkpoint security, blue coats, certified ethical hacker and like a bunch more. This turned me into a kind of a senior level role after being there for a while.
And I was doing everything firewall, everything intrusion detection, monitoring. I was doing a lot of syslog analysis, hardening the network, securing the network, and then trying to find threats in the network. And then after doing that for a long time, the company wanted to build a SOC, a security operations center. And I was the architect for that. So I had to build out tools and the procedures and even get the team built up to build a SOC out of nothing. And that was the hardest challenge I've ever had in my life. Nice.
That's awesome. So how many people were running the SOC at that point?
There were about three or four of us analysts that were trying to watch it 24-7. And if you do the math, it's impossible for four people to watch it 24-7. And that was really a big frustration of mine is we just didn't have enough people to launch it successfully, if you ask me.
Kind of like the oversubscription model, really.
Oh, yes, exactly.
So a lot of the folks out there, when they're trying to get an entry-level job, it's going to be like a security analyst position or similar, right? So something where you were doing for some time. Give us a little insight as to what the life is like of a security analyst, just starting out.
Yeah. So what we would have them do is use the tool. In this case, it was a SIM, a security event manager, which is collecting all the logs and telling the analyst that there's something potentially a threat here. You know, a rule would trigger and say, oh, this doesn't look right. Let's look into this further. And so you as an analyst would take a look at that and investigate. And you might investigate by doing a Whois lookup on the attacking IP and what kind of system was it attacking. Is it hitting a Windows machine or a Linux machine? You kind of have to do this investigation. As to what this threat is, how important is this threat? Is it legitimate threat? Is it a false alert? Because if it's attacking PHP, but that's not a system that's running PHP, then we can mark that as a false positive.
So it does take some time to investigate each alert to determine whether it is a true alert or not. And, you know, at that point, if it's considered a true alert, it would be escalated to an engineer to take a look at it further, an incident responder or the customer to investigate the issue a little bit more detail.
Yeah, I mean, there's a lot of stress with trying to make sure that what you're looking at is a false positive or, you know, see if it's a false positive or a true positive, right? So, you know, at what point do you know that what you have in front of you is a false positive? I imagine it's a stressful environment, right?
Yeah, and I think a lot of my texts, they just kind of erred on the side of caution and said, it's a true event. Let's make some phone calls. And that would probably be a better way to handle it because it covers your butt. You're not going to call someone and it be a false positive and then you wish you didn't. You might get chewed out a little bit about it, but the opposite is even worse, is seeing something, mark it as a false positive, And then it actually was a big event and you didn't do anything about it. That would be, you know, could, you know, lose your job over that instead of just getting chewed out. So a lot of people just erred on that, not knowing, you know, and I always told them to, you know, if you're not unsure, just, you know, call an engineer, call a person and have them help you take a look at it, see if they can determine this.
So it is difficult. And I did have a challenge trying to get people trained up on knowing all the different threats that could happen and And how to rule out false alerts. So one of the things that I've noticed is it might take about 90 days, you know, three to six months for an analyst to kind of click in their head of how to see things clearly, how to see that's a false positive, how to recognize that's a true Alert and kind of be a value add to the team. And so I think that six months is kind of a sweet spot. And once you get there, then you're really looking better and you can start teaching other analysts how to find false positives or not, you know, in a little bit better way. So there's just a learning curve, I think, to it.
Tell us about how you got into tech, maybe when you were younger, some important influences in your life that led you to, you know, technology and things like that.
I think my first computer was Apple IIe, and this was before Windows 3.1. And then we got some IBM computer that was running DOS, which still didn't have Windows yet. And these computers just totally fascinated me. Of course, the video games were fun, but then I would start making things out of basic, and I could do basic programming, To spit out all the colors or make a sound of every, every frequency and hear it go up and down. And I, and I would just love experimenting with it. So those were the early days, but then when the internet came along and you could just connect with people and talk to them and share ideas and, oh, it was so amazing. Like you really felt like I don't know, like the whole world opened up at that time.
So it just like, you know, my parents were trying to teach me how to type, but I had no interest. But then when a chat room was and I could talk to other teenagers my age and stuff, all of a sudden I wanted to type real bad. So, you know, those early days of just tinkering around on there, I think is what just struck my interest to get going. And, you know, that just stayed strong, I guess, all my life. I've always had some, you know, a bunch of computers around or a lab or something to just tinker with. Yeah. As going through high school and college, I'd find old computer parts at, you know, the Goodwill store or whatever and build, you know, really cheap Linux machines just to play around with and Unix.
In fact, I played with every operating system at a time and I would do things like remove dash RF, the whole root directory, right? Like, Just to see how many files I could delete before the whole operating system would crash. And then what would happen if it crashes? And this was on a cheap thing that I just built like an hour ago. So it was okay if I broke it because... And then when it does break, when it does get to the point where it's unusable... Is it restorable? And I would try to fix it from that point. Could I restore some of these files? Could I reinstall the drivers? Whatever it was that I deleted to try to get out of that situation. Because my grandma was always so worried about doing the wrong thing on a computer.
And I'm like, I could fix anything you do wrong at this point. I know how to get out of any situation perfectly. Be fearless, grandma. Do click anywhere. Do anything you want. I can get us out of it. And so I just had that experience of and, you know, the opportunity to just experiment and play and just to have it around in my house to just go nuts with. And I think that really gave me the, you know, the jungle gym, the lab to really explore.
Yeah, it's that itch, right? That itch that just, you know, you want to scratch it and then just keep exploring.
Yeah, exactly.
That's awesome.
And there's always so many computers going around in college days. Like I would try running password cracking on one computer and just see, you know, it'd be a month to try to crack some passwords. I would just keep running and running and running and I'd see how long I could do it. And there's just always some sort of project going on.
Yeah, there's something about this itch. So can you remember what like your first hack was? And your hack could be technical, but it could also be non-technical too. What was your like first life hack?
The first one I remember clearly was SimCity, which was a single-player world-building game, SimCity 1. And I got into the save game file, which was totally unreadable by humans, okay? It was gibberish. But I opened it up in a hex editor, And I started playing around with some of the numbers in there. It's still gibberish to me. But then I would see something like, oh, there's the name of my town. And there's the date on my town, the year. And you could see just little things like this. In there and then I would look for how much money I had and then I would change the number there and of course I would totally corrupt the save game file and I'd have to build a new save game file and then I'd try changing it again and I would keep corrupting files over and over but eventually I figured out exactly which byte
In the file was for the amount of money. And I was able to give myself like a billion dollars or something. And my dad, who really liked playing the game, was thrilled that he had a fresh SimCity game with a billion dollars that he could just go nuts with. Because at the time, there wasn't any other like hacks that you could do to just get a bunch of money. So... We were able to do that. And that kind of shortcuts your whole gaming perspective. Instead of spending a month to try to get a billion dollars in the game, what if I just spend a week to hack the program to get a billion dollars? To me, it was like the same game. It was just as much fun, if not funner, to try hacking it than it was to actually play it.
Yeah, that dopamine effect, right? It's like that reward system that you just got.
Yeah, exactly. That's cool. That's cool.
And were your parents into tech? Did you have other friends that were into tech? Like, did this just happen in a silo, right, by itself?
I think, yeah, I didn't really have anyone around me that was into tech, but once I got America Online and eventually IRC, I found those people who were into tech. I lucked out to find such a strong influencer early on who could tell me like, oh, you should get this book on how to learn C, and I'll even give you some challenges on how to program in C. And at the time, that person was running a MUD, and they let me be a programmer on a MUD, which is a video game that's all text-based, like Dungeons and Dragons, but it's all text-based. And so I started programming in C on their MUD, and that was some of my early projects that I was doing, learning how to program with other people and stuff. I really think it's a good idea to, as you're learning something about tech, is to kind of help out on another project.
And there's so many GitHub projects out there and open source projects out there that there's got to be one that you love or love the idea of. And they definitely need help. I'm sure some projects that you love need help getting them even more done. And you'd be surprised how you could help. Even not knowing that much about programming, you can start talking to the main contributors and say, hey, what can I look at here to try to help build this project a little bit further along? And I'm sure they'd love to help you help the project and collaborate with you because everyone needs help programming their thing. I just think it's so, it can change your whole life just to be in some of these early projects because you don't know how big it's going to get and you don't know how cool of a mentor you could get out of this.
And there's just so many great opportunities that you can get out of helping out.
Yeah, exactly. I think two things out of there that you just hit on the head was get involved, but don't be afraid of getting involved. And I think a lot of that latter part, a lot of people are afraid of getting involved. Like, oh, what can I contribute, right? And just getting that confidence. What would you say about that?
Yeah. I mean, you pick up a book, you read some tutorials. I never really like was the person that was like, let's learn this programming language and then go build something. I really have this idea of this is what I want to make. What is it that I need to learn in order to get there? And so I guess that's just been my mentality of like, what needs to be done here? And then I'll learn what I need to do in order to get it done. So if you just have the passion to like want to build something, either build like a web app or a program or something, you know, maybe on GitHub that you found that's cool. Once you have that passion, then nothing should really stop you because you want to do it. And, you know, you have the capabilities.
You can go to the library and use a computer if you need to. Like you should be enabled to just do what it is you need to do because, you know, You got things in front of you.
You know, something I've been finding out a lot about lately is that a lot of security folks have this creative side to them. And it could be really big. It could be really small. Right. Take, for example, you know how you have the show right now. You've created something. So tell me about like your reflections about, you know, your security side, your tinkering and the creative side that you've now tapped into. And how other folks can kind of use that as far as like getting into the field?
Yeah, I mean, I've always had this idea that I want to, I don't know, be an entrepreneur, make something for myself. And so that's always been like something I've wanted to do, but I never felt good enough to do it. One of the things that I did early on in my career as a security engineer was just start blogging. And I mean, I even started with a WordPress blog, which I think is incredibly insecure and probably not a good idea. But it didn't matter to me at the time because I was just like, I want to get these thoughts out. And basically, I blogged about lessons learned where I would click that button. And that was the absolute wrong button to click. You should never type that command ever. And that's like a lesson learned.
And so I would blog about that to say, hey, remember, never push this button. And then other things I would blog about are when I would try to look up something that I need to do on a firewall. And it just isn't in the documentation. Nobody's talking about it online. There's no help. And so you're off the map and you're learning how to do things on your own, maybe by trial and error and opening up tickets with Cisco or whatever it is. And so those situations I would absolutely blog about too. Because I'm positive someone else is looking for that same question online. And so maybe my blog can help them. But at the same time, I think the majority of reason why I was blogging at the beginning was to help myself when I need to do that again.
Instead of looking back on your notes, what notepad did I put that in or Trello card or did I write it down on a piece of paper? Just put your notes on a blog because it's going to help you later. But it's absolutely going to help a ton of other people as well. At this point, there's something like 30,000 people a month that visit my blog to just look up basic questions, like how to do a factory reset on a firewall. Because I had to do this so many times. And I'm like, let me just write down the step-by-step guide for not only me, but my juniors and everyone else. So anytime anyone asks me, I'm just like, look, here's the procedure. You just use this procedure. So this was kind of a creative outlet.
I had to make some graphics on there and I did switch it from WordPress to a more secure Jekyll blog with just a flat HTML. There's no PHP or anything that you can use to exploit. But this was definitely a creative outlet because then some stuff I would do think pieces on and stuff. And it was interesting to hear other people comment on whether that was right or wrong and And ideas behind it. So there was a lot of just creativity there. I mean, there's another thing of like, if I just felt like all I was helping out was my coworkers and my clients and there was, and that was just a handful of people. Right. And I felt like I wanted to help more people. I wanted to help maybe dozens more or hundreds more.
And by blogging, I felt like I was doing that. I was reaching that bigger audience of people who were appreciative of what I was doing and saying, you know what? I've spent six hours looking for this answer. And here it is right here on your blog. Thank you so much for putting this up. You saved my butt this weekend. And those are just great feelings. So that was just part. I think that's where a lot of it started was just blogging.
That's really good. And even the act of blogging or writing about it will help you learn it more, right? You will kind of cement it in your brain a little better.
Oh yeah, definitely. Explaining really complex concepts clearly is a very difficult task. Specifically, I had a blog about troubleshooting a VPN and a post about that, and it started out as a mess. And then over the years, I was able to simplify it and simplify it and simplify it. And it's one of my top articles now, is when people are hitting certain error codes on VPNs, troubleshooting, they'll find my blog right away, especially for Cisco, right? So Getting it down to just like kind of that above the fold thing as well so that no scrolling is needed to find the answer. Just put the darn answer right at the top of the page. This is the question you have. This is the answer for you. End of story.
What more do you need to know, right? And so, you know, just explaining these complex concepts clearly took a long time to figure out. And I went back and I revisited a lot of articles just to explain it more clearly and more clearly and more clearly simply, right? You don't want to overly complicate it. You just...
Simply explain it and people will appreciate that so much so much you know it's amazing is that sometimes you have an idea in your head or you know how something works but when you go explain it you kind of either freeze or you can't fill in the gaps or whatever it is maybe it's a memory imprint issue right where you kind of you know in your head you think you know it have you ever heard of people saying you know well you know just explain it to your cat to your dog to your little sister or brother things like that has that resonated with you ever before
Yeah, absolutely. There was this one guy I worked with where it seemed like every time that I would ask him a question, as I was asking it, I was realizing what my answer was. And I would just say, never mind. And I'd go back. I knew the answer. And it was always weird to him. Like, why does he always ask me a question and then never want me to answer it? Like, this is the strangest thing. And then I had to explain to him, like, every time I started asking it, now that I'm saying it, I know the answer. Like, I know what you're going to tell me is the answer, at least, you know, like that much. Is you start listening to what you expect them to say to you in response. Like, did you try looking here or something?
Oh yeah, I didn't try that yet. So hold on, I'll get back to you. So yeah, just verbalizing it is one thing. But then again, like when you think you have a concept, trying to teach it to someone else is when you're really going to have that concept as well. You're really going to understand it because now you can explain a little bit more detail about, Of why it's like that or come up with the theory behind it. And so many things in the Cisco world, there is no theory behind it. This is ridiculous the way this is done and I can't explain it, but this is the way it is. And some people wouldn't accept that as an answer, but that's just part of trying to teach someone is getting past some of those more complicated questions that they have, like, well, why would it be like that?
And now you've got to really try to understand the reason why it's like this and not just how to do it, but why do you do it that way? And that really solidifies it in your head and By teaching others, by blogging and trying to just teach others was really what I think helped me boost my career to a higher level.
What are some things you were looking for when you were hiring someone, especially someone junior or new to the field?
Unfortunately, we didn't get a lot of good candidates. So I kind of lowered my expectations. And what I was looking for was one of three things. Number one, you have experience. So you've done this before. You know the role. You're experienced. You know what's going on, right? So if you were a security analyst before, great. I'm hiring a security analyst. You've been in this before. Excellent. So that would be a first pass, I like you already kind of thing. A second thing that I would look for is certs. So maybe you don't have any experience, but you have this strong desire to learn. And by getting certs proves to me that you have this desire to learn. Because if you say you have a desire to learn, but you have nothing to show for it, we'll take those steps before coming into the interview.
I don't want you just to come in because you want to learn this. I want you to kind of show me that you have learned this before coming to me. Because that shows me the drive and the passion that you have. And that's kind of the third thing that I look for is passion. In this. And I've interviewed people who are like, yeah, I'm super passionate about security. And I'm like, what are your favorite blogs that you read up on? I don't read any security blogs. What are your favorite conferences that you've gone to? I have never gone to a conference. What is your favorite security tools that you use? I've never used a security tool. What do you mean you're passionate about this? If you have nothing that you've ever done in security, show me the passion.
So I think the biggest way you can show passion in an interview is to show me your home lab, Show me what projects you've worked on before, or show me like some CTFs that you've done. And the CTFs are amazingly great at teaching you. These are the capture the flag challenges where they're usually free and online that you can take from your home or even from the library. You don't even have to have any special tools. And they're little puzzles, security puzzles, like Elevate your access on this Linux machine to find the flag or something, right? Or decrypt this encrypted message. And it's not even encrypted. It's just base 64. So it's just encoded in a way that it doesn't look like it's readable, but maybe it's just rotation 13 or something.
It's really basic decryption. And so now you get into seeing how messages get hidden and stuff like that. If you could show me a list of CTFs that you've completed or competed in, holy cow, that shows me so much passion on your side. That alone, just the fact that you want to complete these things is good enough. You don't need experience, assert, and passion. I just need to see one of these three things. And so many people come to me with none of these things and they just didn't even want to, I don't know how I can, you know, do anything with you if you haven't even made the first step. So making any of the first steps in any of those directions, it's good enough for me to listen to see if now, you know, I'm listening for, are you a team fit?
Are you teachable? Are you someone who could teach me something? Is this something that you want to do? And those, you know, those are just the basic interview questions that you're going to ask in order to try to find if somebody wants this position and they'd be a good fit.
Have you heard of the website CTF Time? Yeah.
CTF Time has a bunch of challenges up all the time. You can get together with teams and tackle various competitions. It's really great. And those are the exact places that if you can get in on that and get some of those done, wow, I think that's for the resume. Put those on the resume. The challenges you've completed, put them on the resume.
Do you think we as a society or as infosec community, are we setting the bar too high? Do you think we're not doing a good job of kind of helping those that are new to the field? Or what are your thoughts on that?
It's hard to say. I think there's a lot of shaming that goes on of people who do security wrong and then they get pointed fingers and laughed at. And that kind of makes things stressful. Like, You know, am I doing it right? I don't know. What's the right way? And nobody really wants to help and tell you what the right way is because it's really complicated. And so I think some more compassion there of just like, look, security is really hard and you're going to mess up and that's okay as long as you have a plan on how to recover. And you know what the consequences could be if you mess up and that kind of thing. But I think it's becoming more of a... There's more technology out there and more complexities and more things need to be secured because it's not just securing your servers and your computers.
Now it's securing printers and securing the mobile phones and the desk phones and any other tablets and... Projectors and you know smart stuff that's coming into the office network and so the landscape is just growing wider and wider and now it's not even the stuff isn't even in your network now it's now in the cloud so where is the perimeter of your network who knows like i don't own this ip amazon does but i host on amazon and so can i pen test against this like it becomes like so much more complicated at such a fast speed that it's really hard to keep up with even when you are very senior in this space And so I think if we give people entry-level jobs that are more focused on a specific task and not so wide, I think that'll help us get more people into this space, maybe.
Because then they'll be like, oh, I can do that. That's not so hard. That's, you know, you might do this one thing. And then from there, you can, you know, teach them two things, three things, five things, because your employees will figure out what it is they want to do next. And they'll start having an interest. Well, I'd like to also do auditing or malware reversing or something. And you'll see where they want to go next. And you can try to fit them in that spot.
Yeah, sometimes companies try to put everything in the kitchen sink in a job description and kind of has a counter effect where it intimidates folks to not even apply, right? Where they really only need 30% of those skills for their actual job, but they'll put 10 other things. What did you say?
Yeah, and something I've noticed from people applying as well is that the guys, the males that apply will apply to jobs that don't have all the qualifications. They're like hoping that, you know, they didn't really require you to have all those requirements. And they'll apply anyways. And the females, they won't apply unless they have all the qualifications. And so they don't feel like they fit if, you know, it's saying, you know, you have to have these 20 requirements. Well, I don't have those, so I'm not going to apply. And that's what I've kind of seen overall as far as people applying to some of these positions as well. I don't know if it's just like a game of the way corporate is of they're like, oh, well, it would be nice if we had these 20 things, but we'll settle on these five.
I think it's just a struggle of making the right opening, wording the job opening properly because I've never seen them look good and like a million companies all over the place. And so I would say just give it a try. If they like what you have on your resume, then they're going to bring you in. And if they don't, then no big deal. You'd go on the next company and apply there.
So I'd love to hear how you transitioned from managing a sock to starting Darknet Diaries and becoming all in Darknet Diaries. Were you doing it full time now?
Yeah, that's been quite the fun transition. Like I said, I had this idea of wanting to work for myself and being an entrepreneur, making a startup, something where I'm able to, you know, make a living on my own work. And, you know, the blog itself was actually making some money as far as ads go on there. Not very much, but it's one of those things that's like, okay, I have this crack in the wall. Now I need to build this crack bigger. I just need to get more people to the blog or something, you know? So I was starting to get really focused on how do I get more people to find me and use my site? And maybe if I make some instructional videos, maybe that'll help or something, you know? So I kept really adding to the blog and I was like, you know what?
I think there needs to be a podcast that talks about infosec stories. And I want to hear stories about people who were there that got hacked and not so much some experts saying, well, it's a good idea if you're in this breach situation to do this. No, I want to hear about the person who was breached. What did you do first? What was your first steps? What was your second steps? Was that a good step? If you look back on that, did you do steps differently? And I want to hear those exact stories from, you know, ground zero. And I didn't really hear anyone talking about that. Nobody wanted to share, on podcasts at least, their company getting hacked stories. And I go to the conferences and I hear people telling these stories.
So I'm like, let's get these stories out there. I want to hear this. And then at the same time, I want to hear the story from the hacker side. What was it that you saw that got you into this network? And what did you do when you got in there? And I want to hear those stories as well because I think those are equally as interesting stories. So I started talking to some podcasters, but they didn't really have any interest in covering that kind of thing. They thought that was too hard or didn't understand it or something. So I really wanted it and I just decided to build it myself. So I worked on the podcast Darknet Diaries to create a couple episodes to test with my friends to see if this is interesting enough for me to pursue.
And that worked out. They liked it. They said, yes, do it. I love it. And so while I was working as a kind of a side hustle at nights and weekends, I would work on this podcast. And, you know, I launched it and I immediately started marketing it, trying to get more people to listen. You know, I was emailing journalists and other influencers and saying, hey, do you think you can tweet about this or something? You know, listen, if you like it, tweet it. And that was working like people were spreading the word. And at the same time, I was getting really burnt out at work. Like I said, building that sock was just like the biggest test I ever did. So 10 years of working there and being burnt out, I was just like, I need a break.
And I'm going to take a break. I'm going to take like a sabbatical. Let's just take three months off and work on this podcast and see if I can pull it up to make money over that three-month break. So I had already been podcasting for six months. And so six months plus another three months, it's probably nine months into podcasting. And I took that three months off. I quit my job and just put all my focus into the podcast. And sure enough, I was able to get it to a place that was not making where I was before, but enough to live on. And I thought, okay, if I could do that in the first nine months, maybe in a year, it'll be more substantial. And then two years, it'll be where I was or something.
I don't know what's going to be in the future, but it's enough now that I don't need to go looking for a job. It's enough for me to live on.
Yeah. I mean, the sound editing, there's a lot of work that goes into podcasting from learning from myself. So the sound design, all that stuff, it's just been great. It's a really good hook. It got me hooked. I remember hearing it and I was like, wow, this is, you know, it was blowing away. Listen to it in the car. You know, if you ever saw me driving and just like laughing. Hysterically, that was me listening to your podcast. Yeah.
I remember we met at DEF CON and you came right up to me and said, I love your show. And those were kind of the reinforcements of like, what I've got here is something special. And I should focus on this because if random people, strangers, because I didn't know you then. Are coming up to me and telling me this, then I'm touching the right audience, I'm affecting the right people, because you know security, you've been here for 10 years yourself, and it still was, the story has amazed you, and they surprised you, and they made you laugh, and they made you excited about listening to the next one. And I thought, okay, if I can capture your attention as someone who's an expert, But then also make it broad enough for someone who may not know that much about it that it's still reachable to them, then I really think I had something.
And the other thing is security has so much darn drama in it. There's always some hack going on and it's high stakes stuff. So I just think it's ripe for a riveting show.
Well, it's amazing. It's just everywhere now. I mean, even a Black Mirror episode, you know, recently, they're trying to hack out of the game, right? So there's, you know, hacking now is just so mainstream. But yeah, you know, how do we explain, like you said before, difficult concepts in a way that everyone could understand, right? That's just takes a special skill.
Yeah, and somebody told me that if you can explain these difficult concepts clearly, that's worth money to some people. And I think this is how it's paying off. Having this podcast, now I can explain what a VPN is to my dad, who doesn't understand tech at all, and he gets it enough to understand that part of the story to let the story continue. And he's not totally lost about it. He's like, oh, okay, I understand this. And it was only after having that VPN blog post that I've been modifying for like six years to try to... Fully explained VPN. So it's that practice of blogging for seven years got me to the point where I can do something to reach a wider audience. And I'm not saying people should turn their career into podcasting, but it's just one of those experiences that I really think that being able to reach the right people can be really impactful.
And if that could be your client, Or your boss or somebody to convince them like, this is what needs to be done. Because I think what us as security people lack sometimes is good communication. We're good at explaining technical things, but that doesn't always mean that's what we need to do to explain it to our boss or our client. Because they don't always care about the technicalities. They just want to know how does this impact me? What's the bottom line here? Is there money involved? Is there people involved? Tell me like, you know, in my language, not in your language. And that's where I think we break down in the communication. And like I said, the blogging helped me explain these concepts in a way that was different and unique and really helped me get there.
So one of the things I was able to do to convince some people outside of my circle, like my boss and my clients, was to explain the financial impact. And this is totally outside my expertise as a security person, is figuring out how much does it cost for a breach? Because I don't know how much people are paid per hour. I don't know how much these computers cost the company. All these things that I just don't know because I'm not in the purchasing division or whatever it is that we did to acquire that. I don't even know how many people work there. And so actually trying to figure out these answers and then give that to the client was a massive success because now it's in their terms. It's in their language like,
Okay, if we don't take action here, this could cost the company $80,000. But if we do apply this firewall rule, then it may not cost that much. It may not cost anything. So now they're like, oh, okay, you know, we see the risk versus reward here. And I think that was really valuable to a lot of people.
Yeah, being able to be that translator is important in and of itself. So kind of getting out of your bubble and being able to translate to everyone. I want to ask you, so something that is important as a, you know, someone trying to enter the field is kind of eating your own dog food, right? So if you're going to tell folks to be secure, you kind of need to be secure yourself, right? Like, you know, if you're telling employees to use two-factor authentication, you're telling your friends to use it, but you're not using it, well, you know, eat your own dog food so you can, one, learn it, and two, kind of empathize with them, right? So, and, you know, we call that operations security, right? OPSEC.
So is there any OPSEC that you could share?
So I think just at work, I had an engineer that worked with me that I was really impressed with what he did all the time. And one of the things he really did a lot of is adopted new technology as fast as it would come out. This is a guy who's running an old flip phone, right? This is not a person who likes the newest technology in the world. This was his job, was to secure clients' networks. And to do that, he needed to understand the latest tech. Because if he understood the latest tech, then he knew the latest security technology And if he understands the latest security, then he knows if he needs to go to his clients to update to the latest security. Like, is this groundbreaking? Is this changing?
And if he keeps up to date and like to the bleeding edge up to date, then we're going to have the most cutting edge security. And whenever we get a client that wants the most cutting edge security, we're ready. We have it because we've practiced it ourselves. This was eating your own dog food kind of thing, right? Like, let's put all the factor authentication in. Is that like a better solution or not? And he was extremely experimental in a very safe way at work to secure our own network to the point that nobody could understand the pace that he was moving. He was just moving so fast. But because he was moving that fast, it made us go into the future in a way that was so much more advanced than maybe our other teams that worked at the company that were under us or something.
We're running much older equipment and it's like, well, guys, you haven't updated your software in six years compared to us who updates it nightly, you know, like there's this big difference. And I think just getting on the latest stuff and staying on the latest stuff and utilizing all the features and technologies and stuff like that really helps you understand what it is you're missing or need to implement and all these things and try and just keep trying to build it better and build it better and build it better. And that constant work of him trying to make it better all the time Made our network extremely secure because we knew every possible way to secure our network because we had tried every possible way.
Nice. That's really good. So do you have any cool war stories to share with us from your SOC days?
I kind of have a depressing story where I would get alerts that I thought were really bad, and I would try to bring them to the attention of the client, and they just didn't want to do anything about it, such as administrator being used on a ton of systems. I mean, the username administrator, right? Right. We don't know who is the username administrator. It's not like, oh, John is using administrator. No, the person named administrator is using administrator. I don't know who this is. It's like a shared account. It's like guest. Who used guest? I don't know. A guest. Well, what's their name? I don't know. It was a guest. So the same thing with administrator. We don't know who used administrator and they were using it 10,000 times a day in networks.
And I'm just like, guys, we need to get rid of this. And the client didn't quite understand the reasoning. Like, well, we have to log in as administrator. No, log in as John Doe dash administrator. That way I know John Doe. With the John Doe Dash administrator, Privileges is the one who logged in and made these changes and did this stuff, but we don't need a username administrator. So my biggest challenge coming into new clients' networks is completely removing the username administrator and just let's turn it off 100% entirely, make it unloginable, Because this is the number one attack I'm going to see when an attacker comes in. They're going to try to log in as administrator. They're going to say admin, admin, admin root.
They're going to keep trying all these passwords on admin. And so eventually they may crack into the admin account. So if we have it off altogether, then they're never going to log into it because it just doesn't work. And so let's change it to a different username, a username that I know is that user. And then I can call them up and say, hey, John Doe, did you log in to this and make these changes? And they can say yes or no or whatever it is. Right. And at least I have someone accountable for who it was and not just I don't know who's logging in as admin. Yeah, I think that was just a big struggle that was kind of a war. And I suppose a story that I had to go through.
Well, when the target hack happened and when you found out, you know, all the details of how all these alerts were ignored, what went through your mind when you discovered that?
Yeah, it was hard because I feel like I have this Cassandra syndrome sometimes where I'm like, guys, guys, there's this problem here, there's a problem here and nobody listens to me. And now I had this news report that says, hey, look, somebody saw a problem and nobody listened to them. So you guys need to listen to me now because I'm seeing problems and nobody's listening to me and you don't want to be target hack. But it barely helped. So it fueled my Cassandra syndrome more of just like nobody's listening to me.
Any other like war story you could think of? During your time as a security, either engineer or even just a regular in the NOC?
Oh, okay. I've got one. Yeah, sure. There was a client who was a big medical center, a hospital or a medical provider or something. And they had a firewall go out. And I don't know how, I was a senior. So I got involved because whoever was working the case was like, look, I can't fix it. Can you help me? And so I got involved in this situation. And first thing I realized is the firewall that went out was a PIX firewall, Cisco firewall, which has been end of life for six years, 10 years. It's been end of life forever. And I was trying to go home. I was like, look, I'm done with my shit. You know, it was like five o'clock at night and they said, no, this is a life or death situation when the doctors can't, you know, get to their clients because the firewall's out.
They can't, you know, give the medical, you know, tools just don't work and all this stuff. Like we could potentially lose lives here. And I'm like, this is not my problem. You don't have an up-to-date firewall that we can replace. I cannot replace this. This has been end of service, end of sale, end of life for a long time. There's nothing I can do about this. You need to go buy a new firewall. And when you buy a new firewall, you can call me back and I'll put it in your network. And they said, that's not an option. You need to get us another one of these replacements. Somehow, they had a very special contract with Cisco that I was able to call up Cisco and say, hey, it's this company that wants to do a RMA, a replacement of this firewall.
I know you don't have this available. They told me to call you and they said, we have one left. What? And you don't have it all put together. And so we are going to send it to you in pieces and your contract is one hour delivery. So tell us where to send it and we'll get it to you right in an hour. I'm like, how? Okay, fine. So I give them my address. They send me this firewall. It comes in seven different boxes. Wow. Power supply in one, the network adapter card in another. I think there's a fan in another box. I had to assemble this thing because it had some old client's config on it. It didn't even have a clean config. It was so raggedy and wrecked, but I... I got it together in the office and this client was actually down the road.
So I popped it in my car and I drove down to the medical facility. This time it's like 11 o'clock at night. Yeah, I was like, okay, this is what I'm doing tonight. So I drive down there. And put it in the network and I replaced it. It was one of those things that you don't learn anymore because it's so old technology that only me, because I had played with it when I was younger, knew. And I had like experimented with it just for fun, but it was already end of life before I even started the scene. You know what I mean? Like the operating system was not the normal operating system. It was different commands entirely. And I knew it because I was the only one on the team that had experience with it.
So I was like, look, nobody on my team knows how to do this. So just... So that's kind of a story that I'll never forget.
That's crazy. They totally lucked out on that one. They did. Wow. Otherwise, I just had about a Linksys firewall.
Actually, nothing would have been open. That's crazy. Yeah.
Wow. So what would you recommend to folks who kind of want to stand out in their team or want to take a more leadership role in their team in security?
Well, I think that there's a kind of a definition of junior and senior out there. And I think seniors are kind of more leaders on the team, at least from the eyes of the company. And I think in my opinion, the difference between junior and senior, because a lot of people, they get on a team and they're junior and they like, well, I'm just as good as the senior. Why am I not senior? And you have this animosity towards the senior because you feel like you know as much as them. And I think the biggest difference after seeing a lot of juniors and seniors in my time is the junior is often going to wait until they're given a task And they're going to do it and then they're going to wait till the next task.
But the senior is always taking on tasks when nobody asked them to take it on. And so they're going back to that config to double check that it's looking good, even though nobody told them to go look at that config. They're looking at the release notes of something that just came out, even though nobody told them to look at those release notes. They're eyeballing a new technology, even though nobody told them to eyeball that new technology. And they're bringing stuff into the office to work on or they're taking on new projects to work on, even though nobody did that. And in the eyes of the company, of the corporation, wherever you work, this is amazing because now you're more valuable. Now you have more responsibilities.
And I think that's how you can move into that senior role is to find projects and tasks to do and just take it upon yourself to do it. And I think that can go a long ways and can show a lot of drive and spirit. As long as you're still completing the tasks you need to be doing, but then taking on that extra stuff and then can really be beneficial.
Initiative, right?
Yeah, exactly.
Yeah, and I think that advice can go to everyone, whether you're in security or not. You know, you have the folks that do just a minimum, right? And then others that will go above and beyond.
Yeah.
That's awesome. Cool. Well, Jack, it was a pleasure having you on the show. I look forward to having you again sometime again in the future.
Yes, I would love to come back sometime. Thanks for having me.
Yeah, thank you. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.
