Episode 36 · · 41 min
Lisa Jiggetts From Navy Cook To Pentester To Non-Profit Founder!
Penetration Tester and Founder of the Women's Society of Cyberjutsu
Episode summary
Lisa Jiggetts knew from an early age that she was going to be in tech and cyber. A navy veteran who started off as a cook, she always found herself gravitating towards technology. She is also the Founder & Board of Director of the Women’s Society of Cyberjutsu, a non-profit that is dedicated to increasing the opportunities and advancement for women in cybersecurity. Check out her journey into the cybersecurity field.
Notes
Originally a cook in the military, then migrated to information security.
Looked for opportunities to transition into information security by talking to people in and outside her social network.
Networking can be hard, but it will turn in your favor.
Lisa is an introvert, but knows how to become an extrovert when needed.
Quotes
"When you're starting out, you don't necessarily get into the area you want to be in—you got to work your way up."
“That's the biggest thing you can do. I think is networking because somebody knows somebody."
"So I got all these certifications… I read a book and pass. What is it to me personally? That didn't tell me, you know, how to do anything. They get you in the door."
"[Networking is] hard, but just do it because, in the end, it's gonna turn out in your favor."
Before infosec: Military cook and system administrator
Chapters
- 0:00
Intro: who Lisa Jiggetts is
Ayman introduces Lisa, a pentester and founder of the Women's Society of Cyberjutsu, and previews networking and gender diversity.
- 1:45
Sneakers, DOS games and wanting to be a hacker
Lisa describes her lifelong love of gadgets and computers and how hacker movies shaped her career goal.
- 4:07
From military cook to de facto sysadmin
Lisa explains how she turned a cook assignment into hands-on sysadmin work at each duty station.
- 7:18
Leaving the military: federal job and first security role
She moves through the Department of Interior, earns her CISSP and lands a certification and accreditation job through a friend.
- 10:14
Networking, mentors and connecting in the pandemic
Lisa argues networking is the biggest factor in getting hired and explains how to build mentor relationships and find online groups.
- 14:16
Why she founded the Women's Society of Cyberjutsu
Lisa explains that she started WSC in 2012 to create the community she wished she had.
- 16:36
Women in security and how male allies can help
She discusses bias she has faced, positive examples of allies, and practical ways men can support women.
- 26:11
Cloud, Kubernetes and a hot take on certifications
Lisa shares why she now studies cloud, her view of hands-on certs versus paper certs, and how to start learning AWS, Azure or Google.
- 33:59
OSCP struggles and not letting skills lapse
She talks about failing to get root on OSCP boxes, a career break that left her rusty, and the tip to interview quarterly.
- 39:03
Parting advice: network with people
Lisa closes with her top tip for newcomers and how she manages as an introvert.
- 40:12
Closing: Ayman's new community
Ayman wraps up and asks listeners to check out his new community in the show notes.
Key takeaways
- Networking is the biggest thing you can do to get into security, because someone you know knows someone who is hiring.
- Mentorship is a gradual relationship that grows from meeting the same people repeatedly, not a cold request to be someone's mentor.
- If your assigned job is not the one you want, find ways to do the technical work anyway, as Lisa did by taking on sysadmin tasks from the kitchen.
- Certification and accreditation work is a good entry point into security because you run scans, assess systems and do risk analysis.
- Choose hands-on certifications where you can, and learn one major cloud platform (AWS, Azure or Google) using free credits and video courses.
- Keep learning during career breaks, because skills fade quickly, and interview regularly to keep your skills sharp.
Notable quotes
when you're starting out, you don't necessarily get into the area you want to be in. You got to work your way up
I like to say when I tell my story that in most of my jobs, when I was coming up, I made myself and made the situation fit what I wanted to do.
Networking. Not TCPIP or OSI model networking, but networking with people. Build relationships. Get yourself out there, especially if you're an introvert like me.
Questions answered in this episode
- How did Lisa Jiggetts get into cybersecurity?
- Lisa joined the military and was assigned as a cook, but she gravitated to the servers and Unix systems at each facility and worked as a sysadmin. After the military she worked for the Department of Interior, earned a CISSP and used a friend's referral to get a government certification and accreditation job, which led to pentesting.
- What is the Women's Society of Cyberjutsu?
- WSC is a non-profit Lisa founded in 2012 to help women get into and advance in cybersecurity. It offers membership programs, hands-on CTF training and outreach to middle and high school girls, and it also welcomes male members and sponsors.
- Are certifications worth it for people breaking into infosec?
- Lisa says certifications can get you in the door and are required for some government work, but a paper cert does not prove you can do the job. She prefers hands-on certifications and uses them mostly for self-validation.
Show notes and links
Show the original episode notes
Lisa Jiggetts knew from an early age that she was going to be in tech and cyber. A navy veteran who started off as a cook, she always found herself gravitating towards technology. She is also the Founder & Board of Director of the Women’s Society of Cyberjutsu, a non-profit that is dedicated to increasing the opportunities and advancement for women in cybersecurity. Check out her journey into the cybersecurity field.
Notes
- Originally a cook in the military, then migrated to information security.
- Looked for opportunities to transition into information security by talking to people in and outside her social network.
- Networking can be hard, but it will turn in your favor.
- Lisa is an introvert, but knows how to become an extrovert when needed.
Quotes
- "When you're starting out, you don't necessarily get into the area you want to be in—you got to work your way up."
- “That's the biggest thing you can do. I think is networking because somebody knows somebody."
- "So I got all these certifications… I read a book and pass. What is it to me personally? That didn't tell me, you know, how to do anything. They get you in the door."
- "[Networking is] hard, but just do it because, in the end, it's gonna turn out in your favor."
Links
- Lisa on Twitter: https://twitter.com/lisajiggetts
- Intro Music: https://trash80.com/#/content/133/weeklybeats-2012-week5
- Women’s Society of Cyberjutsu: https://womenscyberjutsu.org/
Getting Into Infosec
- Breaking IN: A Practical Guide to Starting a Career in Information Security: https://www.amazon.com/dp/B07N15GTPC/
- T-Shirts, Mugs, and more: https://gettingintoinfosec.com/shop/
- Stay in touch and sign up for sneak peeks, updates, and commentary: https://gettingintoinfosec.com/subscribe
- Ayman on Twitter: https://twitter.com/coffeewithayman
- Follow Us on Twitter: https://twitter.com/getintoinfosec
- Follow Us on Instagram: https://www.instagram.com/coffeewithayman/
- Join our community: https://community.gettingintoinfosec.com/
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
In most of my jobs when I was coming up, I made myself and made the situation fit what I wanted to do.
Welcome to Getting Into Infosec. I'm your host, Ayman Elsawah. My guest this week is Lisa Jiggets. Lisa not only is a penetration tester, but also the founder and board of director of the Women's Society of Cyberjutsu, a nonprofit that is dedicated to increasing opportunities of advancement for women in cybersecurity. Her mission is to close the gender and workforce gap in infosec. Lisa knew from early on that she was going to be in cybersecurity.
I always knew I was going to be in tech and in cyber.
She also talked about the importance of networking.
That's the biggest thing you can do, I think, is networking because somebody knows somebody that knows a lot.
We also talk about gender diversity and the issues that women have to go through and the awareness that needs to happen still.
It sucks to hear these stories, but it's going on very strong still. And I think if you take any other societal issue like racism or homophobia or whatever, fill in the blank, it takes time. It sucks, but it takes time. But what makes people realize is the awareness, people talking about it, and then people doing something about it.
However, change is happening, and she is optimistic.
I think a lot of folks are changing their mindset that women can and are qualified to do all the jobs that the guys can do.
All right, on to the show. Hi, Lisa, welcome to the show.
Hello, thank you for having me.
Yes, I'm really excited to talk with you today. For those out there that do not know who you are, can you tell us a little about yourself and what you do today?
Well, sure. I'm currently working as a penetration tester for a small company and they do other services, but mostly in the security area. So I'm enjoying my job there. I've actually... Been in the field for a while since the 90s actually what got me into specifically into security I've always known I've always wanted to be a hacker didn't know it was called that so I think it's just let's just say this first I've always been into like gadgets and techie stuff since I was a kid it could have been a toy like a plastic toy and I wanted to take it apart and fidget with it and See what I can do with it. If it breaks, does it break? Can I fix it? That type of thing. But I've always been into computers as far as playing games, like DOS games is when I really got my hands on the keyboard.
So that dates me, if you will. But when I saw the movie Sneakers, that was early 90s. That movie just ingrained... That kind of work. I didn't know it from the movie. It looked like they were doing illegal stuff, but it was for a good cause. If you will, they're trying to go with the bad guy, the whole mission impossible thing where they're like scoping it out and building planets to attack and manipulating people to like social engineering. That's what it's officially called to get the information they need. And that whole thing, especially the electronics part of the computer part of it was really just, it just, it was cool. It was just so cool. Like, how do you do that? That's, You know, I didn't say I wanted to be a bad, like, malicious hacker, per se.
I just wanted to know, like, even the other games, not the other games, but the other movies, War Games and Hacker, those movies just resonate with me.
Right.
I think I'm one of the few people that, when you talk to people that are in cyber... They got into the field somehow through this weird path. But I always knew I was going to be in tech and in cyber. I've always had that thing. I didn't know I was actually going to be in it. In high school, you're like, what am I going to do? How do I get there? I actually joined the military right after high school. And a lot of people don't know this, but I was actually a cook. I was on the grill flipping burgers. That was not the ideal job for me. But I guess I didn't score where I needed to score on the ASVAB, which is a test you take to get placed in what your field is going to be. So my field was being a cook or working at the gym, that type of thing.
But the spin on it is each of these facilities has servers and tech and all that. So I pushed myself into those areas because I knew how to do that stuff. Unix systems. And I was like, so I was like a sysad type person for one of these places in Chicago. If you look at my resume, it doesn't say cook, it says system administrator, which I like to say when I tell my story that in most of my jobs, when I was coming up, I made myself and made the situation fit what I wanted to do.
Right.
So, because when you're starting out, you don't necessarily get into the area you want to be in. You got to work your way up or... Or if you have a hookup.
And probably there was no one to deal with some of those tech things. You want some tech thing fixed in the kitchen or the area. Yeah. But if you want it officially to get it fixed, you have to put in a ticket probably and wait. Who knows when you're like, let me just fix it myself. That's great. Exactly. That's awesome.
Yeah. And that's just the personality I have, even with software for the longest time. Like Photoshop and those types of things. Like when you hire somebody, they just don't do it the way you want to do it. So I'm like, I'm going to learn myself. And I teach myself things that I want done my way just so I have control of the output. But that's not to say I don't rely on other people that have those skills. Yeah.
Take initiative where you can, right? What was your first computer? How early were you in the computer age?
I don't even remember the name of it, but I remember how it looked. And I was probably preteen age at that time. My dad came home with this. It looked like a typewriter that had a cover. You could cover it. So it was like a flat cover.
Right.
But it was a computer, so I don't know how to explain that. But we would carry it like it was a case. The cover was a case over the computer. I remember we went to some cafeteria, some school cafeteria. There were maybe 50 people in there doing computer stuff. And I was like, oh, okay. So that, then him bringing home games, those DOS games, and trying to figure out how to play them. Like, you have to type in the command. SQL and backslash. Install. Whatever. So that's when I first got my hands on And it was mostly games that I had learned to play. And there was no Google back then, but I don't know. I remember finding online, maybe this was later, but you know, how to cheat the cheat codes and how to live forever in your game.
So that was my, that was probably my first introduction into computers.
Nice. Nice. Okay, cool. And so did you stay in the chef area during the neighbor?
Oh, so I was in the military for six years total, active duty. So I was only a cook for that first portion of my duty station there. And I split time with the sad stuff in the back. But part of our other areas include working at the gym and working at lodging, which is like hotels. So like my degree from the community college of air force is like hotel restaurant management or something like that. But like I said, at each of those, I had hands on a keyboard with the system side.
Right.
And so it was, yeah. Lodging. I worked at the gym. I worked at the food dining facility. Yeah. That was pretty much my career.
Oh, and then how did you transition into security?
So, like I said, I've always known I wanted to be in it. Let's see. I was getting out of the military. I was interviewing for jobs.
Okay.
And I remember this one interview, this one company, I don't know if you remember, it's called True Secure, TRU. And I think they got bought out and I went in there and looking back, I'm like, I wasn't ready, but I just wish they took a chance on me. But I was only, yeah, I was only applying for security type jobs because I was like, I want to be a hacker. I just didn't, I didn't have it then. So I ended up taking, I actually went into federal government, which is funny. So I was at the Department of Interior. So during that job is when I started taking classes in security. And then I got my CSSP. And then a friend of mine, she had already started working at a job on the private side. So that was my hookup, if you will, my inside connect.
I still had an interview and everything. I was already been there. So that was my first quote security job was doing CNA certification accreditation. So government side stuff.
Oh, okay. Gotcha. Gotcha. And so your first, your role, when you got out of the military and you went into that role, was it, it wasn't necessarily, was it full-time security or was that your first cybersecurity job where you still had to transition into it?
First so when I left the federal government right yeah that was my first security like official job but I wasn't like new to security concepts or tools at the time because I was like I had my home lab and I was doing stuff it was just I just didn't have that That knowledge to, to at that time to be a security person. So I had to go to another place of employment that did security, which back then CNA, that was like the hottest thing because the business act came out and said, all government systems have to be certified and accredited. So that was, I did a little bit of that in the military too. But that's where, especially folks that live around the bases, especially in DMV, when I tell them how to get in, that's a great way to get in is do CNA work because you're doing scans and you have to assess and do all that risk analysis stuff.
And you still get to play with some tools. And then you start looking for jobs. And my path was pen testing. That was a good start for my career in security, if you will. And then I started meeting people and
Hacker clubs and you start building up your skill set yeah what are some things what are some things that helped you get that job what if you were to list like several things what are some things that helped you get that first job in security like i said i've taken classes so i knew some concepts and i had some certs already and i think having clearance helped too especially in the dmv like it's all well now a lot of government and government contractor work
So I think that all just fell in line. Just networking and knowing people, I think, is for folks to get in. I think that's one of the biggest, when I talk to mentees, I say, that's the biggest thing you can do, I think, is networking. Because somebody knows a lot of you. Yeah, yeah, that needs to hire wants to bring in somebody and I think it's a lot better these days with joining clubs or groups that meet up and you can learn stuff and meet people because you never know who you're going to meet. So I think that's the biggest nugget, I call it, for getting into security is networking. But of course, having a mentor helps. And that doesn't mean go on up to somebody and saying, will you be my mentor?
That doesn't work like that. It's a gradual relationship building exercise, which this is where networking comes in. So you're meeting the same people over and over, you're building that relationship and You're asking questions and next thing you're probably going to end up being friends. But you don't have to go it alone, I guess is what I'm saying. You got to do some work to build your skill set on your own. I think that's to take an initiative part. But there's a lot of resources out there now.
What do you recommend? How do you network now in the pandemic age?
Isn't it zoom but the good thing is all a lot of the conference folks that were doing them in person i've done them online DEF CON just happened that was pretty cool yeah and how come we had ours i get i'm still getting emails like all these events are still happening they're just online and there's i don't know how many discord and slack groups out there and
It's insane.
It's just so much. Maybe that's the problem now is there's so much.
I don't know. Yeah, I felt a little disconnected. You know, during the, I tried, I hopped in the discords, I hopped, I just felt a little disconnected. I don't know. I imagine, I could be wrong, that those looking to break into the field may have a little more apprehension online. Maybe not. I could be wrong.
So just wondering any tips or... Oh, I think I would agree with you because first of all, It is overwhelming.
Yeah, exactly.
Outside of COVID or doing it online, just in general. But now there's that extra piece. And yeah, I'll take our WSC Slack group, for example. I don't know. We have a lot of members in there. A lot of folks, not even just members, but a lot of folks. But there's probably a good core, maybe 10, 15 people that are the only ones that post, which is fine because... If everyone's seeing it, you're still getting the information, which is fine. Sometimes you just got to get warmed up. A lot of times, and I have to say, especially women don't feel comfortable putting themselves out there, especially if they're not Like an expert that's like our thing do i am i worthy enough to say anything first of all and then two am i going to be asking a stupid question so it does make it a little bit more challenging i think on the online space but i guess there's some anonymity there i guess that we could leverage on the positive yeah you can troll just when i say troll just watch
Oh, you mean like Lurk? Yeah, Lurk, you mean.
Yeah, yeah, Lurk. Twitter is great for that. Like a lot of good stuff getting posted on there.
Yeah.
But if I could, if I'm going to say anything, I'm going to say find a club or a group that is what about what you're about. So like WSC, we're here to help women get in advance. And it's, we tend to go and lay on the side of the hands on technical side. I would think that folks that are interested in that, getting into that would consider checking us out. And yeah, Not just us, but other groups, too, because it's like shopping. Where do you shop? Why do you shop here? Why do you like this place versus that place? You get a taste of different things out there. So there's just a lot of things. And maybe the answer is you just got to explore and see what's what.
Yeah, everything has its own offering. Just take what you can from each item, from each group. Let's talk about WSC. The Women's Society of Cyberjitsu. Tell us about WSC.
WSC is a non-profit that I founded in 2012. The main reason that I started that was because I didn't have a place to go myself. If there was a group like WSC out there, I would have joined that group, which is a group that is of And for like-minded folks. And I'm not going to say women because it's not just for women. Yes, that is our mission, but we do have male members and I mentor guys all the time. So, you know, I just want to make that clear that it's not a women thing per se. But yeah, I wanted to offer the things that I wish I had in trying to get into and learn more stuff about hacking. For example. I wanted to geek out with other women and we could talk shop or talk shoes. There's a connection and you might have to be a woman or one type that could be cast out to feel that way, in which I have felt in many situations in boot camps and at work.
But being part of WC, I have these ladies that Are skilled and experts in their fields. And I'm like geeking out. I'm like, this is cool. Let's learn together, share your stuff. I'm sharing my stuff. And I feel like if you're in a comfortable learning environment like that, now you're just like fast, press the nitro button in your learning. And of course you're going to meet other folks and networking and lots of, you know, opportunities for training. We do a lot of CTF training and hacking and, As teams, we do a lot of stuff with girls, mostly, yeah, middle school, high school girls.
Okay.
Because how can we not, right? They're coming after us. I want this girl to have what I wish I had when I was that age. So, yeah, pretty much whatever we can do to help women get in the field and advance in the field is what we offer membership-based programs. So we have membership for women, and I meant to say full membership for professionals, and we have student and military veterans, and then, of course, our male sponsors, our male friends.
That's wonderful. That's wonderful. Yeah, that's really good. Yeah, you answered my question, like, why did you start it? In your own words, I appreciate that. What are some of the challenges that women face today, either in tech or in security in specific?
I'm thinking that it's probably going to go for both, being in tech and security. I don't think there's much of a difference. If anything, there's more scrutiny on the security side. But I think it's the same as like times are changing. I think a lot of folks are changing their mindset that women can and are qualified to do all the jobs that the guys can do. It's been this way for so long. So it takes the mindset to accept that and have a willingness to change their perception. So my personally, that's been my biggest thing is Not being respected and thinking that I could do, I know how to run commands. Anybody can learn this stuff. So why do you think a woman can't? So that's for me personally, that's been, and I have like only one story where I know some women have just, just go through this, like trying to get in the field and,
Dealing with a whole counterparts or managers. It sucks to hear these stories, but it's going on very strong still. And I think if you take any other societal issue like racism or homophobia or whatever, fill in the blank, it takes time. It sucks, but it takes time. But what makes people realize is the awareness of people talking about it and people doing something about it. We're well aware of that, but I could say it's changing for the good. I think it's changing for the good. Definitely.
Can you tell us both maybe a positive and a negative experience, maybe as yourself as a woman or something?
So like I was just saying, I've only had one bad, not one that I can note that I always tell the story when I was on a assessment, it was me and this other guy and we're on our laptops getting ready to run our tools. And this specific tool was Nikto, which is a web app scanning app. Yeah. So, He didn't know it. I knew it. I was like, this is the command. And I don't know, for some reason, he just didn't think I should know that. So he went and looked it up.
Really? Yeah. How was his reaction? Was it a facial or did he say something?
No, I think I got so angry inside. I blacked out. I don't even know what happened after that. I was like, what? So he looked it up and I was like, but I have a lot of, conversely, a lot of good stories about guys helping out and Offering tips and tricks and stuff like that, stepping up. I love to see guys step up to other guys that are being not so great. And it doesn't have to be nasty. A lot of times folks just don't realize because they've been this way. I had a colleague tell me, he's a hiring manager, and he told me that somebody called him out because he was like, he's a white dude. He was like, yeah, you seem to hire folks that are like you. And I don't think he realized that, but when he told me that, I was like, that's an awakening that first you acknowledge and then you're telling me.
That's great.
So he's doing something about it. So that's why there's, I think there's a tactful way of letting people know that this is not kosher. And maybe that's all that's needed because a lot of times you just don't realize about yourself until somebody tells you from the outside looking in.
So there are allies out there. There are male allies.
Oh, definitely. Yeah.
And then how can male allies help out either in the cause in general or with WSC?
Yeah. I think one of the bigger things is, well, there's a few things, but like speaking up, mentoring, and it doesn't have to be an official mentoring. You could just give a tip and that could be a big confidence booster because you Now you feel like there's somebody looking out for me, somebody helping me out that has that power, if you will. When I say power, that's in quotes because that can mean a lot of things. You're down here and he's up here. So you're already feeling some type of way. If he reaches out and do you know how to do this or you could run this command or anything like that. Just not siloing themselves off. Guys like to kick it with guys and I think women like to kick it with women, but
Still they're into mingling, but you tend to go with what you're comfortable with. So there is that thing about stepping out of your comfort zone. A lot of guys don't like to come up to women, that whole thing. But it's really cool when guys do that. Because you're like, oh.
How does a guy do that with good intentions and not get...
Flirting or something?
Like he's flirting or mansplaining or some of these other things. Because I think that is a possibility. Or I think there are guys out there. I'm not speaking for... There could be guys out there. No, there is. Yeah, that want to help but are afraid of getting pigeonholed into one of these categories accidentally.
Mansplaining is one thing because I don't know if that means the guy... Really doesn't know he's mansplaining or he is that type of guy.
I think there are a lot of, I think there are both categories. For the male listeners out there, maybe we can talk about what are some tips and tricks you have if you're a guy, want to be an ally, but don't want to, I've seen a bunch on Twitter, but maybe you can, in your own words, give tips for guys out there that want to be allies.
Oh, I just, yeah. I just had one idea when you mentioned Twitter, like giving kudos to a woman, legitimate kudos is, that goes a long way. And I also said offering help or, Mentorship and what I was going to say earlier was that your energy will come through when you come up to a woman whether it feels like you're trying to be flirty or you're genuinely like trying to strike up a shop talk conversation I would say the scenario matters right if you were both coming out of a talk was cool did you whatever fill in the blank it's just I want to say a lot of times we women want to be like guys and let me you know clarify that we want to Be the same level as respect and all that, but we don't want to be like guys in some other ways.
So talk to women the way you talk to the guys, but with respect. I think is bottom line. We like to get geeky. I love talking geek shop. So if you want to strike up a conversation with me, let's start talking about, you know, hacking or something like, have you seen this new tool or whatever? You'll see my eyes light up.
Yeah. Just maybe, maybe we should record it as a separate PSA episode, bonus episode on here are all the things to do. You want to engage technically or become an ally as a man.
Yeah. Maybe we should. I can get some of the other ladies on to give more perspective on some of the, maybe we can do real examples. That's something I've been wanting to do anyway, is anonymously let folks air out their experiences. It's happening. And I honestly feel a lot of people don't realize this is happening. They hear the bigger stories that come out, but just about every day there's some BS that a woman's Taking at her job and it's because the guy either he's a true a-hole or he doesn't realize he is right so i think if the guy heard this example he'd be like that sounds i did that maybe yeah
Yeah, and with all my guests, I try to have them walk through some of these bad examples. We have some episodes. By the time this one airs, they should have been out there. But yeah, and me, I'm a little naive. I think there's a lot of other folks that are naive as to what's really going on. But in addition to talking about the bad things, I think giving those lessons for those to do the right thing is also huge.
Yeah, I think that would be a good... I think there needs to be more of that, to be honest, because I remember one of my recent panels at the end for Q&A, a guy stood up and asked that very question. What can we do? Because X, Y, Z, it's not that clear cut from our perspective. So I thought it was interesting to hear a guy say that because we both have perspectives as a woman and as a guy. That would be really good to get that out there. I think on both sides. So there's like an aha moment. I didn't realize that.
Oh, yeah, yeah, I definitely think there's more good than bad out there in the world. And just a skills thing, really just learning and understanding. Yeah, so there's a lot we could talk about. I'm really curious on you being a woman in the military, you must have had a lot of upwards battling as well.
But I think I have very little negative to say about my time. In the military. Yeah, I've been really lucky because like I said, I hear a lot of stories. The military is another tech, right? Another bubble, if you will, that people have got to deal with crap. But I had a few type things, but I don't want to say that was expected or acceptable, but that did happen. But I didn't have anything crazy negative in my time. So I was really thankful for that because I wasn't as strong as I was then. As I am now emotionally and with my confidence where I probably may not have said anything back then, but now if you come to me, You're going to get my viewpoint tactfully. Yeah.
And for those starting out, those who are starting out in any career, they don't have that confidence. And so just building up that confidence. That's interesting you say that. Yeah. So let's talk geek for a little bit. Tell us an interesting incident that you experienced in your security career or a challenge that you might have had to overcome, like a technical challenge, either now in your current job or previously.
I'll say this, which is playing off of my whole thing about Presenting opportunities to take an initiative thing we said earlier. I am the type of person that does not like to be unprepared for anything. So I tend to over prepare. So getting into new technologies, for example, especially with my new job with this company, I've for the longest time have avoided cloud.
It's just so scary to me when I first, you know, try to play around with it years ago and I got a bill. I was like, Oh my God.
Oh, yeah. Yeah, I know that.
No, no. Fast forward. I had to learn stuff quickly. So I've been studying and getting my certs. So I can be prepared to pen test these environments. How do you do that if you don't understand a technology? That goes for anything. But I just knocked out a couple of certs and I feel way more confident. Like we're putting this report together. If the customer comes back and says, can you explain this or why is this a finding? Yeah. I'm very confident now because I've learned it. I did it in a lab and got asserted, which is, I have my own opinions about being certified or getting certifications, but there is a place for them. Whether they're hands-on or not. But I got those just more for self-validation.
I tend to go for the ones that are hands-on.
What is your hot take? What is your hot take on certifications? Maybe people do want to hear different opinions on.
Okay. So my opinion is back in the day, like the paper MCSEs was a hot thing. Everyone was getting them, but they didn't know how to do anything. Yeah. So that's my thing. And having did all that. And I have a lot of certs that I got when I was getting out the military because I'm getting a job. I need to get certified. Well, actually, my mentor is the one that told me. So I got all these certifications. And when I like that was a I read a book and passed. What is that to me personally? That didn't tell me, you know, how to do anything that gets you in the door. And like I said, there's a place for all these 85, 70. If you want to work for the government or government contractor, you have to have certain certs.
That's just the way it is right now. But for skills and being able to do your job, like you need to get those skills up and then the validation is that cert. So if there's a hands on cert for it, that's my take on it.
Okay. Yeah. Yeah. I appreciate that.
Yeah. That's awesome.
Yeah. It gets, it gets you past the interview gates maybe, or past the HR for a lot of certs. It might not actually give you the skills that you need. It might give or take.
Yeah. A little here and there, but.
Book knowledge.
Especially if you're not even not doing the labs, reading a book and taking the exam. Like that to me is, it says you had the discipline though to study. So that's a good thing. That's a plus in my book, but. What else you got for me?
Yeah. Yeah. Yeah. Cool. So tell me an interesting exploit that you had to interesting web challenge maybe, or what kind of pen testing do you do? What's your area of focus?
So like, I was saying we're doing a lot of cloud and Kubernetes. I'm loving this stuff now. So a lot of self-study. Yeah. I'm like, and I, when I did the workshop and I was giving my little spiel, like y'all need to get into this because this is the way things are going. I don't know how many years before. Yeah. Like now's the great time to get on board and I'm a late bloomer, but I'm saying it like now's the time to get on board with cloud. Cause everybody, I don't have to tell you, but,
For the audience out there that don't understand cloud, because I was a little bit in a bubble. I thought I've been doing cloud for a while, personally, on the professional side. But what's interesting is that there's other parts of the US, other parts, maybe the world, where Cisco certs are still coveted. And slowly, eventually, companies are embracing the cloud. So what is your advice for those that are not familiar, don't understand the cloud?
So my hang up on the cloud was not just the billing piece, because that is a big piece that they teach you when you learn stuff. But The concept in general versus on-prem, on-premises data centers for your company versus the cloud. So there's data centers for the cloud, but you don't have to mess with any of that. What you get is what you need, the infrastructure piece of it. So there's that, the offerings of being able to spin up a VM or the scalability, the availability, all like that within VMware. Seconds to a few minutes, you have all this infrastructure at your beck and call and it's pay as you go. Like that's freaking awesome. And then you've got the containerization piece, which further expands that, but it's still tech.
You still have to know your operating systems and what firewalls are and all that jazz, but now it's just hosted. There's no like your job in the basement has a data center type thing.
Yeah. It's all API based. Yeah.
Yeah, I would suggest pick one. And I say one of the three major ones between Azure, Google, and AWS. I was really intimidated by AWS when I first started poking around because there was so much. I was like, I don't get it.
Yeah, it's overwhelming. It is overwhelming.
It is. I like these online training like Linux Academy. Actually, this one guy, he's Kubernetes, but he has a whole YouTube channel. He does everything in Kubernetes and it's on YouTube. And the only annoying thing is he's got like three ads in every video. So when I'm trying to whip through them, I was like, oh my God.
Yeah, send me the link. I'd love to put in the show notes.
Oh, me and open source or something like that. Okay. Just me and just open source or something like that.
Okay.
It's like long and weird, but he's, I really like his videos because he's just showing you, he talks about what he's going to do. And then he is screencasting, like setting up as he goes. So you get it. Like I'm a visual learner, right?
Right.
If I could have stood over somebody's shoulder way back when learning and testing, like that would have been so much more helpful. I would have been way further ahead. So the age of the videos and YouTube now is great learning platform and But getting on one of these platforms like AWS, they give you free credits to start out. And you just go in one of these training providers, whether it's YouTube or paid one, and just knock them out. And before you're like, oh, I get it. I get it. And then your confidence builds and you start learning more and more. Now you're going to be at a point where still a lot of people, for the example of folks trying to get in, you get that like basic cert a lot more.
Than what a lot of people do to be an entry-level person in infosec.
Yeah, yeah.
And because even though there's still this back and forth about we have all these jobs and not enough people thing, They're still being picky about it, but you have now a leg up on the next person. That's right.
That's right. An extra niche. Yeah. Yeah, that's true. That's true because there's a shortage of cloud anyway out there as well. So combine the shortage of cloud with security and now you have cloud security. That's a really good. Yeah.
If we ever go back to work, you are more than likely to end up being a remote worker. Right. It's all online.
Yeah, yeah. So any war stories that you can talk about from your vast experience in security?
I really don't have any. I've been pretty cut and dry. I've been lucky.
Hacked into a box, or you were stuck getting shell, maybe, and then you got an incident.
You're talking about not being able to get a shell. That's OSCP, which I'm doing that right now. This will be my third time attempting it. But that is... That's... It's hell, but it's also rewarding when you finally get your shell and when you can get root. That's probably my worst story is trying to get root on all these boxes. And there's so many ways and they're only giving you some crazy hints, if any. But I did try, I got a subscription for a short time for the offshore lab in the Pack the Box website. And I got the first shell. I didn't get root because I didn't have time to keep messing with it. But that was a good feeling. I was like, okay. And I didn't ask for help. I just figured it out.
There's definitely a reward to the war, if you will.
How about as a mobile security pen tester?
When I did that work, we weren't pen testing. So I wish we were. That was a part of our little group that I was in. There was the dynamic analysis and static analysis group. So we mostly just did manual scans, manual assessment, and like web inspect and burp, which that was a good learning experience because that's basically web app testing. So that was a really great experience, but I really wanted to do more work in that in more recent times, combining it with just regular web app pen testing on the bug bounty side. If you could, I think it would be like bonus. If you use both the mobile app and the actual web app to combine, to find something, I'm thinking you could do that. That is plausible depending on, I guess how they built it, but there's so much out there and there's so little time.
This fortunate things are happening right now, but this is a great time to really start learning stuff. And that's what I've been doing. I'm just, I'm always on learning something. So this is a good time.
That's true. That's true. I was going to ask, how do you stay up to speed? But I think you answered it right there. Because being in the security field, once you get in, then you drink from the fire hose. And you just kind of need to always stay on top of things.
And I will say, though, this may apply more to women just because of the maternity leave. Hearing more stories, being out one, two years, three, maybe who knows how long, raising their kids. You start to be out of the field, out of just the everything. And you try to get back in. You're so outdated. And that happened to me. I was spending so much time with WC. I was still working, but I wasn't doing what I really wanted to do. I was getting a check. But I felt that my skills were dwindling and then that contract ended and I decided to take some time off. So when I decided to go back to work, I was actually having a hard time. I was like, dang, I've been doing this for a minute. What is going on?
What I will say is if you're going to be on break or in between jobs or whatever, Don't stop learning. That was my lesson. It's life.
Absolutely. Yeah. If I don't hit the keyboard or the CLI on something for a month, I'd get rusty.
Yes. It doesn't take long.
I can't imagine, you know, for a month.
It does not take long.
Yeah.
Yeah. A month is about right.
Yeah, yeah. One tip I give to even folks in the industry, I recommend they go interview every like once a quarter.
Ooh, that's a good one.
Right? And then that will keep you on the edge. Even if you're not interested in the job, even if you're really happy, unless you're like, because then you see how other companies are doing things. And you get asked really interesting questions and it'll make you think. So there is just something to be said about staying, keeping the wheels greased and the interview side of things. If you've been at the same job for five years and you think you're going to leave anytime soon, you better start interviewing like six months ahead of time. Yeah.
So I think, you know, those first, I don't know how many interviews, maybe I did six interviews, maybe. No, it was more than that. It was about 10 interviews. Of course, you start getting your chops back when your nervousness is not as bad as you keep going and going. So definitely, that's a great tip there to keep regularly interviewing.
Yeah, it's really useful. So I saw that you got nominated or you're on the top 100 cybersecurity women of the year of 2020. Congratulations. That's awesome.
Thank you. That was a nice surprise.
Well deserved.
Thank you. I think I made that list last year and I think I knew about it then. So this was a surprise, but that was cool.
Yeah, that's awesome. That's awesome. We definitely appreciate your work. And there's just so much to be said. Any parting thoughts for those out there looking to get in the field?
Network. Networking. Not TCPIP or OSI model networking, but networking with people. Build relationships. Get yourself out there, especially if you're an introvert like me. It's hard, but just do it because in the end, it's going to turn out in your favor. You just got to put yourself out there and start meeting people. I think that's always number one on my list. It's not skill set per se. It's the networking piece.
Nice. Nice. You don't sound like an introvert. I'll tell you that much.
Oh, I know how to turn it on. My extrovert. Trust me. I'm all the way over here.
But it does drain some energy, right? Yeah.
And that's why I get drained really quick after conferences or whatever. Like I put it all into mingling and conversing with people that it's just, it's a lot, but it's worth it. Yeah.
Okay. That's well said. A lot of good nuggets in this interview. I definitely appreciate your time. Yeah. And look forward to talking in the future.
Great. Appreciate it.
Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.
