Episode 19 · · 55 min
Jared Folkins 18 YRO Manager To Education Security To Human Hero
Engineer at a school district in Bend, Oregon, and founder of OpSecEDU
Episode summary
Jared Folkins understands people, technology, and the world around him. He can smell a toxic environment from a mile away and has used that EIQ spider-sense for good. Jared shares with us some VERY personal stories (tear-jerker warning!) in integrity and life decisions as well a bunch of on-the-job war stories, including a famous one featured in the news! This is probably my most dramatic episode yet.
Notes:
At 18, he got promoted to manage a team of 50 because he wasn't lazy.
In hindsight, he was able to see indicators of the dot com crash but didn't realize that
Had a fork in the road where he had a major decision to make
Jared shares a VERY personal story with us and the life lesson from that which he applies in his professional life
Having a low tolerance for toxic relationships, Jared has been able to sense toxicity, and it's been a driving force for good for him
Quotes:
"I believe in the power of admitting when you're wrong."
"I carry my guilt between my shoulder blades."
"When I make that mistake; When you have a team that you can trust or a team that honors you, you have the freedom to say stuff like that."
"You can only control you."
"Constraints can be healthy."
"Stepping outside of your comfort zone... [can be] super healthy too."
"If someone tells me this person... is not a good person, I'll actually go meet that person. I want to assess it for myself."
"[When] you get rejected, don't get super emotional... just work with what you have and move on."
Before infosec: Manufacturing line manager, help desk technician and sysadmin
Chapters
- 0:00
Intro: a very personal episode
Ayman previews the stories, from integrity and a bomb-threat case to bouncing back from rejection.
- 1:33
Jared's day job and OpSecEDU
He describes his school district role, consulting, and how a vendor vulnerability led to the nonprofit.
- 6:09
A Kaypro, a Donkey Kong clone and beating his dad's score
A childhood game strategy shows the mindset of finding a different way to win.
- 10:04
Computer shops, Micron and the dot-com bust
He manages 50 people at 18, reads test scripts on the night shift and is laid off at 19.
- 14:17
A fork in the road after the layoff
Jared turns down an illegal business proposition and reflects on choices.
- 16:38
A broken promise to his brother and the power of admitting wrong
A deeply personal story explains why he owns up to mistakes at work.
- 22:01
Help desk, programming and a brutal interview
He used help desk downtime to code, took a risk to get the job, and later survived a panel grilling.
- 27:46
The rootkit nobody wanted to hear about
A company ignored a rootkit in a payments system, so Jared planned his exit.
- 29:29
The school bomb threat investigation
Jared traces a Tor-sent threat through logs, works with law enforcement, and a late-night insight cracks the case.
- 40:53
Advice: volunteering and leveling up
He recommends underfunded organizations, nonprofits and honest resume wording to gain experience.
- 45:01
OpSecEDU projects: TorHound and Dir-Fu
Jared describes tools that block Tor endpoints and shield staff email lists from phishing.
- 47:08
Red teaming and emotional intelligence
A stale-password win and a supportive reporting style lead into finding internal champions and avoiding shaming vendors.
Key takeaways
- Admit mistakes quickly and honestly; teams that honor each other make that safe.
- Volunteer with underfunded organizations or nonprofits to gain responsibility, trust and resume lines.
- Sometimes take the job that levels up the skills you care about, and keep your expenses low enough to have that flexibility.
- If a team is toxic or an employer ignores a serious issue, make a plan and move on without retaliating.
- When reporting vulnerabilities, look for an internal champion instead of shaming the vendor, and avoid anything illegal.
- After a rejection or bad interview, don't get emotional; remember that interviews are a two-way street.
Notable quotes
I believe in the power of admitting when you're wrong
I carry my guilt between my shoulder blades.
constraints can be healthy
Questions answered in this episode
- How did Jared Folkins get into information security?
- Jared worked as a sysadmin and engineer for about 15 years, and security grew from that. In 2017 he began reporting vulnerabilities in vendor software, which led him to co-found OpSecEDU.
- What is OpSecEDU?
- OpSecEDU is a nonprofit focused on information security and education, with a board employed in education. It has released open source tools such as Dir-Fu, which hides staff email directories behind a vetting step to reduce phishing.
- How can beginners get security experience without a security job?
- Jared recommends volunteering with underfunded organizations, nonprofits, libraries or shelters, where you can take on real responsibility, build trust and honestly describe securing a network on your resume.
Show notes and links
Show the original episode notes
Jared Folkins understands people, technology, and the world around him. He can smell a toxic environment from a mile away and has used that EIQ spider-sense for good. Jared shares with us some VERY personal stories (tear-jerker warning!) in integrity and life decisions as well a bunch of on-the-job war stories, including a famous one featured in the news! This is probably my most dramatic episode yet.
Notes:
-
At 18, he got promoted to manage a team of 50 because he wasn't lazy.
-
In hindsight, he was able to see indicators of the dot com crash but didn't realize that
-
Had a fork in the road where he had a major decision to make
-
Jared shares a VERY personal story with us and the life lesson from that which he applies in his professional life
-
Having a low tolerance for toxic relationships, Jared has been able to sense toxicity, and it's been a driving force for good for him
Quotes:
-
"I believe in the power of admitting when you're wrong."
-
"I carry my guilt between my shoulder blades."
-
"When I make that mistake; When you have a team that you can trust or a team that honors you, you have the freedom to say stuff like that."
-
"You can only control you."
-
"Constraints can be healthy."
-
"Stepping outside of your comfort zone... [can be] super healthy too."
-
"If someone tells me this person... is not a good person, I'll actually go meet that person. I want to assess it for myself."
-
"[When] you get rejected, don't get super emotional... just work with what you have and move on."
Links:
- Jared's Blog: https://www.acloudtree.com
- Jared's Twitter: https://twitter.com/jf0lkins
- Jared's GitHub: https://github.com/jaredfolkins
- Opsec Edu: https://www.opsecedu.com
- KayPro Computer: http://oldcomputers.net/kayproii.html
- Donkey Kong Clone: https://ostermiller.org/ladder/
- Grand Mal Seizure: https://www.mayoclinic.org/diseases-conditions/grand-mal-seizure/symptoms-causes/syc-20363458
- Project Dir Fu: https://www.dir-fu.com/
- TorHound: https://github.com/jaredfolkins/torhound
Getting Into Infosec:
- Twitter: https://twitter.com/coffeewithayman
- YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
- Book: https://www.amazon.com/Breaking-Step-Step-Starting-Information-ebook/dp/B07N15GTPC/
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
And this company, you know, responded. They think we know about this. There's a patch on the portal. And then, you know, kind of dismissed me. And that happens like often when I've reported vulnerabilities.
Hey everyone, I'm Eamon Elsua and this is Getting Into Infosec. This week, my guest is Jared Folkins. Jared is extremely passionate about education and security, so much so that he and others created a nonprofit called OpSecEDU. Jared shares some really personal stories with us.
And my dad just looks me dead in the face and says, hey, it's not your mom.
It's a bit of a tearjerker. We talk a lot about integrity as well as emotional intelligence and other dynamics important in the security field.
When I mess up at a system, when I make that mistake, when you have a team that you can trust or a team that honors you, you have the freedom to say stuff like that.
Jared has always been able to make the best out of a situation.
You get rejected, don't get super emotional. Don't say, you know, screw you guys, F you guys. Just work with what you have and move on.
He also shares with us an interesting war story that was also in the news that had an interesting plot twist.
The school district that I work for receives a threat of violence, a bomb threat.
There's so much to cover in this show, I really can't summarize it in the trailer good enough. So definitely check out this episode and let me know what you think. All right, on to the show. Hey, Jared, thanks for coming on the show.
Yeah, thanks for having me, man.
So yeah, so what do you do in infosec?
Yeah, so on a day-to-day basis, I'm an engineer for a school district up in Bend, Oregon. I do some consulting on the side, and I run a nonprofit that focuses on information security and education. Oh, busy guy. Busy, busy.
Okay, so help us dissect that a little bit. Tell us about the nonprofit, for example, and some of the consulting work you do, maybe.
Yeah, so I've done application reversing or penetration testing for different organizations. I kind of have a wide skill set that really kind of puts me in situations, I guess, to where I can leverage that to kind of maximize the value there. And so for the school district, I just help them manage their systems, primarily databases, Linux, Windows, write custom code, write web applications, websites for them. Are you the sole guy there? No, absolutely. It's a massive, it's as big as a city. So there's 18,000, well, it's bigger than that. 18,000 kids, a couple thousand staff, tens of thousands of devices. In the past, I've worked many jobs. One of them was an ISP that was quite large before an acquisition.
And yeah, so it is quite a large network with a vast infrastructure.
That's awesome. And this nonprofit that you're working with, tell us about that.
Yeah, so Ops.edu basically came about because there's an event that took place that I might get into later. But we started to kind of dive into security more. And I started to test some systems that we had large system systems that you generally commit to not for like a two or five years lifecycle, but like a 20 to 40 year lifecycle, right? And so I started to test these. And as I was discovering vulnerabilities, my first instance was I reported it to this massive I think it's a Fortune 100 company. And this company responded, hey, thanks, we know about this. There's a patch on the portal. And then kind of dismissed me. And that happens often when I've reported vulnerabilities. And so my style is like, I don't do the whole rant on social media or anything.
I just try to make the impact I can make. And so in this regard, I thought, okay, they knew about it. But what kind of ticked me off is when I looked at the patch, I actually looked at the metadata of the patch and the PDF, and I could see that it actually had been out there for like 14 months. And And they hadn't told anybody. Oh, wow. And so as I got involved in this community, a large community base that supports the software that makes customizations to the software, everybody was thanking me at first, but like they didn't know about this. Right. And so one of the people I met out of that was an original board member whose our board has to be employed by education. So, you know, the control of that nonprofit stays in education.
Right. And so that's a requirement of our policies and our bylaws. So John's moved on. But at the time, John was also this vendor's massive. So they have multiple products, but he was part of this group and he has a CISP and he's a researcher as well. And he thought he was alone. And so he got in contact with me and he was like, I can't believe somebody else is doing this. No. And so anyway, John Gates, I met him and I was kind of frustrated. And so was he. And so it was really instrumental. And this is before the nonprofit. This is in 2017. And I was thinking, I bet you there's more vulnerabilities in this thing.
And what were you doing at this time?
I was still an engineer for the district. This is the product that the school district uses. And so I've had roughly a 15 year career in computer systems. And now this kind of sidestepping into information security. And I think it's always been part of what I've done. But I've just kind of taken it for granted, right? Like I know how to maintain firewalls. I know how to look for open ports. I know how to lock down Linux systems and try to leverage different tool sets to keep them safe. And I just thought, well, this is what you do. And for a lot of sysadmins, that's like, that is what you do. But then what you're also doing is you're teaching yourself all the ways that you can hack. And you're having, at least for me, a really strange learning opportunity that I didn't realize, like I was almost hacking myself.
And so this kind of comes to fruition here because if you go read my blog, you'll see that I was poking around and hacking and trying to work through different security programs and report vulnerabilities and stuff. And it was an interest, but I just thought, eh, it's just an interest. Like this is not... Nothing I would ever start to really do.
You were just a responsible system admin, right? Sure. You have systems that just make sure that they'll do the minimum, but then you have those extra to make sure security is ingrained, right? Correct.
And like I said, if you read my blog, you'll see that I was into reverse engineering stuff. You'll kind of see that I was into systems that I'm not exposed to really. They had a security program on HackerOne and I thought... I probably could find something here or I'd run across something that would have a smell. And I kind of call it the spidey sense. And you kind of just flow into that. And so I think that was naturally happening. Just my story is a little different there. But kind of getting back to OPSEC, you use Genesis.
Well, I'd like to interrupt you for a second. Sure. So when did you get that itch to, you know, explore that makes you go the extra length in securing systems, right? What was that trait that you have?
Yeah. So I would say like back when I was nine, my first computer was a Kaypro. I don't know if you've looked this up at all before. It's an old system. And it was my dad's like college laptop. But like this is a 60 pound machine with like a five and a quarter inch floppy and a green screen that's built into it. And like you put the keyboard on the front. But that was like my very first computer.
Nice. 64K RAM. Yeah.
No it's less than that i'd have to go look but yeah that was my very first interaction okay and one of the things i did with my dad is that there's this game called ladder and basically it's a donkey kong clone but it's really awesome because the ascii art like the art in it's like a ladder is just a bunch of h's stacked on top of each other or like the platforms you're walking on are equal symbols right because you don't have graphics and like the character who's your lad he is like a P going one way to the right, a Q going left, a D when he falls, one direction, or a B. So it's this really kind of cool Donkey Kong clone. And I remember my dad had this massive high score on this game. And he's a wonderful man.
But one of the only times I ever saw him brag, and he's like, you'll never beat this score, right? And it was like the digital equivalent of Mount Everest. It was just astronomical. Yeah. And I remember thinking, oh, I bet I could beat this. Game on. And yeah, you know, we were a really constrained family. Like we were really poor growing up. And it wasn't out of poor choices. It's just my folks were into, they were school teachers originally. They're into humanities. So kind of my passion for some of those things originates with them. But we didn't have a lot of cash. And so my dad was like, yeah, I'll bet you like 60 bucks. Like, and this is in the 80s. So I would say like, that's, you know, five, 600 bucks to like an eight or nine year old nowadays or something.
And so I remember I went to bed and I woke up and I had the solution. And the solution to beating my dad's high score was generally in Donkey Kong, right? You progress through a level and you move on to the next one and you progress through that one. And you move on to the next one and you try to rack up free guys, right? Free lives and get the high score. And I realized that on this section of this game that as I was playing it, I went up and then I stayed on this level and I jumped back down and I jumped back up and I would die. And at the time, my dad thought I was giving up. But what he didn't realize is I knew that in the summary of my total points, that if I just stayed on this really simple level at this critical point and gathered points by jumping over these barrels, I would end up beating his score because the later levels were too fast for the dexterity of like an eight-year-old.
Like I couldn't keep up with it. And that's why I think my dad made the bet.
I see.
And so at that point, I realized I kind of looked at things a little differently, I believed. And there's other instances like being poor, like we had hand-me-down Legos from people. And I didn't have instructions. Like I had a bin full of Legos, but I didn't know they ever came in with instructions until I was like 12. And so I used to build like airplanes and castles and just these monstrous things, but I didn't have instructions. It was all from my imaginations.
Right. That's wonderful. That's amazing. And so back to that ladder story. So you basically, it's kind of like tortoise and the hare where you just stood there and accumulated points without necessarily going to the next level. Is that right?
It's kind of like that. There's a guy who made a clone in Java and we can link to it hopefully maybe. Sure. And people can check it out. It's the level after Easy Street. I know the level before it's called Easy Street, but the level after, I think it's maybe Ghost Town or something. But anyway, you did have to still jump and move around. But if you did it in the right way, you could go up and down the chain and you could basically make the game fire a lot of barrels, essentially. Oh, I see. And as they fired, you could force it and then jump over these barrels and get more points. And then I would just die, start the game over with a large clock on this easier level and do that. You know, this was a different take on it, I guess.
Yeah. Yeah. Okay. And so fast forwarding, did you know you wanted to get into technology or IT at that point? And then from there, how did you get into security?
Yeah. So like there was this computer shop called ABI Computers and maybe everybody had one of these back when they were growing up in like the 80s and the 90s. And I remember they would always talk to me and they would fix computers. And if I ever rode my bike down there, they'd let me mess around with replacing motherboards, replacing RAM, replacing 20, what was it? Yeah. Big bricks. Yeah. This is back in like the 286 to 486 days. Oh, okay, okay. That, I think, at the age of 11 or so, really, I can remember going to bed a couple times thinking, man, I really enjoy computers.
Get to just sit somewhere and fix them. That was just this loftiest goal. But out of high school, for me, that was during the dot-com boom. And I went to work for Micron. So Micron makes RAM. But in the dot-com boom era, they made servers, they made switches, like the purple extreme switches.
I don't know if you remember that. Yeah, I remember those.
Yeah, those ran on my line, right? So I was a young kid. I was 18 and they promoted me heavily to where I was like 18 managing a group of 50 people. And I remember really enjoying it and at the time making a lot of money, but I never really understood why. Why? And it turns out after the dot-com crash and getting laid off from that job, I met one of the engineers and he was like, dude, it was because at night we could leave you alone and you could go through the entire line and read the scripts, the debug scripts that were complex. And I could tell like, oh, just wiggle this Gbic here and this is going to pass QA. And so I think, again, it was a signal that the code was in my life. I just didn't know it was going to be that valuable yet.
Wow, that's interesting. So hold on, you were reading these scripts.
Tell me more about that. Sure. So like, if you're going to build anything on an assembly line, this was assembly manufacturing, you'd have maybe eight to 10 stations. And the first station might set up the chassis, right? The next station might do like the first logic or motherboard and the next station might do like a network board of some sort. Okay. And every step you'd have to like use tools with air compressors sometimes, or maybe it would be a testing station and you would plug it into a certain IO port and it would run a test. But a lot of times what the engineer was used to having happen is that people were pretty elated. Scripts or they wouldn't read the scripts i don't actually don't know if anybody actually could read some of those scripts it was the wild west during the dot-com days i mean people got stories this is mine yeah and so i don't really know most of these folks were just instructed to pull to the side because it was a night shift job because the line was going 24 7 and they would pull it to the side but with me on that shift leading those people i would just step up read the scripts realize oh you forgot to ground like this board or something oh i
And we would move it along, right? Without me on this line, there would probably be about 30 systems waiting. And I didn't realize that was my value. I was so young. I just thought, I guess I'm doing something right. You know, I didn't know to ask until that encounter where he was like, no, you could read these scripts. And so he was telling me I could go instead of managing or fixing 30 systems and troubleshooting them in the morning. I could go have coffee basically for an hour right so you know that was the value that I learned later I was offering and again it kind of triggered like you know later on in life like oh man this programming stuff or being able to read this code is probably something to invest in so that's pretty cool yeah you're still a teenager at that point right or pretty young 18 I think when I got laid off I was 19 at that point okay so you got laid off as part of the dot-com bust
Yep. That was my first encounter. Like if students are listening to this and the kids that I mentor, I know they'll be listening, but like they've heard me talk about global economies and asset bubbles. And it's something I've investigated since. And I think the signals were there to like discover that. But at the time I was so young, I didn't know. And so for me, you know, like I said, 300 systems, 300 switches or servers a night, we were kind of shoving off this thing. And I came in and I saw the board, the build board, and it said three. And I was like, Hey, there's some digits missing from this thing. No, it was literally three systems. That was the total for the night. And if I had done my research, I would have seen that six months prior, the stock market had tanked.
And it kind of took the ripple effect that long to get to me.
Right. Cool, man. Moving on. So what did you do after you got laid off? What was life like?
Yeah, so life was pretty depressing. I learned really quickly that having my self-worth tied solely to my job wasn't healthy. And so I was kind of bouncing around. And one story that I share with students was people have always trusted me and I've always worked hard to keep their trust. And so I got invited over to some old co-worker's house and we were playing the PS2 had just come out and I forget the video game, but we were playing that. And they said, hey, Jared, you're good with numbers, you're good with math. We got a business proposition for you. You. And I said, oh, you know, I need a job. This will be great. And they took me to a spare room and they opened up like this four by eight or eight by four closet or whatever.
And stacked from floor to ceiling was just pounds of marijuana. Wow. Like it was floor to ceiling. Wow. And you know why I tell that story to kids a lot too is you're going to be faced with choices in life. Right. And I remember they handed me a book, their ledger, and I looked at it and I realized really quickly, like I could trim so much, like I could help them so much if it was just a legal business. And within a couple minutes, I snapped out of it. And I had that thought that my mom and dad had instilled in me, which was, you know, what do you want? What do you want to be? Like, who do you want to become? And I just said, hey, guys, thanks. This isn't for me. And I left and I never went back.
And so at that point, you know,
Talk about a fork in the road, right?
Yeah, totally. Absolute fork. And I think kids, I think students, I think people are faced with those choices every day and we don't confront them and we don't celebrate them enough. And so, I don't know, I get that out there and I like to hear, I like to celebrate kids, especially at the school district when they make a choice. Choice that they're proud of, they know they trust me and they will share. But it's based on that kind of mutual sharing. And so for me, after that, it was kind of a wandering moment, right? This is right before I got hired into a help desk. You know, my work, even in the security work that I'm finding myself in is that I believe in the power of admitting when you're wrong right like if I work on admitting and honoring the people in my life and saying I'm wrong when I mess up like when I get to work and I blow away a file system because I was being stupid right and I wasn't following a procedure or I didn't write the appropriate script and test it when I did that early in my career it was always better for me with the community I was working with to just say yep I messed up these are the exact commands I'm so sorry how can I help fix this well how did you learn that what reinforced that behavior
So for me, it was around the time right before this first help desk job, I got married really young. I found my partner when I was 17. I got super lucky. Good for you. And yeah, it's been great. And I still love her. So that's great. Yeah. Awesome. Anyway, so at the time we had a vehicle and it was like, it was about to die and we were broke. She was finishing up her master's program and it was just that crunch time where you're broke, broke, broke. So we had about 12 months left. And my younger brother drove over and towards the end of his visit, he said, hey, man, you know what? I'm going to buy a new Honda. Just take my Mitsubishi pickup here. And I'm like, man, I can't afford this. And he's like, tell you what, can you pay me anything?
And I said, well, you know, I could cut you a check for like 10 bucks a month.
Do more than that he's like perfect pay me 10 bucks a month and we'll figure out the rest later this is your little brother right absolutely so like if you're the oldest right you're used to trying to protect your sibling but i can tell you that you know to my shame that month the end of the month would roll around i'd be doing the budget i'd go to cut a check for You know what? Jay's not going to miss this money. He's single. He's making good cash. He ain't going to miss it. And so I just kind of skipped a payment, right? No big deal. But one payment turns into three, right? And three can turn into six. And before you know it, six turns into 12. And I don't know if people like me, but for me, I carry my guilt between my shoulder blades.
I tense up there. I feel bad. And I remember my brother called me up and he said, hey, bro, Jamie, that's my wife. She's graduating. I want to come over. We're going to party. It's going to be a great time. And he hung up. And I was stoked to see him. But that weight I was carrying because I was embarrassed because I was not honoring that commitment sucked. And so we had this great weekend, wonderful weekend. And my brother went to leave at the end of that weekend. And I was just really convicted. I called out to him as he was exiting. Name my house and i said hey jay and i'm like i just gotta let you know i'm so sorry i'm in the wrong and i owe you for this pickup right and he just kind of gave me a hug and said i knew you were going to tell me that i absolutely knew you're going to tell me that and so he took off and a month later i get this knock on my door at 7 a.m and my family lives about five hours away and i look
Through the people there and i see my dad in this morning light and i am just stoked i'm like oh my family knows i got the get me by job as i call them right and i thought you know my dad's coming to surprise me my mom my brother come to surprise me and i open up the door and my dad just looks me dead in the face and says hey it's not your mom it's your brother and he told me that my brother had been in a terrible accident and i had drowned oh my god with all of our best friends around trying to do cpr my brother and i are really straight people as far His drugs you know we didn't do drugs we were raised to be responsible and to help other people and so the piece to my brother is i was the first one when he was 15 to find him having a grandma like epileptic seizure and that's a hereditary thing in my family and so that was a number of years before his death but he basically you know i can still remember like the emts are saying
Hey, man, just what drugs did you do? And my brother, like full seriousness, just wiped out because he'd just gone through this brutal seizure and I'd watched him have it. And I thought he was dying at that time. And he pulls the mask off his face and says, drugs off of losers, like right to the firefighter. And that was his humor. He was totally joking. It was a wonderful sense of humor. It was so endearing. But yeah, his death absolutely related to his epilepsy. He'd had a seizure and he had drowned. And that's very common for epileptics is water is a huge risk in your threat model, as you would say now, in infosec.
Wow. My condolences. Yeah, thanks. I mean, does the water cause it in any way induce or it just happened to be?
No, you're just absolutely vulnerable. Yeah. It's like you're kryptonite. Right. You have a seizure and people are too far away from you. They can't get to you and you're just gone.
Right. Sorry to hear that. Yeah. So lessons learned from that?
Like I said, it reminds me daily, like I'm so thankful I don't carry the guilt. And it might seem small to the listeners of like saying, oh, I'm sorry about not paying you for your pickup. But like, I would have carried that. Like I'd be this today still being like, I suck. I think I really do. So that's helped me personally, but it's helped me at work. When I mess up at a system, when I make that mistake, when you have a team that you can trust or a team that honors you, you have the freedom to say stuff like that. And it's such an amplifier. Like everybody's goal focused. Everybody realizes mistakes. Happen. And so with a team that knows this or the team that works hard and honors each other, it's a really powerful amplifier, in my opinion.
Yeah, I think that's really important. You have a lot of toxic teams out there. Even within teams, you have people fighting for vying for attention from their boss and whatever, trying to one up each other. And in security, it's even worse of a situation because you're technically on the same side. So you're not focused on the end goal is making everybody secure or securing the environment instead of trying to one-up each other and make power plays. So hopefully more of us can get those lessons out and just kind of focus on the big picture.
Yeah, I think I agree with you so much in that statement. And I would just... The students and the kids listening to this or whatever age you are, you're trying to get information security that you're going to run into that. That is going to happen and be prepared. You know, you can only control you as another thing that's been spoken to me in my life. And so if the team is so toxic that I cannot exist in it, I just go find a new team. And that's something that I think is a really important lesson for people to learn early is that you can control you and you got to know when to get out.
Yeah, yeah. So Jared, tell us about your first job.
So I would say my first job to get into information security was I worked at a help desk. And from what I gather, this is pretty common for people early in their careers or at any point is there working at a help desk, taking those tickets in, working with your customers, whoever they are, face-to-face, over the phone, remotely. And for me, one of the things I leveraged in that job was... I would bust through my tickets really fast. I would bust through helping out people really fast. And I was super competent. So I had these blocks of time in between helping people. And so I started to focus really on programming. I just thought, you know, I really enjoyed this. I enjoyed my time in other jobs like the Micron job.
And I think there's something here. And so I would just spend any free moment at programming. In that job for a number of years. But the reason I could do that is I was adding all this value for my boss. Like I would just bust hump when I needed to and spend some downtime programming.
Nice. Boredom leads to creativity, right?
And here's the thing too, like the network engineer, I would have loved to get more into networking and I know a lot more about it than Now in my career, but at the time I would have loved to, but for folks to think about is that also constraints can be healthy. Like that network engineer, you know, pretty gnarly, not super cool, like pretty possessive and egotistical. And so I wasn't allowed to touch the networking stuff. Yeah. And so there was a lot of things I couldn't touch like, oh, that's not your job. And so because of that, I was like, well, I've got a system that's given to me and I can control the system and I can just start messing with programming languages of any sort. And I just dove into that as far as the programming languages I've worked with over my career now are pretty quite a bit.
Yeah. Work with what you have, right? Yeah. You know, sometimes you don't realize what you have until you really dig in and take a look. Yeah. Cool. And so how hard was it to get that job? Did you have trouble interviewing? Did you go to school before that? You know, like, how was the interview process?
That job was super cool. I built something in Flash for ActionScript with some code to something kind of cool. And it was totally unrelated to the job. But I took a risk. I took what was that probably like a Mac? G3 in there at the time to that job. And I said, hey, I can build computers. I can fix them. I've done this. And I can also do these other things. That was right after my brother's death. And I was thinking, there's no way I got that job. And I totally nailed it. So I think stepping outside of your comfort zone, super healthy too. And being okay with no. I had also gotten told no before. And that's okay too at that time. But taking that risk was super good.
Was there an interview that didn't go well that you expected?
Oh, absolutely. I've been shredded later in my career with interviews.
Walk us through that.
Yeah. Having an interview go really well, not understanding the landscape, having then a consultant come in and being fairly young and not realizing that if you got hired, you would take this consultant's job. And so the consultant sets out for the next hour to find any flaw that you have in your knowledge set and Shred you just in front of a panel. By the end of it, I was escorted by the lowest member and just dismissed because every opportunity they could find, if I failed at a regular expression, if I failed in stanching a variable correctly or allocating memory, it was just a brutal situation. Aside, I won't go into it. The nicest kid, that kid that walked me out, later got cancer and passed away.
Oh. Oh my God. It's irony. He's like, if anybody should have died, it should have been these a-holes. And like, I really appreciate it. Like this kid's walking me out and he's like, man, I think you're super smart, but the situation's kind of rough. And I just appreciated him so much. And yeah, he got lymphoma and yeah, it passed away.
How did you know? Did you stay in touch with him?
Yeah, I did totally stay in touch with him.
Oh, okay.
Yeah, we would email once in a while. He really enjoyed Ruby. I'd worked with Ruby. I like the language and I'm not a snob. If it's working for you, great. Ruby's not for me. I like to do a lot of things in parallel and I like things to be fairly optimized. I'd written a scraper to kind of hack the housing industry a while back. Yeah. And I did it in Ruby and it wasn't performing and it was always crashing. And to dive into that script, the tooling at the time, this is 1.9.3. I didn't have a lot of introspection into what those processes were doing. I had to just wait for a dump stack that would puke out this weird... I forget what tool it was, but this XML file that I would ingest. And I realized that by default, if you didn't run a certain method, it would never close that
That object, like that object would never get garbage collected. And it took me forever to figure it out. So I don't exactly realize where I was going with the story. But sorry, just a nerd out moment.
Well, so let me ask you. So after that interview, psychologically, how did you bounce back? Because a lot of people out there have had or will go through bad interviews, right? So how did you bounce back?
Yeah. So bouncing back, you know, I'm married. I was married. I remember walking in the door and my wife's like, you got hit by a, like she said it, you got hit by a bus. And she knew I'm like, I've never been through something like that before. And so her encouragement instrumental, she says, you know, interviews are absolutely two way streets. There's probably a reason. And later on, I get more of that story about the consultant. I hear through the grapevine. And kind of luckily for me is the networks you operate in tend to actually be super small, the people networks, the human networks. And so I now work with people who used to work for that organization. And they have told me, like, dude, you survived a dumpster fire.
Like, you dodged a bullet. Wow. But I've kind of learned to listen to that too. You get rejected, don't get super emotional. Don't say, screw you guys, F you guys. Just work with what you have and move on. And if your gut's telling you this isn't a good fit, politely just say, hey, I appreciate the offer. This isn't a good fit. Move on.
Cool. Yeah. So Jared, any interesting war stories through your travels of infosec? I mean, at schools, you've probably seen some interesting stuff or private sector.
Yeah. I mean, private sector, some of the things I can probably talk about at this point is some of the problems that you might run into when you're trying to look for a good employer to work for. I remember I ran across a system and this company was incredibly large and this system processed payments. And I ran across a rootkit absolutely in this system. And I could tell, I could tell exactly what was going on when I saw it. And it took me a while to convince another sysadmin. And finally, I did. And I thought, ah, I got an advocate, right? And we took this to somebody in charge. And we were under a deadline. I was writing some code to distribute new firmware to a bunch of endpoints is probably the easiest way to put that.
And there was no formal API. So I had to reverse engineer how it was all put together because these endpoints, yeah, they were just pulled straight from China. Mm-hmm. So anyway, that was a task at hand. And when I said, hey, you know, I was doing some general maintenance and saw this alert. I went into the system. There's a rootkit. They said, we'll just delete it and get back to work. And I said, like, you know, we got to rebuild this thing like this. We're processing payments. And they said, well, we're not even sure it's a rootkit. So absolutely don't look at it anymore and get back to work. And that war story I tell to students because I'm like, you're going to run into that and take that as a signal.
It's not like, in my opinion, don't retaliate. Don't get angry. I went home and this is how Jamie and I operate. When I know that it's time to move on from a job, I say, hey, this happened today. This isn't sustainable. And we usually put a plan in place for 12 months that I'll be moving on from a different place with Whatever happens. And so in that instance, yeah, we put a plan into place and moved on.
Okay. There's a really famous war story that you have. Can you talk us through that?
Yeah. So in 2017, the school district that I work for received a threat of violence, a bomb threat. What's not talked about in that threat is that there was also a threat of self-harm. And so So when you work for your community, and I have a really small, tight-knit community, relatively to the Bay Area, roughly 90,000 people comparatively, there's a very familial stance about that stuff. And so you obviously have to do the right thing. I would hope anybody listening to this feels that it's obvious. And so it became an investigation that I was assigned to. And so I dug into some logs.
You were assigned by the district, right?
Yep, to act as the technical lead on this.
Okay.
And so the way it went down, right, is I'm coming into work and I get this call from my boss saying, hey, there's this threat and I need you to go out to the school. And I said, okay, I'll meet you out there. He's like, dude, I'm not going out there. This one's on you. And he was just joking around with me, but he was like, you know, I trust you. Go out and do this. And so digging through the logs of this event, right, the first thing you're trying to understand, what was the input generated? Can I easily track this down? It became pretty apparent that this threat had been sent over Tor. Somebody had really gone through A bit of thought to kind of conduct it.
And let me ask you, was law enforcement involved at this point? Absolutely. Okay, they were.
Yeah. The city, the feds. Oh, okay. It's weird enough. Like you see things in it and it just truly sends.
Chill.
Yeah, just there's a feeling about it that means it's next level.
Mm-hmm.
And so we're looking through this and I'm looking through the logs of kind of the systems that this message was received through. And like I said, they had utilized Tor. Yeah. And that generally doesn't allow you much way to kind of operate. No. But I had the idea like we store a ton of logs for this system. And so I had a large data set. Right. And, you know, ML and AI has been this like popular thing for a while. But like those algorithms are pretty old. As far as the basis of them, fundamentally. And so I just had the idea, well, I got these IP addresses, can I kind of correlate patterns of use? And so the system that this person went through was web-based, right? And so you could see, like people don't think about it, but based on how you operate.
You can really quickly build up a profile of who you are. So you come to the site from Google, you go down this tree of paths, and the resources that you're looking for seem to be parent-focused, right? And so you can start to group you together. An algorithm can start to say, okay, this is a parent or guardian. Whereas if you take a different approach, you might just be a bot or you might just be a student. And so it was pretty apparent based on the patterns of use around this event that there was something interesting. And so a result kind of came out of that system that immediately led us to a student. And this is where I feel it was a huge learning opportunity, but I kind of got in over my head.
And I think my advice for folks is sometimes you're going to be over your head and it's okay to recognize that. Take that breath in. Think of your successes and move forward is what I just kept kind of saying to myself. And they were like, hey, man, we need you to be the technical lead out in the field. And so now I'm pulling the data that's kind of pointing towards the student potentially. And I'm called to kind of assess this too.
And was law enforcement like... Standing over your shoulder? Totally. Oh, really? Yeah.
They had taken over a cube behind me.
And so you're using agent strings, you're looking at IP addresses, all that stuff, all the metadata. Absolutely. Right. Yep. Now you've got this information in your head and... Yep.
I guess we've got this information. We work with the correct organizations to get the proper legal avenues to understand it's potentially the student that is in our district. And I'm now called Out to go interview this student. And as the student is sat down and as their parental unit is there, listening to this young person, it becomes pretty obvious that they're lying, like really lying about something. And it just makes everybody suspicious. It's really brutal. And my technique I use a lot of times, if somebody tells me that this person down the street is my neighbor, is like not a good person, I'll actually just go meet that person. I want to assess it for myself. I want an And so I went into this with just, I didn't want to know anything about this student.
I wanted to assess. I wanted to truly give an opportunity. And pretty quickly, the student's crying. And finally, the student's parent speaks up. And as somebody who cares for kids, as a parent, I thought, okay, cool. This is this person's advocate. This is where they get involved. This is appropriate. Regardless of what happens, this needs to happen. And this parent says, hey, you know, Jared, when did this threat get sent? And I said, well, it was about this time. And this parent says, I wasn't even home yet. I wasn't even at my house. And by the way, I don't even know how to work the type of device that you're talking about. And I realized that this kid didn't have an advocate. This kid was getting chucked under the bus by the person that was supposed to protect him.
And that radically shaped my perspective.
Hold on. Tell me about, so the father-
Parent yeah the parent is saying they weren't home yep because this threat came off network oh i see okay yep so we had put together the metadata that substantiated essentially this ip was in enough of the right spots you know to ask these questions to get the right subpoenas because it was just the perfect a lot of things aligned and i won't go into all of them right just ask for a little Trust that a lot of things aligned. And so, but I thought, again, this kid's got this advocate and it's speaking up. This is the moment, right? Regardless of this kid's socioeconomic background, this is the advocate. And this parent just chucked him. And I realized this relationship is toxic. I don't know what happened in their lives to make it this way, but they hate each other.
These two people hated each other, this parent and this child. And I left, right? I left, I get home late. It's about 9 PM. My kids are already in bed, but they had stayed awake. And I went up to tuck them in and kids are super smart. Like if you treat them like just little people, they are so smart. And my six-year-old said, dad, why are you so sad? And I was trying to be honest with them, but I wanted to anonymize it, right? I didn't want them to have to carry everything I was carrying. And I said, hey, dad had to work with this little boy today. Dad thinks this little boy is lying. And dad thinks this little boy might jeopardize his future. And dad's scared for him. And my son, who's just a wonderful human being.
He looks at me and says, hey, let this little boy know. I'll be his friend. And I'm sure, and this is the brutal part, I'm sure his dad's just like you and his dad's going to protect him. Oh, man. And like I was, again, I've used the word in this conversation, but I was convicted. And I went downstairs to talk to my wife and I said, hey, I got to treat this kid as if it was my own. How hard would I work if this was my kid? And so I went back and I said, I'm going to work this weekend. I'm going to look at all my data sets again. I'm going to process everything again, affirm to myself that my conclusion is correct. And I remember working all Saturday and well into the night and I went to bed and I woke up.
And again, critical to that kind of capro story I told that ladder story, I woke up with the solution. I woke up at two.
Power of the subconscious, man.
I think so, yeah. I woke up and I said, wait, I'm asking the questions of the ones I'm thinking of, the relationships in this network that make sense to me. What's so abnormal that shouldn't even exist, right? And so I went and did some more analysis, and out of that analysis popped this one IP address. Okay. You know, it was open network, didn't appear to be a torn out or anything. And I was like, this is so weird. And as I dug into it, I realized that in this vast, large data set, the exact endpoint page in question, this IP address in a close enough timeframe, not so close to be apparent, but at a close enough, I would say was there. And it had hit that one page once and only once across this massive data set.
Right. And I thought, man, that is really strange. And so I remember crafting an email in the middle of the night there. Sorry, crafting two. One of them was to a special agent. And I said, I just hope you can trust me. This seems meaningful. This signal seems meaningful. And I'd really appreciate it if somebody would look into this. As far as my investigation goes, this is the last thing I can give you. I've really exhausted all the resources that I have available to me. And then I emailed my leadership. And I worked with some really wonderful people. Who do love kids and I said hey I think it's important to remember that although this student is absolutely lying and there are so many red flags that this student doesn't have an advocate and regardless of if we think we're called to it or not I believe that we have to
Step in and take that into account right and so I remember Monday came and you know like nothing happened and I was just feeling so bad for this kid because I thought that maybe it was he was in the wrong spot at the wrong time and I was scared for him I had really Taking on that ideology of that this was my kid and then I get this text message on Tuesday saying be in the superintendent's office at like 6 a.m. or something sharp and I'm like oh geez this is going to be important and I get in there and I Basically, this whole task force is on the phone. And what had happened was the endpoint that I had given them, this one last tiny minuscule piece of data, they weren't going to operate on. But they took a chance and they sent a field agent out.
And out from this house, as this field agent arrived to this house at 7 p.m.,
14-year-old child and they were headed to this child's birthday party. And the agent said, can I talk to you really quick? And almost immediately, this kid just breaks down and says, you know, it is confessing and says that a girlfriend, so this kid is 300 miles away. He's not, as far as my morals go, he's not my direct responsibility. And so he's saying, I got angry at an ex-girlfriend. And so to get back at this person, I had Googled, found a way to send this message and tried to just terrorize this community based on this massive threat.
Wow. Wow. That's incredible. What an incredible story. And a couple of questions. I mean, so many questions, but like, what was his motivation to lie that the kid?
There is a logical answer that once you get more operational detail of that starts to click, but I can't talk about.
Okay. Well, Judd, that's an amazing story. And I'll put a link to the new story in the show notes. So let's take a beat, as you say. What's the doing the right thing can be a profitable thing? What's that briefly?
So I think that there are companies out there that are taking security seriously, like Trader Joe's. They're truly taking it seriously and they're aligning their product and they're saying, you know, security is part of the product, right? We have these policies where if you're a customer, you can email us. And this is super rare. I won't name the company, but this is super rare in education, especially. You can email. Us and we'll send you our annual audit, third-party audit of the software where somebody's actually kind of torn into it. And they'll give you a landscape of our infrastructure and our stack so that you can see someone's doing not only just due diligence or liability, but like actually trying to secure stuff.
And so I look at this company and I don't know too much about them, but I see those signals. Where they're kind of taking that on saying, let's be progressive about this. And I think that going forward, that will be the truth. When somebody will continue to be a greater truth. When somebody says, you know what, people care a lot about security and privacy. And if we hinge a core tenant of our product on that, we can differentiate in markets.
Yeah, I mean, there's tons to be said about being transparent. It's just a really good way to build trust. You know, as opposed to taking the opposite approach and just hiding everything and saying, oh, just trust us. We take care of security, right? Well, you know, let's prove it, you know. Right. Give us something to help build that trust on, right? Right. Tell me, what is some advice that you have for folks, students, young and old, I mean, high school? What is some advice that you have for folks out there for getting into security?
My advice for folks getting into it is one of the things I think that's helped is working with underfunded organizations. Obviously, I run that nonprofit, so it sounds like it's easy to say, but when you volunteer or you work with somebody underfunded, a lot of times you'll get agency because there's just no resources, so you are the resource. Because of that, you can level up, I believe, really quick with somebody who will trust you. So not every day do you have to take the most profitable job, right? If you go interview for two or three jobs, 10 jobs, and you get two offers, consider at times taking the job that you think will actually level up the skillset that you're truly passionate about, even if that takes a hit financially.
What I've done in my life is try to not make as big of expenditures, not live as grandiose as I could potentially. And that's allowed for that flexibility. So.
And do you have any practical like organizations they could like look at or you know how in practicality would they find an organization that you know would be willing to take a risk on them because experience is the issue right you're talking about the lack of experience right of trying to get in that catch-22 issue uh-huh so you're talking about going to other organizations that might let them in what are some examples right so volunteering is what i've seen on multiple occasions not only in infos
You will network with people of your own accord. And because you're giving your time, they either got to decide to work with you or not. And they got to see if you have skills and they got to see if they can trust you. And myself included, I've been given a remarkable level of trust on something that probably on paper originally, I couldn't articulate that I could do. Could I lead a consortium? I'd never done that before. Could I make a 501c3? Never did that before. Reverse engineered that entire process for all the tax process. And because of that, people rally behind you when you start to earn trust. And then I've been put in situations where I've been given access legally to systems that I would have never had access to, to help out with.
And so then you can take those experiences practically and move those into your search for a job. I've listened to some of your other episodes and I can't recall who Said it, but somebody was talking about, and I know I read some of your book, you talked about building a home lab and different things. I think one of those critical things is the self-motivation drives those types of conversations, the volunteering, the building the home lab. And so the more you can just say, I don't know how to do this yet, but I'm going to Figure it out, you can reach out, you know, to OpSecEDU, especially if you're a student, and we will be happy to email you and point you in a direction. I've built different little labs for students because I knew that they were bored, you know, and that's stuff that I do, you know, through OpSecEDU on the side, because I've been that kid who's trying to just, you know, explore and stuff.
But again, I think that helps you level up.
Yeah. What kind of organizations would they volunteer at? Any examples that they could find in their own community?
Yeah. So if you just search nonprofit in your community and somebody is looking for, you know, on Craigslist or something that's security minded or security specific. And what I mean by that is it could be even privacy. It could be there's a lot of hot topics out there right now. And, you know, privacy might mean you're just writing documentation. And your goal might be to be like a red teamer, which I have done, too. But you're just stair stepping your way through that. You're making that relationship. And I'm not saying I'm not saying work for free forever. I'm not saying you are devalued. I understand the sentiment. But sometimes you can find an organization. And I hesitate to say it, but there's a ton of places.
There's homeless shelters that run networks, right? Libraries. Yeah. When you can put on your resume, I managed and secured this network. When you just twist your resume a little bit to say secured or hardened, and it's a true statement, don't make it falsely, like make it truthful. That stuff really, I think, can just level you up.
Yeah, well said. That's good. So I think we've got a couple of projects that have come out recently from OPSEC EDU. Can you talk about those for a little bit?
Yeah. So one of them that came out that we did was something to help school districts kind of protect certain endpoints from Tor. And that's just an open source project that I put out in GitHub. But the other big project that we did is called Durfu. It's a directory kind of obfuscation tool. And the way that we kind of just pitched that tool to our members is that smartphones, Android, different things have that call screening feature. And what we've seen historically with these underfunded and mainly like you have constituents, you're either working for the state, the city, local government or federal is people need to get a hold of you. So traditionally, folks have just dumped entire email lists.
Well, when I've done red teaming, you know, I'd write that three line bash script and I'd have a ton of attack vectors with just no work for me. Right. And we've seen that escalate to where these types of phishing schemes that are coming out are stealing lots of money. Yeah. Hundreds and hundreds and hundreds of thousands of dollars. And so one of the techniques that we try to do with this Derfu is that instead of call screening, it's just email screening. You can upload a CSV, you can use the API to do that, or use the web interface, and it will build a directory for you and you can use the JavaScript widget to embed it into your site And then when people want to contact your staff, they can, but they just click and there's just kind of this vetting process where a message goes to your staff saying, do you know this person?
Think through this email address. Is this somebody you want to communicate with? Instead of like right now, a lot of state governments and school districts, they're saying, hey, don't get fished. Fishing's bad. But then they'll just wholesale dump out these massive spreadsheets with all the attack vectors of your staff. So we just launched today and already people are responding well and are super curious. We were able to do that. I just want to, you know, they didn't say how to do this, but we did secure a small grant from Microsoft Azure. So thanks to them for hosting that.
Nice, nice. Great work, man. Yeah, I tried it out myself. It looks pretty good. You have to confirm, you have to, you know, have a valid email address. So that's like half the work right there. So that's pretty good.
Cool. I like it.
So that's pretty cool.
Thanks.
Yeah. So you're talking about red teaming. What is the most interesting target that you've obtained in your red teaming days?
Yeah.
That you could talk about. Yeah.
An interesting story there is just how stale passwords are still. I'll put it this way. When you profile a company and you do your reconnaissance and you gather like this is a high profile target, I remember starting a project thinking, wow, that target's super juicy. I would love to get credentials for that target. And then randomly, I ran into a data set that was on the
Of started perusing that, just ran a quick rep through it. And sure enough, the email address for that exact target on that assignment in question was in there randomly. And I was blown away. And I kind of emailed the lead and I said, hey, this is a really one-off, but you want me to try something here? And is it still in scope? And he said, absolutely. And I walked up to a highly valuable system. Logged right in. And that person basically, I mean, you can think of them as root. It was just wide open. And from that point, you knew everything about this organization.
And you used the password from the dump.
Yeah, absolutely. Yep.
Okay.
And so one of the things that I practice is when you're red teaming and when you have to give your report, you know, my style is super social. My style is super supportive. And so I'm just saying, Hey, this is what I found. Here's some ideas, but like, what do you think? And like opening that conversation for them to respond, like one, I might be wrong. My ideas might suck. In this case, they probably don't, but they might. And so I have an opportunity to learn. But on top of that, by the end of it, they're telling you like, hey, you know, the last report we got was 50 pages and they told us that we suck. They told us to fix our crap and they walked away.
Versus you establish that relationship and people you earn their trust rightfully so because you earned it so there you go emotional intelligence there's something to be said yeah i mean you know as a pen tester you have to tell people that their baby's ugly all the time and so we need to be more sensitive about it right or we need to be sensitive about it so that's really excellent walk us through some of the emotional intelligence skills that you mean you know when you're
Yeah. So there's this whole kind of conversation in infosec. And my perspective is different because I got a passion for that piece too. So my perspective on that is right now in infosec, they're saying shame the vendor. And OpSecEDU is taking a different approach to this. We don't shame the vendor. A lot of my infosec peers say drop our vulnerabilities and walk away because some of these vendors are pretty gross. They're pretty mean to us. But what I have seen happen is that when you finally find the advocate inside that organization who gets it and you haven't shamed, you make a relationship. Because what I've tried to do with emotional intelligence is do a culture hack, which I think is the hardest hack of all.
It's saying you've got to adjust who you are and a belief system. Which we don't really think about belief systems. We just do our stuff and think we're humans. And I'm saying, no, you need to think differently about this software development process or about how you're rolling out your infrastructure. And my current belief, and I've been hammered for it, but I still stand by it, is I'm looking to make that relationship and make that internal advocate. And once we find that champion internally, that relationship's really transformed. We've got somebody to report those vulnerabilities to. They tell internally, man, we should be thanking these folks. They're badass. It doesn't... Happen a lot at this point in the culture.
But I think a piece of that is emotional intelligence is not operating through shame. It's operating to find your championship and align with that champion.
Yeah. People empowerment. I think that's one word right there. Empowerment. Like people want to be empowered. And I think what you're talking about is you're empowering. If you can empower someone internally who does want to do the right thing, doesn't want to secure the product, et cetera, they can, you know, be that champion. What did you say?
Yeah, I think it's tough. Or no. Well, a champion is different, right? A champion is going to take a risk. A champion is going to be connected. A champion is going to be heard. And that's such a rarity. So I'm not saying this is easy. Like I'm not taking an easy road with this pitch. No, no. But I guess emotional intelligence is critical if you want to truly change the security story in which people are operating in. But on top of that, don't think it's going to be easy. Don't think you're going to get a pat on the back. Look for your value in the peer group that cares about you. And I think you can do amazing things. And if you're a student listening to this, don't do anything illegal. And don't think just because what you're doing is exposing a massive vulnerability, you know, is going to lead to good things.
As somebody who has tried so hard to do the right thing, you know, lawyers like to call you up and still threaten. Please, students, please. Please be aware of that and find somebody who's really been beaten down by that process and lived it to take advice from and not social media who would love to see a good sideshow.
Yeah. Responsible disclosure. Cool. Cool.
Yeah. I appreciate that. It's cool.
Personally, in my experience, I was able to go into a company where the information security team was despised. And three years later, I mean, at least a year or two later, I would have folks coming and meeting me in the hallway and say, hey, Eamon, did you know about this? I think you want a heads up about this. There might be some security issues there about projects coming on. And so it's just about, you know, being approachable and affable and smiley or something, you know?
Oh, totally. Yeah. I think I'm experiencing that now, right? A CISO is really not a thing in education. It doesn't exist. And yet people know I'm passionate and people have seen me be skilled and have acted in a way that they would want to be treated, right? And so I absolutely had the same thing. Here's a gift card, Jared, because the way you approached me was so respectful. It made the difference. Right. Or like you said, I found this weird thing, thought you'd be interested. Thanks. And I think going back to what can people do to level up, if you start in system administration or on the help desk, but you have a passion for information security, when you get that job on the help desk, I didn't stay there long.
I realized that where I wanted to go and I realized that I wanted to be empowered to do more advanced things, but I also knew I could grow a skillset. Luck Luckily, you know, I kept interviewing different places and different things to finally find I aligned with folks who were going to say, hey, you know, just run with this. Go for it. We trust you.
Yeah. We need you. Yeah. Yeah. I mean, just be approachable and be a nice person. Right. Be human. Be human.
It's pretty hard. It seems like. I don't know. There's a lot of challenges there.
Yeah. We'll see. Well, Jared, it was a pleasure talking to you. This has been fun. And I see ourselves having a talk in the future.
Yeah, man. I really appreciate you having me on. I hope somebody gets some value out of this. And if they want to get a hold of me, I'm on Twitter. You can hopefully put stuff in the show notes so they can figure out where to find me. Absolutely. I'd be happy to chat and help them out.
Great. Great. Yeah, it was really fun. And I know people will definitely benefit from this.
So thanks, Jared. Thanks for coming on the show. No problem. Thanks for having me. Thanks a lot. Bye.
Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon.
