Getting Into Infosec, Episode 13: Marcus Carey - Childhood Builder/Breaker to Navy Cryptologist to Founder and Mentor
Published January 11, 2019 · 44 minutes
Episode page: https://www.gettingintoinfosec.com/episodes/marcus/

[0:17] Ayman Elsawah: Hey everyone, I'm Ayman Elsawah and this is Getting Into Infosec. Our guest today is Marcus Carey.

[0:22] Marcus Carey: I've always been a tinkerer. I've built stuff. I was a science fair geek, the whole nine.

[0:27] Ayman Elsawah: Marcus is the CEO and founder of ThreatCare and has spent over 20 years in incident response penetration testing and forensics with a variety of federal agencies, including the NSA.

[0:36] Marcus Carey: And so one of our analysts went rogue and tried to hack back.

[0:40] Ayman Elsawah: He's really passionate about giving back to the community through things like mentorship, hackathons, and speaking. Marcus really breaks it down for us on how to learn to learn.

[0:47] Marcus Carey: So now I'm like a finely tuned weapon when it comes to learning and doing things like that.

[0:52] Ayman Elsawah: Marcus has mentored a lot of people and shares with us a breakdown of how to get past a job interview.

[0:58] Marcus Carey: It should be impossible for anybody to do bad on an interview. And the reason why I'm telling you this, the two parts of your interview are things that an employer says that they need for the position. Give yourself a couple of weeks. Usually jobs, these type of jobs that break into security from a SOC analyst or whatever, those are evergreen positions that they're always looking for.

[1:18] Ayman Elsawah: You should have seen me while I was recording the interview. Marcus was dropping tips like candy from the sky and I was just blown away. Really happy to have met him. I even left in the part where he corrected me as I thought it was important for you to hear. Hey, Marcus, thanks for coming on the show.

[1:31] Marcus Carey: Hey, thanks for having me. I'm excited to be a part of this.

[1:34] Ayman Elsawah: Great. Yeah, same here. So let's start from the beginning. How did you get into information security?

[1:39] Marcus Carey: Well, when I was young, I think the thing that I saw when I was young was stuff that I kind of like nerdy stuff that kind of like attracted me, like, you know, Revenge of the Nerds or War Games. I kind of understood I was a nerd from day one. So War Games really got me into one of them. You know, computers and there was definitely a security element to war games from a hacking perspective and anything related to hacking and all that stuff. I kind of wanted to do that since I was a kid, probably.

[2:07] Ayman Elsawah: Nice.

[2:07] Marcus Carey: But I guess, like, I didn't have the resources to do it, though. So the military was a good start for me because I joined the military at 18, even though I took basic programming in school and I took Pascal programming language. But that was the only thing that only exposed the computers I had. I didn't have my own PC or anything. So the military, when I joined the military when I was 18, I got access to a lot of stuff. So that's where I really started my computer security career, I guess, in the military.

[2:34] Ayman Elsawah: So entering the military really helped you kind of springboard your information security itch. Can you talk more about that and how that helped?

[2:41] Marcus Carey: Yeah. So when I was 18 years old, actually, I was an avid basketball player back in the day. Most people wouldn't believe this, but I actually had a chance to go to college to play basketball. But what happened was it wasn't a full ride. So I would have to pay. And I was dirt poor growing up. So I couldn't afford anything that wasn't full ride. So I couldn't get a full ride. So one day when I was walking around high school campus, there was a Navy recruiter. It was recruiting people for the Navy, and it said that it paid for college. And so since it said it was paying for my college, I was like, okay, cool, I'm down for this. And then so I joined the military, so it paid for college. And then since I scored pretty good on what you call an ASVAB test, it's the Armed Forces Aptitude Test.

[3:23] Marcus Carey: That test I scored pretty dang high on. And they told me I could do nuclear engineering or cryptography. I ended up going into the cryptography field. And this was 1993.

[3:35] Ayman Elsawah: And why did you choose cryptography?

[3:36] Marcus Carey: I told them I just wanted to work with computers.

[3:38] Ayman Elsawah: Okay.

[3:39] Marcus Carey: That's all I wanted to do.

[3:41] Ayman Elsawah: Nice. Okay.

[3:41] Marcus Carey: So having said that, they say, yeah, it was computers and communications and stuff. Because most of the stuff that we did was classified. So even my recruiter didn't kind of know what the heck I was getting into. But he understood there was computers and stuff involved. And so luckily, that was the biggest thing that ever happened to me. As far as getting on because during the military there's tons and tons of you know billions of dollars spent on computers and stuff and so once i got in it was just a golden ticket to mess around computers everywhere labs even in the barracks you know global telecommunication systems We had the first Cisco routers. We had everything, like everything you could imagine that was related to networking and communication and security and cryptography, like ridiculous cryptography.

[4:31] Marcus Carey: But this was like government cryptography systems, you know, stuff that wasn't even available to the public to like kind of like some of these things are just being available to the public now.

[4:38] Ayman Elsawah: Right.

[4:39] Marcus Carey: I've been working with since 1993.

[4:41] Ayman Elsawah: Right.

[4:42] Marcus Carey: So.

[4:42] Ayman Elsawah: Okay. And were you breaking things before you got in the military?

[4:46] Marcus Carey: Breaking things? I mean, I've always been a tinkerer. I built stuff. I was a science fair geek, the whole nine. So like I said, I had learned how to program a little bit in school growing up. I was in gifted and talented classes and they let you play around with computers and stuff back in the day. And I learned how to program a basic. But other than that, I was always a math and physics tinkerer. I was building stuff and doing the science fairs. So yeah, definitely a bit of an artistic person. I wanted to be an architect when I was growing up. So I've always kind of been a builder and breaker of things.

[5:17] Ayman Elsawah: So the Navy was obviously a big springboard for your infosec career. But tell me a little bit about your pre-Navy days. What was the mindset you were in? Did you know you wanted to do information security or you just know you wanted to do computers? And can you tell us about a time where you possibly were in, quote unquote, hack a situation, a situation where you were stuck, you had to come up with a solution and it could have been technical solution or just, you know, a hack in your younger days?

[5:43] Marcus Carey: When I was young, the people that I looked up to, my mom at some point bought a use at encyclopedias. I was totally into all the sciences and stuff. The people I used to look up to were inventors like Thomas Edison, Benjamin Franklin, just name it, Leonardo da Vinci. All these different people were my people that I looked up to and I wanted to be like. I used to tinker around and do tons and tons of science experiments. I was really artistic, so I could draw. I won statewide drawing competitions. I placed hot signs for us because I was good at my hands, making volcanoes and whatever there may be. So just tinkering. And I was the poorest person I knew growing up, bro. I didn't have any money.

[6:30] Marcus Carey: So anything I did was a hack. I made my own hacky sack, funny enough, because I couldn't afford it. I used to make my own toys. I made my own like track pit because during the 90, the 84 Olympics, I was into like, I want to be a long jumper. So I made my own track. We used to live in the country. So I made a jump pit, like up the specs.

[6:50] Ayman Elsawah: Wow. Amazing.

[6:51] Marcus Carey: I found a basketball room. And made my own, I found a rim, ended up making my own basketball court. Like, I just would find scrap parts and just build stuff. So, I mean, ever since I can remember, I was always building, whether it was technical or non-technical. You know, plus learning how to program. Like I said, I learned how to program basic when I was like, must have been like eight years old and just making computer programs back then. And in high school, I took Pascal. Man, I've always been a tinkerer, man. I've always been fascinated with building stuff. At least I love MacGyver. You probably remember that TV show.

[7:23] Ayman Elsawah: Oh, yeah.

[7:25] Marcus Carey: That was my whole thing, and that continues to this day. I mean, I started a software company, and I'm still building and tinkering around and figuring out stuff in the computer world now, but didn't have a lot of technology at my disposal. But when I would tear stuff apart, you know, whether it be lights or electronics or whatever, build that kind of stuff too. I was always building and tinkering stuff since I was young. And so I've always been fascinated with that kind of stuff. So it kind of all points to, you know, kind of like being in a field where you can break and all that stuff. And I guess in the military, the military taught me the security aspect and gave me mad exposure to computers.

[8:01] Ayman Elsawah: That's amazing. Yeah, there's definitely something to be said about that. That's great. And I want to dig into your artistic side. I'm finding a lot of quote unquote hackers, a lot of security folks have this really huge creative side to them, whether they be musicians, artists or anything like that. You know, do you have any comments on that?

[8:17] Marcus Carey: Yes, I can remember me being like five years old and drawing and having paper like manila paper and recreating the things I saw in books. I can remember as clear as day like drawing Snow White and the Seven Dwarfs. And then when we would have competitions in school, there was this thrift store or something like that. It was kind of like a Walmart before Walmart called Bid Franklin down in the south. I drew this portrait of Benjamin Franklin pitching Benjamin Franklin chain, and it won a competition. There was also some kind of centennial of the Constitution. When I was young, I drew Thomas Jefferson's hand writing the Constitution. It was like, hands are hard to draw. I just had a talent for drawing.

[8:59] Marcus Carey: So that's when I knew that I was artistic and all that stuff. My mom, my church actually put me through piano class when I was young. Man, I must have been like nine, ten. I went to piano class, so I learned how to play the piano. And then in sixth grade or seventh grade, I went to play bad. And I never had played the trumpet before. But based on being able to read music really well on the piano, I was first chair in six weeks of that.

[9:26] Ayman Elsawah: Nice.

[9:27] Marcus Carey: So that was a musical related thing as well. So I think that being able to create stuff and where there's nothing there, I think that transfer well into code for sure, because there's nothing there and you have to create it from scratch. And that's the same case with drawing and same case with music.

[9:45] Ayman Elsawah: And you talk a lot about you have to learn how to learn, right?

[9:49] Marcus Carey: Yeah, yeah, that's what I'm saying. Yeah, yeah, totally.

[9:52] Ayman Elsawah: Yeah. Can you expand on that right now on how it relates now in information security or getting in?

[9:57] Marcus Carey: Yeah, totally. So every person has some kind of core foundation already, no matter what you did when you were growing up. I think like learning how to learn. So I know and I'll give myself an example. I'm an auditory learner. I learn by listening to somebody and also a visual learner. If I see somebody do something, I can recreate it. So those are two things that I know that I learn from. So what I do and everything that I do, I learn in those manners. For instance, like there's this thing called sub vocalization. Sub-vocalization is when you read something, you kind of read it. Internally, you have this inner voice that you're reading something with. So what that does is that makes you read slow though, right?

[10:37] Marcus Carey: Because you're pronouncing a word even in your head. If you ever study like speed reading, some people speed read to read stuff. Speed reading, you have to eliminate sub-vocalization. Basically, you take the information in without reading it and just let your brain just kind of take it in. So I figured out I'm a slow reader because I tried to learn speed reading. But what I know is I do sub vocalization. And the reason why I do sub vocalization is that means when you read Mary has a little lamb, even if you don't read it out loud, you read it to yourself in your brain. So you'd be like, Mary had a little lamb. Right. So how that works is with your mind, you have to read it way slower. But in my mind, I'm vocalizing it to myself because I'm an auditory learner.

[11:23] Marcus Carey: So I read super slow, but I take it all in. And so that's something that I know about myself. And also, since that's a skill that I have, I can listen to audiobooks and retain at a high level because I'm an auditory learner. So to me, I can listen to audiobooks and I can learn a lot. So when I say you have to learn how to learn, what I'm talking about is that everybody learns a different way. What you have to do is you have to figure out how you learn And then you're going to be able to take in more information faster, whatever way they be. Because you can't learn how Marcus learned because everybody's wired different.

[11:59] Ayman Elsawah: Right.

[11:59] Marcus Carey: So if I say, hey, man, it's a good audio book, blah, blah, blah. That might not be your thing, right? It may be a CBT, a computer-based training course, right? And, you know, there's stuff like Cybery. There's stuff like all these different blog posts. So everybody learns in a different way.

[12:15] Ayman Elsawah: Learn Python the hard way, right? Like doing it, you know, the hard way, for example, by hand.

[12:19] Marcus Carey: Yeah, yeah, yeah. And again, if you're a kind of learner that you learn by doing, some people say I learn it by doing, or you can learn by seeing somebody else do it. If I see somebody do something, I can recreate that. That's how I am. So what you have to do is you have to position your learning around how you learn best. And there's a lot of different ways to do that. And then maybe like doing Python, like how do you learn Python? Well, some CBTs will give you a sample of code and then ask you to do it. Maybe that's your way. Or maybe you can just watch somebody on YouTube doing Python. If you're a visual learner, you can learn well from that. So my thing is nobody can tell you how to learn as good as yourself.

[13:00] Marcus Carey: So what you have to do is you have to take note. I didn't know anything about self-vocalization until I tried to learn a speed read, right? Because my whole thing is how do I learn best? How do I take in more information faster? And so that's what kind of like guided me down this path. So now I'm like a finely tuned weapon when it comes to learning fast. And doing things like that, because I know exactly how to learn. I know I need to get, I can get an audio source, like audio book or whatever. I know that I can go to YouTube and watch somebody do something. And then all of a sudden, snap, I got another skill. And that's how I learned.

[13:34] Ayman Elsawah: That's nice.

[13:34] Marcus Carey: That makes sense?

[13:35] Ayman Elsawah: Yeah, that's nice. Yeah, I never really heard sub-vocalization as a term before, but I've always, I guess, internalized it. I'm kind of the same way. If it's a regular book, like say, I don't know, a Malcolm Godwell book or whatever, I can listen to an audio. But if it's a technical book, I find it difficult in audio and I kind of need to read the words, right? So I've learned that myself, but it took me some time to figure that out. But eventually I got that. I say, yeah, that's really good.

[13:58] Marcus Carey: Also, there's one more thing I can add on to that.

[14:00] Ayman Elsawah: Absolutely.

[14:01] Marcus Carey: Another trick that you do is like, even if it's a technical book, I can tell you the book that I'm going through right now, it's quite technical. And this is related to information security. So there's this book called How to Measure Anything in Cybersecurity Risk. It's a cybersecurity focused version of how to measure anything.

[14:16] Ayman Elsawah: Yeah, I'm reading that right now too.

[14:18] Marcus Carey: Cool. So what I do is I get the audio book, right? So for all the background stuff, you can just listen to. But from the technical content, there's some, I got the audio book and I have the freaking physical book.

[14:29] Ayman Elsawah: Oh, okay.

[14:29] Marcus Carey: Yeah. So there's tons and tons of stuff that is background informational that can be conveyed word of mouth. This is like old school, you know, this is where, funny enough, this whole word of mouth thing is how humans first started to become, you know, smart.

[14:45] Ayman Elsawah: Right.

[14:46] Marcus Carey: And pass along information. And so that's why when you go to a conference, that's why everybody's like from a travel perspective, that's why everybody's in the halls talking because that's how we do it. Right.

[14:56] Ayman Elsawah: Right. Absolutely.

[14:57] Marcus Carey: But this book, right, how to measure anything. So what I do is I listen to all the background information. And then when I zero in on formulas and math, that's when you need to actually look at it and do it.

[15:08] Ayman Elsawah: Yeah.

[15:08] Marcus Carey: So it's kind of a hybrid approach. And that's how I consume stuff so fast. It's like, OK, cool. I know that I can listen to all this stuff. If they're talking about theory, I can take that in. Then when it comes to math and the formulas and equations and stuff and anything they cite, then I'll just go look up. That's actually real, real good stuff. But I'll tell you how good I am at this. And this is not bragging or anything, but this is how good I am at learning stuff. So back in the Navy, there was these things called CLEP tests. And a CLEP test is a test that you can take for college credit. Now, most colleges have these tests, but sometimes they don't tell you that you can take these tests.

[15:47] Marcus Carey: So in the military, these tests are free. And so these tests could be over history, science, whatever, right? And so if you go to college and you want to test out of the class, if you did test out of class, you probably took the CLEP test. Put it like that. So what people don't know is there's hundreds of these tests. These tests cost about $100, and you just go take the test, and it's worth college credit.

[16:08] Ayman Elsawah: Oh, wow.

[16:09] Marcus Carey: Right? Most colleges take $30 to $60, and this is important, too, because anybody out there that did a lot of credits, they can actually finish that degree by taking these tests that I'm talking about now, and that actually can help them break into security. If a degree is required, and, oh, snap, I did all this college, so if I didn't finish, look at CLEP test, C-L-E-P. So what I did is I did over 115 credits on CLEPs. So that's 115 credits. That's a college degree, pretty much, by me reading and digesting information and then going to take a college-level test for it. And they were all free because I was in the military.

[16:45] Ayman Elsawah: I see. So these club tests are open to the public. Anybody can take them?

[16:50] Marcus Carey: 100%. Okay. There's this other thing called DSST. Okay. And there's a thing called Excelsior College Examinations. So those three things, anybody can take them, but nobody has heard of them before. And there's a lot of people that went to college for two years, but didn't get their degree conferred or whatever. But you can still go back and do that if that's something that you need to do. I see this a lot and I help people out, you know, get them on that path. But here's the deal. How did I learn those subjects? This is the most important part. So how did I learn those things is because there's these information sheets that come with all these tests and the information sheets tell you what to study.

[17:26] Marcus Carey: So I could go to the library based on the information sheet and read what it wants me to read. I mean, what I need to learn, right? And then I would just go take the test. And these tests even tell you the percentage breakdown on the actual test. So it would say 50% this, 20% this, 10% this.

[17:46] Ayman Elsawah: Wow.

[17:46] Marcus Carey: So what I'm going to do, I'm going to study the 50% that matters.

[17:50] Ayman Elsawah: Yeah.

[17:50] Marcus Carey: And I'm going to know that's the whole. And as far as security goes, like, okay, cool. I did that. I took those tests. It should be impossible for anybody to do bad on an interview. And the reason why I'm telling you this, the two parts of the interview are things that an employer says that they need for the position. That's one part. And those are wrecks on a website somewhere. It tells you what you need to know.

[18:13] Ayman Elsawah: Right.

[18:14] Marcus Carey: Now, I would not pay attention to the, don't pay attention to your experience and all that stuff. What you pay attention to is the stuff that they're saying that they need you to do when you get onto that job. All right, so cool. I need to know that stuff. I need to be able to speak to that. So I would say, look at those recs. Understand what's going on in the rec. I would say give yourself a couple of weeks. Usually jobs, these type of jobs that break into security from a SOC analyst or whatever, those are evergreen positions that they're always looking for, right? Get the rec. Understand everything on the rec. Play around with technology related to the rec. So if they say intrusion detection analyst or intrusion detection, what I'm going to do, I'm going to go download Snort.

[18:56] Marcus Carey: And I want to play with Snort. And I want to do every Snort tutorial I see. If they say something like packet analysis, I'm going to download Wireshark. And I want to get everything. I want to know everything about Wireshark. I want to be able to do custom Snort rules to make it do IPS stuff.

[19:09] Ayman Elsawah: Right.

[19:09] Marcus Carey: I'm going to download Bro. I'm going to do Terracotta. I'm going to do like whatever. All that stuff's free. And it's telling you what they're expecting on the rec. Right. So that's one part of the interview. Know what they want. The second piece is this. Your resume should be tight as a mug and you should be able to tell everything in your resume. Like I've interviewed people before and they didn't know anything that was on the resume. Right. I'm like, what the frick? Like, okay, you did this. You have this on your resume. Can you tell me about that? And then they're clueless about the tech on their resume. There's no excuse for that. So what I tell people to do is this. Look at the rec. Tailor your resume to the rec.

[19:50] Marcus Carey: Reverse engineer the resume. My teacher told me one of the most powerful things ever when I was growing up. She said, like, hey, to answer a question, take the question and make that into the answer. And nine times out of 10, whoever grading your paper won't be able to tell the difference. And what I mean by that is this. I'm saying like a question on background, like definitely taking a test. You take whatever the facts are, because there's facts contained in the question. And then you make that question into an answer and you add additional facts. You know what I'm saying? So if somebody says that they need intrusion, if somebody needs somebody from your IDS, And it has that language on the freaking rec, I would say something, something, something, something.

[20:31] Marcus Carey: I would take the words, flip it around, and then I would make sure when I get into an interview that I can speak to whatever that is.

[20:37] Ayman Elsawah: Right.

[20:37] Marcus Carey: Now, you don't have to really have experience on IDS. I mean, like, real-world experience. But you can say, have developed custom snort rules, custom whatever, whatever, right? You can say that on your resume.

[20:49] Ayman Elsawah: Yeah, find experience in your life that you can put on there, right?

[20:52] Marcus Carey: 100%.

[20:53] Ayman Elsawah: In a truthful manner, obviously.

[20:54] Marcus Carey: 100%. Because you don't have to be working those positions to get that knowledge, is what I'm saying, right? And so it's fairly easy to see what the rec is, learn the stuff in the rec. That's exactly what I did when I took all those tests. I didn't know nothing about money and banking and what fiat currency was versus this kind of currency and gold back standard and all this crap was. I'm from the hood, man. I don't know none of this stuff, right? But I went to the books and learned it, and then I was able to regurgitate it for the test. In the real world, interview is the test, right? So it's easy to go get Wireshark and learn TCPIP upside down. You can take all these courses. You can take all this stuff.

[21:34] Marcus Carey: So you're not lying that you possess the knowledge. You're not going to say you did it for two years and such and such. You're going to say I taught myself. Now, what's more impressive, me sitting in some other sock or some other crap Or somebody that takes the motivation to go learn these things on their own, right?

[21:50] Ayman Elsawah: Yeah, having the self-initiative, right? Having the self-taught initiative.

[21:54] Marcus Carey: 100%. And so my superpower is my ability to learn and teach myself.

[22:00] Ayman Elsawah: Let me ask you then. So there's learning, okay? But then you mentioned you took an aptitude test when you went to the Navy, right? And for getting into information security, there's a common understanding that we need the aptitude, right? For information security and also the Spark, right? There's a talk about the Spark and all that kind of stuff. So what would you say for folks that want to get in the field but don't know whether they have the aptitude to get in it or whether they have the Spark? You know, how would they kind of formulate that or discover that on their own?

[22:30] Marcus Carey: Yeah. So I think aptitude allows people to learn stuff faster. And that's it. I think the military requires you to learn stuff fast because, you know, you go in and you have to learn stuff fast because you go into different duty stations and you have to learn stuff on the fly real fast. So the job that I did in the military required a high aptitude because I have to just learn fast. So... You mentioned Malcolm Gladwell earlier. That book, Outliers, it talks about if somebody practices long enough, it'll be impossible to see who's really talented versus who put in the hours of grinding. So I think if you're focusing on a narrow subset, like we're talking about, like I'm talking about, it's focusing on a specific set of skills that are kind of evergreen.

[23:15] Marcus Carey: And if you work that long enough, it doesn't matter your aptitude, you can become an expert at that. And what people will, anybody that knows anything about that subject matter will say that this guy, this girl knows their stuff. That's what you have to focus on. You can't focus on everything because there's people out here that are celebrities and they act like they know everything. Right.

[23:35] Ayman Elsawah: Yeah.

[23:36] Marcus Carey: Don't be one of those people. Focus on a narrow subset of stuff and master it.

[23:40] Ayman Elsawah: Right, right. I would even say try to find the latest stuff. Like right now, and I think it's tweeted about this, if you try to learn Kubernetes security or anything cutting edge, that could probably put you ahead of the pack, right? So be able to see what's coming on the pipeline and focus on that as well might give you an edge. What do you think about that?

[23:57] Marcus Carey: I agree. And so what I agree and I agree on this kind of like on a partial level.

[24:02] Ayman Elsawah: Right.

[24:02] Marcus Carey: So what I think and what I know to be true is if you learn certain basic things, that's going to transfer throughout whatever, no matter what you do. So I would say if you learn Linux basics and how to harden a Linux system, that's going to apply to anything you're doing, whether it's Docker, whether it's Kubernetes, whether it's whatever. So you learn principles that are going to take that matter no matter what. IP chains, whatever. There's a whole bunch of stuff that relates to no matter what kind of thing you're doing.

[24:32] Ayman Elsawah: Oh, absolutely.

[24:33] Marcus Carey: Internetworking.

[24:34] Ayman Elsawah: Yeah.

[24:34] Marcus Carey: Like just be good at that. Right. And then.

[24:38] Ayman Elsawah: Learn the basics first. Yeah.

[24:40] Marcus Carey: And then you can be a beast incremental knowledge. So Kubernetes is incremental, Amazon, whatever, whatever, all that stuff's incremental knowledge.

[24:47] Ayman Elsawah: Right.

[24:47] Marcus Carey: But like have a really solid base if you want to be a security professional.

[24:51] Ayman Elsawah: That's well said.

[24:52] Marcus Carey: Yeah. That's how I look at it.

[24:53] Ayman Elsawah: That's cool. You have a bunch of mentees from understand, right?

[24:56] Marcus Carey: Yep. Yep.

[24:57] Ayman Elsawah: That you're working with.

[24:58] Marcus Carey: Yep.

[24:58] Ayman Elsawah: So can you tell me about what you're seeing some common mistakes out there from your mentees that, you know, are probably happening out there at scale?

[25:07] Marcus Carey: I think that a lot of the confidence is something that I help bring to the table. One of the things that I do is I have to convince them that they're amazing.

[25:17] Ayman Elsawah: Yeah.

[25:18] Marcus Carey: And so that's what I try to do. Funny enough, what I see is I see I have women and men that I help. A lot of times the women are like way more qualified than the men are. They got degrees, they got certifications. And they don't have the confidence sometimes. And I'm like, are you kidding me? You're more qualified than I am. Right. Like, what the heck? Yeah, the confidence is what I help people with a lot. One of the things that I've been helping people do is like negotiate salaries and get raises and all this stuff. And it's just confidence that I help people out on. You know, being raised in a country like I was raised, I kind of approach stuff at a simple elementary level. And I think people overthink a lot of things.

[26:00] Marcus Carey: So I help them break it down and just have more confidence. I think that's what's missing a lot of times.

[26:05] Ayman Elsawah: Okay. Okay. And is there something for those listening out in the country or those in places with less resources, for example, or those that are people of color, anything like that, what would you recommend to them in leveling up?

[26:18] Marcus Carey: Yeah, I think that all around, kind of like what's funny about technology is that I think like being a person of color, because I'm black, so I think that people need to know that there's other people I heard that have done stuff and are doing stuff. I also encourage more people that have been successful, whether it be women, people of color, or whatever, to reach back and try to help other people out and try to connect with them and help them out. I think that's the big part. I think that sometimes... People think that there's scarcity of resources. And I think that's the biggest myth going on in the world right now is how there's some kind of scarcity. We have more food than any time ever in the world.

[26:58] Marcus Carey: We have more medicine than any time in the world. We have all these different things. But if you listen to certain people, you think that there's some kind of scarcity of resources and all that. Where the truth is that we have an abundance of everything. There's jobs to go around. There's money to go around. There's everything there is. So what I would encourage people to do is to be more active and proactive on being a mentor. And so you don't have to wait till you make it to be a mentor and to help people out. That's the thing that I would say. And so no matter how successful you think you are, if you got a job and somebody else don't have a job, then that's an opportunity for you to mentor and help them get a job.

[27:35] Marcus Carey: You know, I have a company called Start companies. Or I'm helping people get jobs. I'm helping people negotiate their salaries. Like recently, I had a guy... Get a 70K raise. Help somebody else get like 15 more K than they were offering them. So you don't have to wait until you're a billionaire to make it. Hopefully I'm a billionaire one day. Incrementally, you can always be helping people. So I think that's what's going to help us out ultimately. And have confidence. Have the confidence, people. No matter where you're at, whether you're white, black, blue, whatever, you have the confidence that you got this. Because there's a lot of people out here that are faking to fold out a bill and they out here doing it.

[28:14] Marcus Carey: So why can't you?

[28:15] Ayman Elsawah: That's right. You know, sometimes it has a counter effect where there's so much information out there. There's so much. And all we see are the superstars out there. And it kind of makes us feel small. And we kind of lose confidence. We're overwhelmed by everything that's out there, you know. So just kind of taking a moment to step back and saying, okay, let's just take it step by step, step by step. Might be the way.

[28:36] Marcus Carey: Yeah, bro. That's our role. Everything is super simple. Even though stuff is complicated, break it down to a simple element. Look at the job rec. Look at what a job that you want. That may be only asking you to do four things well. You may know two or three of them already. Get the fourth one down. Rewrite your resume to look, reverse engineer the dang rec, and go get that dang job. And negotiate for the highest salary. Pro tip on negotiating salaries. Go to Glassdoor or some other thing. Whatever the highest salary is on there, that's what you ask for. People be asking for like the bottom range or somebody goes in and HR tells you, oh, it's 80K job. I'll go on Glassdoor. If Glassdoor say it's 115, that's what you ask for.

[29:23] Marcus Carey: There's a book called Never Split the Difference Unnegotiated. Everybody should check that out. Y'all tripping if y'all ask for it or believe whatever HR says.

[29:31] Ayman Elsawah: Yeah.

[29:32] Marcus Carey: Don't do it.

[29:32] Ayman Elsawah: And never give out how much you're making also.

[29:35] Marcus Carey: Yep.

[29:35] Ayman Elsawah: What I would say too. California has a really good law on that now, but not the rest of the US.

[29:40] Marcus Carey: Yeah, that has nothing to do with you. You want to be paid commensurate to your current skill level. And this is what you think it works. I think I'm worth 115. Yeah, but it's only 80. My number is 115.

[29:52] Marcus Carey: Now, what's going to surprise you if you never did this before is they will come back with a dramatically higher number typically. Or if they don't value you, why are you there in the first place?

[30:01] Ayman Elsawah: There is something to be said about that first security job where we can't really negotiate that much, right?

[30:07] Marcus Carey: I don't believe that, bro.

[30:08] Ayman Elsawah: Oh, yeah?

[30:09] Marcus Carey: No.

[30:09] Ayman Elsawah: Okay.

[30:10] Marcus Carey: No, I think people are hosing themselves, man. So, I mean, hopefully if you listen to this podcast, my Twitter is at Marcus J. Carey. Hit me up on Monday for advice if you're scared or if you're uncertain or whatever the feeling may be. And I will help you negotiate yourself like square business.

[30:28] Ayman Elsawah: That's awesome.

[30:29] Marcus Carey: That's great so there's no such thing in that so you're not getting paid because this is your first opportunity in the door you're getting paid based on the value that you're bringing to the table right and so when i worked at nsa man a lot of the people that i worked with nsa were clueless but they were making a lot of money now it didn't matter if it was their first second third fourth fifth job right they were clueless gotcha Like 100%. Some people only had one job and it was like pushing a button or something. Wow. I'm not even exaggerating, bro.

[31:00] Ayman Elsawah: George Jetson, huh?

[31:01] Marcus Carey: I'm not exaggerating at all. So what I would encourage y'all to do is you're way better than the people that are already working where you're at. Don't think that they know anything because when you get there, you're going to be surprised that they're clueless. So, and this is just real talk.

[31:16] Ayman Elsawah: Yeah. I'm glad you're laying it out and that's why we're here for, right?

[31:19] Marcus Carey: Don't think that they know something more than you do.

[31:22] Ayman Elsawah: Mm-hmm.

[31:22] Marcus Carey: Because you're going to get there. You're all motivated to learn and all that stuff. You're going to get there and like, oh, snap. Nobody cares.

[31:29] Ayman Elsawah: Right.

[31:29] Marcus Carey: But do not let them people out there make you feel less like you don't have to learn or you don't have to grind. Because what you're doing, you're still the same thing. You're grinding, you're learning, you're improving. And then that's going to set you up for more opportunities. Let them be lazy and you grind. Because you're going to figure this out real quick once you do get in the field.

[31:47] Ayman Elsawah: Okay. So let me switch topics for a second. Do you have any interesting war stories out there that you've run into? I'm sure you have a lot. But anything fun that you could share from your days anywhere, really?

[31:58] Marcus Carey: Well, I would say that I've built a lot of stuff. So one of the things I built, I built this thing called Threat Agent. This was a couple of years ago. And people still ask me. So I built all kinds of stuff. I built this thing called Honey Docs. I built a lot of stuff that other people have kind of like written tools like this before. I wrote tools that could kind of track people by doing like these little, I think they call them honey tokens now, but I came up with this thing I call HoneyDocs. OK, so basically I had some people that were like, you know, white hat hackers were using it to track people on Twitter. They would put these things in jihadi forums and they would track terrorists. And also I got a contact at some point for some foreign police officers and they were using it to track people that were pulling people for ransom, kidnapping and stuff.

[32:47] Ayman Elsawah: Oh, wow.

[32:47] Marcus Carey: So it blew my mind that whatever you do and if you write tools and all that, you never know who's going to use them for good or bad. And so what that made me learn is because a lot of people have this thing like, you know, white hats are writing out, you know, they're writing all these exploits and all that stuff. But it feels good to hear people when you hear from law enforcement that they're actually saving people's lives based on some of the stuff you wrote and you didn't intend for it to, you know, you write it for some other purpose. That's where you're a hacker, you write something, and then other hackers figure out different ways to leverage what you're writing. So never be surprised on how your work turns out to be used for good or bad.

[33:29] Marcus Carey: There's going to be bad people to use your stuff, but hopefully there's enough good people out there. If you're actually saving people's lives and finding people that are kidnapping people, that actually blew my mind that my stuff was being used to do that.

[33:41] Ayman Elsawah: Well, there's our lesson to learn from that, I would say, is to share your work, right? I bet you a lot of people have some good tools they've written or whatever it is, but they haven't shared it online with the community. And they'll have a twofold effect, right? Someone as an employer could see that, but also have the second effect that you mentioned as well. What do you think?

[33:58] Marcus Carey: Yeah, 100%. Like if you're doing work out there, and this is another thing, thank you that you brought this up. So as you go throughout, if you're looking for a job, one of the best ways you can do is to be able, again, take that job rec and then demonstrate how you've mastered the subject matter related to that rec. By blogging or writing tools or whatever, show externally that you've mastered those concepts in some way. Blogging is great contributing to open source repos maybe documenting open source stuff and don't ever worry about somebody already put this information out there right do not worry about that at all that's what a lot of people say oh this is elementary blah and worrying about how people don't think they look dumb because they said that you're always going to be an expert to somebody that's like not as advanced as you are right now in your career

[34:50] Marcus Carey: You're going to help somebody out just by sharing that information. Now, there could be 10 blogs on that same topic. You blog it, write it your way, put it in your voice, and I can guarantee you're going to reap the benefits out of sharing information. Some people believe in karma or whatever. You put out good in the world, and there's going to be good to come back at you. So 100% share everything as much as you can, as much as you can do. Again, if that job title is intrusion detection person, blah, blah, blah, you can put on your resume, like blog post, boom, on IDS. So 100% share as much as you can.

[35:28] Ayman Elsawah: Yeah. Yeah. I think I was in the same situation. I'm kind of was, am still whatever you'd say, but I haven't posted things that I've done either simple things or elaborate scripts and tools I've created. And now I'm trying to teach myself to do that, you know, more often. So for that simple reason, you know, Oh, somebody probably did that already. Well, not really. So yeah, I'm glad you summarized it like that. So do you have any interesting stories from your, say intrusion or incident response days or anything like that?

[35:55] Marcus Carey: Yeah, I got a quick story. So I was working at this one government place. We were doing SOC-type work. And so one of our analysts went rogue and tried to hack back.

[36:06] Ayman Elsawah: Oh, wow.

[36:06] Marcus Carey: And he ended up hacking an oil company.

[36:09] Ayman Elsawah: Wow.

[36:09] Marcus Carey: So the oil company was compromised, and it was attacking one of the government agencies. But it was bad guys, of course, at the oil company. So then the government agency ends up looking like it's attacking an oil company. Which was bad. So it was an international company. That was crazy. And that's a really nice tidy war story. I can't name names or agencies, but that's it.

[36:31] Ayman Elsawah: Right. That's all you're getting from me. Right. Yeah. So without falling under the insider threat category,

[36:37] Marcus Carey: Yeah, two things. Sometimes your employees are going to go rogue, and hopefully you can detect when they do. And also the hacking back story. Hacking back is talked about all the time. You can hack them back, blah, blah, blah, and it's cool. But what the problem is, you might hack back the wrong person. So that's the two stories from that.

[36:53] Ayman Elsawah: Wow. Lessons learned. Thanks for sharing. So you mentioned CLEP earlier. College degrees, certifications, all that is a controversial issue. What are your thoughts on that from what you found from your mentorship and everything that's out there? What would you say to that? Because it's not for everybody, but what are the two cents you can add for college and certifications?

[37:15] Marcus Carey: All right. So I think that college certifications, blogging, GitHub repos, all these different things can be used for proof that you know what you're talking about. One of my most successful mentor type situations is my oldest son. My oldest son is a senior software engineer for Rapid7. He did not go to college. And so since he's my son, he did grow up around me. He did grow up around computers. But his gift was being a software engineer and writing code. And so Rapid7 hired him when he was 16 years old. And he's been working for them for about six years. And he didn't go to college. He didn't have no certifications or nothing. No. But what he did have is he had tons of code. He wrote six iPhone apps.

[37:59] Marcus Carey: He had all kind of GitHub repos. He wrote a Metasploit API kind of thing for the iPhone back in the day where you could run, you could export stuff from, Yeah, so he did a lot of cool stuff, and he got hired. But what was his calling card? His calling card was he built all these apps, he wrote a couple of hacker apps for the iPhone, and he had a ridiculous GitHub from all kinds of stuff. So you have to be able to prove that you know what you're talking about in some kind of way. The interview could be a way to do that for an employer, but blogging, GitHub, certifications.

[38:36] Ayman Elsawah: It's a package, basically.

[38:39] Marcus Carey: You don't need one but i'm so i'll tell you like i'm black of course so what i thought growing up everybody told me if you're black you have to get an education like real talk like dr martin luther king and all that stuff main thing they were planning for is education for black kids and i grew up with a time frame where if you don't get education you're not going to get hired right and so that's kind of like that's the main thing where i got my education i got a master's degree in network security Do I think that you need a master's degree? I don't know. I don't think it hurts me. I don't think you need a master's degree, but I think, you know, being black, I need as many dang things as I can get.

[39:20] Marcus Carey: I can't even lie. Right.

[39:21] Ayman Elsawah: But if you're going to go into debt or, you know, if it's an extreme hardship for you, there might be other paths. Right. Is that what you're saying?

[39:28] Marcus Carey: I don't think you need it. I do not think you need college. Right.

[39:31] Ayman Elsawah: Yeah.

[39:31] Marcus Carey: I don't believe you need it. But I think it's different for certain people. I think it's different if you're black, 100%. I think if you're black, if you're a minority, I think you need as much stuff as you can get. I mean, that's the square business. So my son is biracial, but he had me. So, I mean, my son is like super privileged, right? So I got that.

[39:54] Marcus Carey: So, I mean, not to say I'm amazing or whatever, but, you know, his dad's well-known.

[39:59] Ayman Elsawah: Yeah.

[39:59] Marcus Carey: He has access to computers. He knew how to code when he was freaking 11. Like, come on now.

[40:04] Ayman Elsawah: He's a mentor of mentors, right?

[40:07] Marcus Carey: Yeah. So now what we do is we say, okay, cool. Any black kid out of the community just up in the cybersecurity pro, it would take a lot of stuff. People believe I'm awesome because I worked at NSA. So I have privileges and stuff that made it so I'm here where I'm at. But me knowing NSA, I know that's not a big deal. That's not a big deal to me. When I see people that worked at an agency a lot of times, when they tell me they worked at an agency, it doesn't mean anything to me.

[40:38] Ayman Elsawah: Interesting.

[40:39] Marcus Carey: I'm a former CIA. Okay. Whatever. What does that really mean? That doesn't mean you know what you're talking about. I want to encourage people. Everybody is unique. Everybody has to bring their own thing to the table. Bring you to the table. You're unique. You're amazing. Bring it to the table and let the chips fall where they may.

[41:00] Ayman Elsawah: Absolutely. That's great advice. So tell us about your company today and then what it does.

[41:05] Marcus Carey: Okay, so my company is called ThreatCare. What we do is we help companies build, measure, and maintain their cybersecurity programs. Because if you look at it, funny enough, a lot of people are not doing really good at cybersecurity overall.

[41:18] Ayman Elsawah: Hmm.

[41:20] Marcus Carey: And so we see this all the time. So what we do is we help people, you know, put a program in place and we help them test it, what we call breach and attack simulations. So we imitate hackers on networks so organizations can see and defend against it. So that's kind of like what we do in a nutshell.

[41:36] Ayman Elsawah: And what made you start it?

[41:38] Marcus Carey: I personally had a lot of frustration with the security industry as far as the vendors go. The vendors make a lot of stuff. They sell a lot of stuff. But at the end of the day, from a risk perspective, risk is actually decreasing. And so what I want to do as a company is I want to be able to try to measure that. And remember I told you the book I'm reading? Everybody should read that book, How to Measure Anything in Cybersecurity Risk.

[42:02] Ayman Elsawah: Mm-hmm.

[42:02] Marcus Carey: How do you really measure that? And how can you prove that you're secure? You put a firewall on your network. Oh, does that make you secure? You put an endpoint protection on your system. Does that make you secure? So, you know, nobody knows. People are doing all this stuff, but they don't actually know if it's moving the needle as far as being secure. And so at our company, we help people test that out by doing bridge and attack simulations. And from there, you can tell whether it's really working or not.

[42:28] Ayman Elsawah: That's good. And for someone getting into infrared security, is there a way they could use your product to learn or is it mostly just geared to enterprise folks?

[42:36] Marcus Carey: Yeah, 100%. You can go to ThreatCard.com and you can download our free tool and you can run breach and attack simulations. This would be a great way for you to use something like Wireshark, Snore, whatever, and you could actually try to see if you can detect the intrusions that we create.

[42:52] Ayman Elsawah: Okay. That's awesome. Well, Marcus, thank you for sharing today. I think you had some really good wisdom to share with everyone and I look forward to talking in the future.

[42:59] Marcus Carey: All right. Thank you very much for having me.

[43:01] Ayman Elsawah: All right. Thank you.

[43:04] Ayman Elsawah: Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.