Getting Into Infosec, Episode 4: Matt Toth - From Slinky Network Support Engineer to Security Sales Engineer
Published October 30, 2018 · 63 minutes
Episode page: https://www.gettingintoinfosec.com/episodes/matt/

[0:00] Ayman Elsawah: Hey, everyone. Welcome to another episode of Getting Into Information Security. I'm your host, Ayman Elsawah. So I want to step out of character for a second, just talk about why I started this podcast series. On a constant basis, I was getting asked, you know, how do I get into the field? And, you know, what do I need to do? The thing is, everybody's way into the field is different. And so by learning all the different ways that people have gotten into the field, I'm hoping that you will relate with at least one or more of my guests. So that's the idea that we're trying to do here, right? Because there's so many different ways to get into the field and not necessarily a linear way as some other fields.

[0:44] Ayman Elsawah: So I hope you benefit from this. You know, just let me know. Thanks. Today's guest is Matt Toth.

[0:51] Matt Toth: On my way out to Blackout this year, I watched Hackers on the Airplane and it was freaking me out because I'm like, all of the attacks that they're doing, they're performing, they're talking about are real world attacks that we're dealing with today still. Denial of service attacks, IoT attacks, right? That's a huge thing right now. They don't have things.

[1:09] Ayman Elsawah: Matt is a senior security engineer at Splunk with over 20 years of experience in IT and a focus on cybersecurity. Working with the U.S. Department of Defense, he has led teams in cyber war simulations and has advised senior leadership on new attack vectors and threat actors. With a passion for security, Matt is deeply engaged with the community to educate and prepare the next generation of cyber warrior. We get into some deep and philosophical topics.

[1:34] Matt Toth: It doesn't hurt to get them. If you have the capacity, I mean, if you're going to be spending a crap load of money out of pocket, maybe then you can, you know, wait on it. A lot of companies that will say, oh, you're interested in this, you've already studied up on it. Yeah, we'll pay for the test. Go for it. As well as some not so serious, but informative nonetheless. Kind of funny. It's hard for me when I see people saying, oh, well, don't go get these things, because Normally somebody who's been around the industry a long time, they don't see the value in it Anymore because they've already established themselves. But from a straight up payday, getting hired, if you have the capacity, especially if a

[2:07] Matt Toth: Company's paying for it, knock it out of the park.

[2:11] Ayman Elsawah: As well as some not so serious, but informative nonetheless. Kind of funny.

[2:16] Matt Toth: Their AI was a room full of analysts in the back of their shop, just going through and doing things. There is.

[2:22] Ayman Elsawah: He also has a blog at hacktheplanet.org. Matt is one of my oldest infosec friends and an all-around good guy. We covered what it means to be a sales engineer and how he got hired in the infosec field. Hi, Matt. Thanks for joining.

[2:35] Matt Toth: Oh, thanks for having me. It's always good to get together with your friends.

[2:38] Ayman Elsawah: I agree. I agree. Yeah, thanks for making the time. I think it's nighttime for both of us, so it should be interesting. We don't have to worry about any distractions, hopefully, right now. So you are a senior sales engineer at Splunk. Maybe for my audience, maybe you could give them a little insight as to what the life of a sales engineer is.

[2:58] Matt Toth: Absolutely. I started at Splunk just about five months ago. I've been doing security sales engineer work for the last... Maybe 11 years now. Been doing IT for over 20. Started off as a little network support engineer, which meant I was thin enough and light enough to pull cables through the ceiling. But moved up and was working in security. And then I talk a lot and I was at a startup. They're like, hey, can you help the sales guys? So I popped over there to start helping them out as a sales engineer. And I didn't know really what that meant at the time. What I found out is basically it's, you're still an engineer. You still have to be highly technical because you are the trusted voice for your company.

[3:40] Matt Toth: When you go out and meet with customers, they look at the sales guy and they say, okay, I know he's here to close the deal, right? That's his job. The engineer is here to make sure that this fits my environment. They're kind of my advisor from the company side, right? They're going to help me make the right decision. And sometimes you do have to work with your sales team to say, this is not the right place for this. Because the worst thing you can do is sell something that doesn't work, right? So your job is to understand the customer's environment, understand your solution, and then make sure that it's an actual fit. I've been pretty lucky. I think partially I've made good decisions, but I've worked at organizations that you can fit the product in fairly easily into the customer's environment.

[4:23] Matt Toth: There's a big need typically at the places I've worked. So I could success there. But again, it's that you're kind of the, I hate to say trusted advisor, because that's a word that gets overused. But it really is the, I'm here, the customer trusts me to be here. And that's I'm going to make sure that when they're done, they're happy with the situation so that they never come back and say, hey, dude, you screwed me over.

[4:48] Ayman Elsawah: I think the sales engineer position is often overlooked from a sales cycle and from just all angles. So you did mention that it is highly technical. And I'd like to maybe help illustrate for the audience how technical you do have to become or you do have to be For this role right there is a misconception and feel free to correct me that you know sales engineers are not really technical so i mean there's nothing worse than buying a product that doesn't fit for your environment or you know buying the wrong license or whatever it is so maybe you could go into the technicalities of like how technical do you really have to be i think you mentioned you're you even have to set up a poc this week is that right

[5:30] Matt Toth: Sales engineers actually typically have to be the jack of all trades. You have to understand networking. You have to understand endpoints and not just Windows. You have to understand Linux. You have to understand server environments. You have to understand how email works. You have to understand what new attacks are coming out from the security perspective. You always have to be updating your skill set. You have to know... What's coming down the pipe for your customer, right? You can't just go in and say, well, I know my product and that's enough. You really have to have a really solid base knowledge. So when you go in and you're working with a customer and they say, well, hey, we're running Palo Alto Firewalls with the Wildfire malware sandbox, right?

[6:12] Matt Toth: And we're running Tanium. And what we want to do is we want to see what that looks like in your product. Working for Splunk, again, we are a big data tool. We gather all of the different logs, network data, anything with a one or zero, we put that together, and then we help visualize it and correlate it. So, for example, something comes through, like, hey, this is malware. We see the visualization in our tool, we flag it, but we want to Work with titanium we're going to push that titanium and say hey now you go out and look across the entire environment and see if this hash is anywhere else in this network so you have to be able to integrate products you need to know i think it's really helpful if you know any scripting any programming at all you know some python or for those of us have been around a while pearl it's kind of died off a bit anything like that because you're going to have to work to be able to integrate it you're going to have to be able to have that kind of

[7:07] Matt Toth: Architectural mindset, right? You're going to have to be able to look and go, oh, this is how you built it. This is how we have to fit because everybody's environment's different. Even when you think, okay, well, one bank's going to look like another bank or one federal customer will look like another federal customer. They actually can be really, really unique. And so from a technical perspective, you have to have that solid base knowledge. And I think you have to have the passion to keep diving in, keep learning more, doing a lot of self-education. I know a lot of people in our industry like to use the word autodidact, right? I'm a self-taught person. But I think that you really kind of have to be, if you're not driven for it,

[7:47] Matt Toth: You're going to fall behind very quickly because it doesn't matter if you know your product. I mean, you have to know that you have to know in and out, but you have to know at least to a healthy level, all the other products that are on the market in your space, at least. Right. And then how those fit together. Working for Splunk, right? We work with everybody. Everybody can plug into Splunk, right? And so I have to understand firewalls. I have to understand other networking gear. I have to understand endpoints, like I mentioned. Servers, what looks normal? Hey, why is this person who's never created an account before creating accounts? You have to kind of understand that and understand how to look for that, right?

[8:25] Ayman Elsawah: Well, it's really key in a lot of security products in general is that the security products are really going in an integral part of, say, the network or the infrastructure, right? So, you know, not only does a security engineer need to know, I mean, it basically encompasses, you know, you're touching all these things and all these different networking groups and different departments are hesitant or wondering, you know, if your product can do the job or if it's

[8:55] Matt Toth: Well, you have to make sure that it can actually perform in the real world, right? Because a company who shall not be named, I have not worked for them, Was caught, it's an endpoint solution. They got caught during their demos, during their DOCs, handing people, they're like, oh, look at this, here's some data to run through it. No other vendor can catch this except for us. Come to find out it was something they had written a signature for. Even though they say they don't use signatures, this organization does. And they had done that, and they'd handed out this false file. Luckily, somebody saw it and called them out on it, but it's like... It's really kind of sad how the industry can work that way.

[9:34] Matt Toth: And so because of the way you have to integrate with everything else in the environment, because you have to know those things, you also have to know your competitors. You have to know what they're going to do, how they're going to behave, and then be able to coach or teach them. Because, I mean, that's a huge, huge piece is educating your customer. One of the briefs I'm giving this week is a threat intelligence brief. Here's all the bad things that are going on, right? So I had to go out and have to build this brief off of all of this collected data correlated together and say, here's cryptojacking is on the rise, significantly on the rise.

[10:07] Ayman Elsawah: Yeah, it is.

[10:08] Matt Toth: And then knowing historically, well, where did the cryptojacking come from? Well, it came from ransomware. Ransomware is still around. Where did ransomware came from? It came from scareware, right? Where you just get that little pop-up, you could hit the escape key. Most people don't know that they even have an escape key. You see that history, you know what's going on and you can move forward. But I have to be able to educate my customer on that. And I have to be able to do reading on that. I have to constantly keep myself up on that to make sure that I can educate them. I mean, you're kind of that teacher, trusted advisor, all those things together.

[10:39] Ayman Elsawah: What's a typical week for you like?

[10:41] Matt Toth: I don't know if there's a typical week as a sales engineer, to be honest. Depending on who your customer is, you may travel a lot. I travel pretty regularly. So you're going to be doing your normal calls. You have to do a lot of sales calls because you hold quota.

[10:53] Ayman Elsawah: You have to close business.

[10:54] Matt Toth: You have to help your sales guys close business. You'll have customers that have already bought reaching out saying, hey, I have a question because you are... As much as... You know, you're not supposed to be the first line of support. Oftentimes, there's like, hey, I'm seeing this. It's kind of weird. Have you ever seen this before? So kind of, again, responding to the customers, guiding them through it. If it's more than just a, oh, yeah, look here, you've got to solve, you know, guiding them through the support process, monitoring the tickets. Than getting in front of the customer, talking to them about what they need, building out environments for them, building out, if you're building a POC, it's sometimes you're going to have to take your hardware and sometimes they're like, oh, we have VMs.

[11:34] Matt Toth: But it's, here's what we're going to build. Here's what you want to see, right? Because we've talked, you work with them through that process. What do they really want to get out of the solution? Because you're there to solve the problem, right? Hey, I have this problem. Can you help me solve that? And oftentimes it's only partially technical, right? You're going to help them build processes into their normal day-to-day. You're going to help them build playbooks to say, If you see X, here's how you respond to it, which may be outside of your solution. I think it's helping them tune that in, seeing how you can help them, making sure you can, or guiding them to a solution that could. But it's all over the map, right?

[12:14] Matt Toth: Last week, I was on the East Coast. This week, I'm in Texas. Week after, I'll probably be somewhere else. We're running a workshop at an industry conference in Utah the last week of September and then going to a big user conference at Splunkruns.conf every year. We're running to that. So kind of that You're always going, right?

[12:35] Ayman Elsawah: Yeah.

[12:36] Matt Toth: You get done with your day and you're not really done with your day, put the kids to bed and have dinner, sit down and start reading. What did I miss today while I was doing email and while I was installing software and installing Kali on their VMs because they're not used to running it. So you can simulate attack environments and things of that nature.

[12:53] Ayman Elsawah: Yeah. How do you end up staying up to date on things?

[12:56] Matt Toth: I still use RSS and Twitter quite a bit. I'm a huge fan of RSS. Find a few different places that you can grab information from and then just be diligent about keeping up on it. Twitter is also really beneficial. Again, in our industry, you have some great people that you can learn from. So seeing what they're talking about and where they're going. One of the things that we're seeing a lot of is people want to start doing threat hunting. Where it's finding adversaries who've already penetrated their network, right? They've already broken through our defenses, and now we need to find them quickly. Because, I mean, the average length of a breach, I think we've got it down to like 180 days. I think it's what the industry standard is now.

[13:36] Matt Toth: But for a while, it was like over a year. It was like 400 days, I think, at one point, where the breach hadn't been detected. So one of the things I've been doing is making sure I have different groups that I'm monitoring, you know, different Twitter handles, different... Organizations, sites, and just trying to make sure I know everything I can about what the industry is saying about threat hunting. Because it's kind of a buzzword, but I think it's a very useful way to detect those breaches that your standard security systems haven't found. It has a human element into it, so it's training people up. You just kind of have to keep diving in every day.

[14:13] Ayman Elsawah: So one question I had about the sales engagement is, are you still engaged with the customer post-sales? Or does that hand off to another team? Is it different at different companies? Because I used to see pre-sales engineers and post-sales engineers. Now it's just sales engineers. So maybe walk us through what the engagement cycle is like.

[14:33] Matt Toth: Yeah, and I think it has changed a bit because as a pre-sales engineer, you're the face of the company to them, the technical face of the company to the customer. So previously, you'd have your pre-sales engineers, you'd go in. The salesperson I worked with a long time ago, who you know, said... Technical sales is like dating dudes. You go out, take them to dinner, make them like you, close the deal, and then you move on. I was like, oh man, that's very dark, but it's kind of hilarious. But I think it was some of that, where the mentality was, okay, you've closed the deal, now you move to your next deal. You have to maintain quota, you have to do these things. And then the post-sales engineers would come in and do the installation, do a lot of the training and things of that nature.

[15:20] Matt Toth: But I think because you are the first person they've met, they're going to call you all the time. Hey, well, can you come do this? Can you come help with this? You're the trusted person. So even if a post sales person comes in and we still have, and you still see that with professional services, right? You build that in where you're going to have people who know the product inside and out come in, do all of the installation for the customer, do the training, things of that nature. But the pre-sales engineer still has to be engaged. Because you're who the customer trusts. You're who they bought from. You're the one who sold it. And the sales guy can close the deal. They trust you that this is going to work for them.

[15:56] Matt Toth: And so I think you've seen that shift where it's definitely become a broader, you're not just a pre-sales engineer. You have to be able to do post-sales. You have to be able to do training. You have to be able to do those things. We use professional services, again, internal teams or contract teams, depending on who the customer is, what they want. And a lot of that goes into once the customer is kind of sold on the product, working with them on how they like to get it delivered. Because it's not cookie cutter. It'd be awesome if it was, but it's not. And so you have to go, okay, how do you want it installed? How many days do you need, right? Let's look at your environment. How many systems are we going to be looking at?

[16:33] Matt Toth: All of those things kind of go into it. And so you're kind of almost a project manager also, right? Helping get it done. Because again, if the customer is not happy, you're going to hear about it. I mean, they're going to go right to Twitter. They're going to go to all their buddies. And every future sale is going to be much, much more difficult.

[16:52] Ayman Elsawah: Yeah, you're responsible for making it work. So your face is on it. Yeah, that's pretty good. That's pretty good. Would you say that, what kind of personality does it take to be a sales engineer? Is it introverted, extroverted? I'm sure there's a lot of, and maybe a follow-up question is, what kind of person would a sales engineer, like transitioning into a sales engineer, how does one become one, for example?

[17:15] Matt Toth: Yeah, I think you can get, introverted people can do it. You just have to understand that you're going to be interfacing with people, right?

[17:22] Ayman Elsawah: Would you say it's safe? Like, it'd probably be a safer job for an introvert where, or like an introvert that is okay meeting people, like, because you're kind of on the wings of the account manager or the, right? Or the salesperson. So in a way, you know, you don't have to, you're just kind of riding along. What did you say?

[17:42] Matt Toth: Yes and no. So I think it depends on your account rep, because I've worked with account reps who are like, you are here just to have me confirm things off of you. I will let you know when you need to speak, like you're not running this. And then I've been with others who are like, hey, I'm not going to make it to that meeting. Can you do the entire thing by yourself? And you're like, yeah, I'm absolutely going to do that. And so it really comes down to your account rep's personality. Sales reps, I know some people have had bad experiences with them, but I've I've had great sales reps throughout my career. I mean, I've had a handful that were difficult to work with, but you figure out, okay, what type of person are they?

[18:25] Matt Toth: What are they trying to get out of this? And then you blend your personality to them. You have to be a little bit of a chameleon in that way. I'm kind of an extroverted introvert. I enjoy people. Large crowds can make me a little bit anxious, but at the end of the day, I like to retreat into my hotel room or office just to recharge the batteries a bit. I think from a personality perspective, I've met people who are pretty hardcore introverts who've been successful at it because they've been able to find a salesperson who matches them well.

[18:54] Ayman Elsawah: That's really good to know.

[18:55] Matt Toth: I've worked with quite a few reps, but there's a handful that I've worked for extended periods of time because we blended really, really well. Their abilities and my ability were able to just kind of make it a very successful teaming. You have to understand that you're responsible for your own success. You can't hide because you do have a quota, right? You can't just sit back and be like, well, you know, I'll close a few tickets. I'll do a little bit of this and everything will be great, right?

[19:25] Ayman Elsawah: So it's a team effort on the quotas between you and the account manager, right?

[19:29] Matt Toth: Absolutely, yeah.

[19:29] Ayman Elsawah: Basically. He's driving, but you're kind of co-pilot. Yep. Navigator.

[19:33] Matt Toth: Absolutely. It's great, though, because if you have a good sales team, if you're working for an organization with a good... Good solution, you can really push your pay up quite a bit. I think it helps if you're hungry, you have to want closed deals, right? You can't, you have to be passionate about technology. If you really don't like the technology you're working in, you're probably not gonna sell it very well. If you don't want to close the deal, the customer will probably read that like, well, he doesn't even really wanna be here, right? So I think that if you like making a lot of money, if you're okay being in front of people, And you love technology and learning all the time, it's a great field.

[20:13] Matt Toth: I've had opportunities to move out of it. I just, I love this because, again, I get to meet people. I get to solve problems. I get to touch a bunch of different technology. That's not just my own companies, right? I get to do all these different things. When you close the deal, again, being a little bit competitive, When you get that win, now it's a rush, right? I don't think it's necessarily for everybody, but I love it. I think that if you enjoy getting out there, if you enjoy being technical, if you enjoy competing, and not necessarily competing, you don't have to be, you know, oh, oh, oh, yeah, but it's just...

[20:49] Ayman Elsawah: And a lot of times you have the support, especially from a technical perspective, on the back end of some of the, you know, you have access to the developers, you have access to some of the senior architects that have actually made the product. So it's not just you out there by yourself. You know, you have this team behind you, right?

[21:05] Matt Toth: Absolutely. And it honestly is pretty cool because a lot of times if they're... Good developers, if they're good project managers, product managers, they understand that their paycheck depends on you closing that deal also, right? So a lot of times you can get a lot of access that you would not necessarily have had, except they understand, I need to help this guy because this deal turns the lights on at my house. It's a lot of fun. I've made a lot of good friends on the development side. I worked at Symantec for a while and their threat intelligence team there is incredible. And being able to sit down with these guys, the analysts and Learn from them. It's a great experience. I wouldn't have been able to get that if I wasn't in the role that I was.

[21:46] Ayman Elsawah: So what are some of your thoughts on the security industry today? As you say, you've been around for a while.

[21:51] Matt Toth: I think we're honestly moving forward. I think we've done a lot of work to fix some of the big issues from trying to bring in more women. So Splunk had a Women in Technology conference just a few weeks ago that we sponsored out in the DC area. You see that at Black Hat and DEF CON, right? So at DEF CON, there was a women, wine, and... Wisdom? It was three Ws. I'm assuming that's what it was that IOAC had put on. And we're seeing that grow. And so we're seeing a lot of diversity coming in, which is really, really helpful because our adversaries have that. And so we need to be able to step up to the plate as well. I think we are learning quite a bit. I think we still rely a little bit too much on buzzwords.

[22:33] Matt Toth: You know, at Black Hat and DEF CON, you know, machine learning and AI were everywhere. Try to chat with them. Okay, well, what type of machine learning are you doing, right? There was an organization, so they were talking about their, oh, we do all this AI. We come to find out their AI was a room full of analysts in the back of their shop, just going through and doing things, right? You're like, that's not AI. But it helps the market. And it's kind of sad, but we still struggle with that. But I think we're moving forward. I think we get called, people get called out a lot more quickly when they do things like that.

[23:05] Ayman Elsawah: Have you noticed on LinkedIn, the chatter from CISOs against sales reps or, you know, just the resentment it's like coming up all over. And so, I mean, what are your, what are your thoughts on that? Yeah.

[23:17] Matt Toth: I think sometimes sales guys will hear a word like, I love that word. You know, that's the threat hunting. Wow, that sounds awesome, right? APT.

[23:28] Ayman Elsawah: Ooh, advanced.

[23:29] Matt Toth: Yeah, we stop APTs. We stop the advanced stuff. Artificial intelligence, right? I mean, we've all been hot on that since Terminator came out, right?

[23:36] Ayman Elsawah: Yeah.

[23:36] Matt Toth: You know, we're like, Skynet's going to get us. I think that good salespeople understand when not to use the buzzword bingo, right? They understand not to use those. You still get a lot of folks who will come in and do that, but I think sometimes CISOs also get a little... If they've gotten burnt, it really burns a little bit on the industry in general, right? Also because CISOs have, besides salespeople, they're probably one of the higher turnover jobs, right? If something goes bad, it doesn't matter if I was trying to stop it or not or had budget to stop it. My head's the one that's going to roll, right? And so there's probably a little bit of the, hey, you burned me and it could cost me my job.

[24:17] Matt Toth: So I'm going to be very unhappy at the industry at large. Resentment basically yeah absolutely and well knowing that salesperson also got a pretty you know could have got a big payday off it you know it's one of the things i've learned is you don't show up in a super nice car to a sales deal silly little thing but it's a little bit of industry there a little bit of psychology if you show up in a porsche people are going to go and that's totally as a sign up i don't own a porsche i'm a sales engineer because i have a suburban But, you know, I've seen sales guys show up in a Porsche and the customer's like, I'm not going to pay that. You obviously made too much money as it is. Right. So the psychology of show up in the Honda Pilot or don't show up in a super nice car because, again, it's going to make them resent you a bit.

[25:04] Matt Toth: They're going to go, well, this guy's getting paid a lot of money. He's asking me to hand him all this money.

[25:09] Ayman Elsawah: It's funny. I think there was some sort of quote-unquote wisdom somewhere that someone has mentioned for salespeople. It's like, oh, you got to drive a nice car so they think you're successful. And it's funny how you're saying that. It's kind of basically the opposite from a client's perspective.

[25:25] Matt Toth: Don't show up in a 1982 Honda Civic with three wheels and a cardboard for your fourth. But

[25:32] Ayman Elsawah: Fred Flintstone, like, you know, going on the floor.

[25:35] Matt Toth: Exactly, exactly. I think we all had those cars when we were young. Yeah. Understand that when you... Perception is huge. When you show up, you need to look professional. You need to represent your company well, but you also need to understand that if you're flashing diamond rings... I mean, I think that you see that with sports, right? People resent some of these guys making this money, not because... I don't have that. They have it. I'm going to resent it a little bit. So just be smart about it. I mean, you can drive a nice enough car.

[26:05] Ayman Elsawah: Yeah, I think you said it best. Just be smart about it. And I think these tips could apply to anyone, really, in the professional field. Come appropriate for your audience, right?

[26:15] Matt Toth: Oh, absolutely. When you go to DEF CON, you show up in a suit, people are going to be like, what the heck? Who's this dude? You meet with a CEO, you show up in a suit. You don't come in flip-flops and a Hawaiian shirt, no matter how much you want to. And honestly, as a sales engineer, something you have to work with your sales team on is understand how they want you to represent it. Splunk is a very technical company. So one of the things that you'll see Splunk SEs oftentimes, well, it's not, you know, button down and blazer and it's, you got the Splunk polo. When you're running workshops, a lot of times they'll show up with Splunk t-shirts, you know, the looking for trouble, finding your faults, just like mom.

[26:57] Ayman Elsawah: I love the shirts, by the way.

[26:58] Matt Toth: Oh yeah, I love them.

[27:00] Ayman Elsawah: I was wondering the other way, it says, I see dead servers.

[27:02] Matt Toth: Oh, yeah. They're great, but that's part of that company's culture. And when I was at Symantec, it's not Symantec's culture. Their culture was very much a, you're going to show up and you're putting up in blazer because that's how you're representing them. When you're meeting with your audience, understand who they are, understand what they expect. Give it a little bit of thought, right? You don't have to spend hours on it, but just don't be like, oh, I just threw this on. It was laying next to my bed. What happened? I didn't close the deal. Weird.

[27:34] Ayman Elsawah: Yeah. Yeah. I had a big stain or whatever, you know, just, you know, we're a deodorant. Yeah. As an engineer, if you're going from engineer to sales engineer, anyway, I'm not going to dig in on that. Yeah.

[27:47] Matt Toth: We've all met those engineers.

[27:48] Ayman Elsawah: Yeah. Yeah. I think there's been plenty of jokes where, you know, you know, at the security conference when people aren't wearing deodorant.

[27:53] Matt Toth: So that's definitely, they have the three, two, one rule, right? Yeah. Three hours of sleep, two meals, one shower every day. Yeah.

[28:02] Ayman Elsawah: You have to remind people about that.

[28:04] Matt Toth: Exactly. The fact they have to make that rule is an issue.

[28:08] Ayman Elsawah: Yeah, there you go. So tell me, what's the first computer you ever had?

[28:13] Matt Toth: Commodore 64, I think, would be the first. It was, we got it from one of my cousins. The one that I think that I actually probably did the most on, though, was an old Mac that my dad was able to bring home from work. I think I was able to work, I mean, this is, you know, in the way back, I was able to work on that.

[28:30] Ayman Elsawah: Do some basic on it?

[28:32] Matt Toth: Yeah, a little bit of programming. Mostly, admittedly, what is the least amount of effort I have to put in to get this game to work? Okay, got it working. Okay, now I have to go find this. Okay. I think my passion for computers, I was going to be an artist when I was younger. I loved comic books, still collect. I actually knew some folks in that industry and I got a scholarship to an art college and I had a mentor. And I think this is really important for all young people. Find mentors that you can trust that actually have yourself and your best interest in mind who can help guide you and listen to them. I had just started in IT. I had been working at a telecom as an operator. I was 16, 17, hung out with the IT guys.

[29:18] Matt Toth: I'm like, hey. And so I moved over and they're like, hey, you want to work with us?

[29:20] Ayman Elsawah: Of course I want to work.

[29:21] Matt Toth: So I'd worked, moved over there and my mentor, we were chatting and I was going to go to this college for art. He's like, you're a good artist, but you understand what you're going to make, right? He's like, you're already making at your job what you will make in art, right? Plus you're going to have all the student debt and all of these things. And I looked at it and I was like, okay. Chatted with some other folks. I'm like, you know what? I love computers. I started finding some crazy stuff. Like, oh, this is awesome. This is really fun. You start diving in. I'm like, and this is a career I can already start.

[29:56] Ayman Elsawah: What age was that mentor?

[29:58] Matt Toth: 17. So I was pretty lucky. I was able to start school at four. So I was able to graduate by 17. I Not because I was intelligent or anything like that, but just where the birthday fell in Virginia, the cutoff was January 1st, so I was able to, even as a December baby, get in there. I started working, kind of always worked, I think this is probably something I'm trying to work out of, is I kind of identify as my profession, which isn't necessarily healthy.

[30:26] Ayman Elsawah: What do you mean?

[30:27] Matt Toth: I work probably more than I should. My work-life balance is dictated more about my passion. Slunk is really cool about, hey, your time is your time. And I love this. This is what I do. When I started in IT, as soon as I graduated high school and I was already doing IT, I jumped in. I was doing 100-hour weeks, just learning everything I could. I had an apartment with a blanket and a pillow. I didn't even have a mattress. I had my computer. And that was about it. I think I had a fold-out table that the computer sat on, maybe. I don't remember at this point. But I just basically spent all my time in the office, and then I would go home, shower, clean up, sleep for a bit, go back in. Part of it was I worked at a telco, so I had incredibly fast internet at work, right?

[31:18] Matt Toth: This is still in dial-up days. So you get to work and you're like, oh my goodness, it's glorious. I worked at a startup right after that. They had showers and full kitchen and all that. This is pre.com bust.

[31:33] Ayman Elsawah: Yeah, that's pretty big for back then. Oh, pre-bust, okay.

[31:36] Matt Toth: Pre-bust, yeah. It was right before the bubble burst. It was, if I remember right, they were the third to last company to go public before the bust. And so all those options I had were worth zero, like negative. I would work and just love it. It was fun. I think this is something that I feel bad for a lot of people coming into the industry today. When I started, it was like, hey, just go fix this. Go punch down that network. Go solve this. Any means necessary. Hey, we're working with these solutions.

[32:13] Ayman Elsawah: You had to touch everything.

[32:15] Matt Toth: I was a network support technician. Then I was a Windows NT engineer. I mean, that's Windows NT, the last stable version of Windows. Then I was like a Linux admin. Then I was a CRM admin. I had to build a customer relationship management solution for the customer. I mean, this is pre-Salesforce, right? This is pre-Active Directory. And they're like, hey, this is your new project. Make this work. Okay, here's your title. Great. I'm going to put that on my title bingo card.

[32:43] Ayman Elsawah: Is it all in the same company?

[32:44] Matt Toth: No. So it was over a few companies, but the first company, it was like network support, Windows. I think if I was a Windows engineer there or not, or if I, it was when I, I think I moved and the company I moved to said, all of our people are engineers. And I'm like, oh, that sounds cool. That's awesome. I love that. I'm barely shaven, but I'm in. We did that. And then at the CRM built and running and they're like, Hey, we're going to move to active directory. Oh, right. Built that up. I remember doing Microsoft SMS, which was pre SCCM, having it totally crash hard, having to rebuild it, read it, get it working again. It's interesting. And then the.com bubble burst. And that was a network admin, a small company, Linux admin, a small company.

[33:32] Matt Toth: Then, Again, you have to work. So I was a support guy at a telco again. And at that point, I was lucky enough to have a friend who was working at a security company, was able to pull me over. I was already passionate about security at that point, but being able to do a professional was very nice. But I think something we all have to understand is you have to You can't just sit there waiting for your dream job to show up, right? You have to be constantly mingling, finding other people in the industry. You get your jobs from people you know. If you're trying to break into infosec, go to the meetups. So another OpSec fail, but I live out in Utah, right? And so we have a great DEF CON group out here, DC801.

[34:15] Matt Toth: So I moved out here. I started going to those meetups, started going to the local conferences, St. Conn, B-Sides, SLC, Hack West. Find the conferences, meet people. It's not always comfortable, even being a sales engineer. I mean, again, I've been doing this for a really long time. When I moved out here, I was like, oh man, this is going to be super awkward going and meeting, you know, just going to a meetup and being like, hi, my name's Matt. I'm an infosec addict.

[34:45] Ayman Elsawah: Yeah.

[34:45] Matt Toth: Hi, Matt. Yeah. But it's, you do that. And all of a sudden people are like, hey, here are the jobs that are available. I mean, I already had a job at that point, but It's really cool to see that, right? But that's how you get your job. So don't be afraid to go out and mingle. If you don't know it, if you're just getting into the industry, recognize that all of us have our skill gaps. There is no one who knows everything, right? Jump in, start learning. People want to help. I like to mentor people. Most everyone I've met in the industry likes to mentor and likes to help because there's just not enough people. If we can get somebody into the industry, we're like, oh, let's work off of my back.

[35:25] Matt Toth: All right.

[35:27] Ayman Elsawah: Yeah, I think that there's something to be said about, I'm hearing over and over again, go to conferences, go to meetups, try to find something local. I think just the energy, wouldn't you say, is enough?

[35:41] Matt Toth: Right, and that's, I think, all anybody cares about is, are you passionate? And this is not to sound derogatory, but I can teach almost anyone to do this if they care, right? It's not a hard job. People think that we're wizards. I even talked two years ago at a conference about changing the mentality of, hey, we're all wizards. Cyber wizards since you know we're just people who are doing a job there's nothing magical about it's actually really easy if you're you've ever done any type of puzzle it's just figuring out how the pieces fit together and there are so many resources out there for it i mean there are just an incredible amount of free resources for you to learn you just have to take the time to do it right

[36:27] Ayman Elsawah: Definitely agreed. And oftentimes your first job might not be a security job necessarily, right? You might have to transition into security if you're not practicing security by day and night, right?

[36:41] Matt Toth: Right. Absolutely. Yeah, I think you hit on that well. And I think this is where sometimes people want to put the cart before the horse, right? I think you really do need to work, be a network admin, be a system admin, work in a NOC. Understand how the system works so that when you become a security professional, You already know what the baseline is. You understand how things should look, right? When you open up, get an open source tool like Wireshark or a free tool like Wireshark. I don't know if it's actually open source. I assume it is, but it's a free tool. It's a free tool that you can use, right? You understand what a network chatter is supposed to look like. So you can understand what you're trying, you know, okay, from a security mindset, this is deviating from that baseline, from that standard.

[37:28] Matt Toth: Okay, now I can look at it. I think trying to jump directly in, and some people may be able to do it, just, you know, so passionate. And if that's your path, do it. I think it is helpful to have that background, though, in kind of general computing basics, you know, your net plus, your A plus, whatever. You don't have to have those, you know, that kind of foundational knowledge. And I could just be saying that because that's kind of how I came through it, but... I think having that has definitely helped me in my career because I'm able to see things and go, that's weird.

[37:59] Ayman Elsawah: You know, the whole cert thing can be controversial sometimes. What are your thoughts on that?

[38:05] Matt Toth: My thoughts with certs are, do you like to get paid? And that may sound a little bit flippant. I think a lot of times the people who say, oh, you don't need those things are people who have already been in the industry for a while. They have a name. So the cert doesn't help them get hired because they already are established. When an HR person is looking at two different resumes, if one has certifications and the other does not, for the HR perspective, they're going to go with the person who has certifications. Maybe not, again, 100% that they're going to do that, but I've seen that's typically the way they go. You want to make a couple extra grand a year? Get your CISSP. You want to be able to touch a government computer?

[38:48] Matt Toth: Get your SEC Plus, because they still have requirements. You have to have that to touch it. I think it doesn't hurt to get them. If you have the capacity, I mean, if you're going to be spending a crap load of money out of pocket, Maybe then you can, you know, wait on it. A lot of companies that will say, oh, you're interested in this. You've already studied up on it. Yeah, we'll pay for the test. Go for it. Right. I don't think they hurt. And I think that it's hard for me when I see people saying, oh, well, don't go get these things. Because normally somebody who's been around the industry a long time, they don't see the value in it anymore because they've already established themselves. But from a straight up payday, getting hired, if you have the capacity, especially if a

[39:28] Ayman Elsawah: Yeah, especially if the company's paying out for you, for sure.

[39:31] Matt Toth: And just ask. One thing I think a lot of people have a hard time with, especially engineers, is asking, right? When I was at Symantec, I was a sales engineer, right? And I was like, hey, I bet I can pass the CEH. Will you pay for the test if I pass it? And they're like, go for it. So I went and I passed it, right? And it didn't hurt me, right? It didn't hurt me to ask. And some people are like, You know, you get the people who want to hate on certs, like, oh, yeah, these certs. I'm like, you know, when I get hired, when people interview me, it goes towards my base. And that's where I think that if you have the ability to get them, get them. Don't think that you're not going to get a job because you have a specific cert.

[40:15] Matt Toth: You may not get a job because you don't, though.

[40:18] Ayman Elsawah: Well said. Well said. Cool, man. What's the first security conference you've ever been to?

[40:23] Matt Toth: I think it had been to some local meetups. I don't know if they qualify as conferences.

[40:29] Ayman Elsawah: Yeah, I guess conference meetup. What was the first meetup that you went to? First security-related anything that you went to?

[40:37] Matt Toth: Security meetup that I was working at a company called Steel Secure. And we had just brought someone in to help build our community. So we had built a security meetup in Denver. And so being the sales engineer, I was tasked to go and mingle and drop my credit card. Go to all that but it was great i loved it from there i have 11 years of black or of DEF CON on my wall now my wife keeps telling me i need to build a shadow box to just lay all the badges out there i think you have a an eclectic affinity for badges wouldn't you say oh yeah i love badge life if you don't know what that is go to twitter and look up hashtag badge life So my first DEF CON badge, I was like, oh, sweet, it's incredible.

[41:26] Matt Toth: I think it was last year, they had all sorts of different badges. And I was like, okay, now I'm in. Partially, I think it's the artwork that does it for me.

[41:37] Ayman Elsawah: That's interesting.

[41:38] Matt Toth: I love the imagery that we can do. And some of these are just incredibly creative, right? I loved DEF CON 21, maybe 19. It was the one where they did the, it was just the metal circular badge with the Eye of Ra on it, right?

[41:53] Ayman Elsawah: Eye of Ra, yeah.

[41:54] Matt Toth: Cryo Force. Yeah, Eye of Ra on it. And they said numbers and the crypto challenge with that. Oh, that's really, really cool. The crypto badge, the crypto village badge from last year with the scarab, and it had a little decoder ring built with a bunch of other things built into it. It was just incredible looking. SaintCON, two years ago, they had a badge, you had a bill. You show up and you sit down at a table with your soldering gun and put it together. I was able to take one of my kids with me for that, and they soldered all the pieces on. It's a cool scene, how it works, but also the artwork behind it. I love a lot of the imagery we do. Mr. Robot, a TV show. I love it. That's an awesome story.

[42:36] Matt Toth: I appreciate that they try to get things right. But even then, I remember watching Hackers. Maybe that was where things passed. It's at 97. I was like, oh, I love this. It's so cool. It's so funny. It's so like, look at them, the rebels.

[42:51] Ayman Elsawah: But it's awesome.

[42:53] Matt Toth: It's iconic, right? I mean, that soundtrack is still incredible. Honestly, I watched, on my way out to Black Hat this year, I watched Hackers on the Airplane. And it was freaking me out because I'm like, all of the attacks that they're doing, they're performing, they're talking about are real-world attacks that we're dealing with today still. Denial of service attacks, IoT attacks, right? That's a huge thing right now, the Internet of Things. You'll hear people joke about it being the Internet of Shit, right? I mean, there's just so many bad tools out there. I shouldn't say that, insecure tools. But, you know, in that movie, the boats were all automated. They were all Internet of Things, right?

[43:30] Matt Toth: And they're being attacked. There's no manual override anymore. And you look at that with a lot of our infrastructure, right? As we start changing things, they're not securing it. They're just making it more manageable remotely. And sadly, sometimes you'll get adversaries managing it for you.

[43:47] Ayman Elsawah: Yeah.

[43:48] Matt Toth: You know, I mean, there's the goofiness about it. I love their reference to William Gibson. I'm a huge reader. And Gibson's one of my favorite authors. Neuromancer, the whole sprawl trilogy, you know, Count Zero, Mona Lisa Overdrive, just, they helped shape my imagination and my love for the industry. But, It's fun, right? And I think sometimes people get too serious about things. I think it's usually the same people who get butt hurt about certifications. But, you know, it's like, you have to be able to have fun with it, right? I mean, one of them, at St. Conn last year, Grifter, Neil Wyler, works for RSA. He's a really, really nice guy. He's a security head. You know, he had gone out to DerbyCon and got a cockroach in a shake that he had out there.

[44:32] Matt Toth: And he had started, you know, they named it Trevor. Started this whole thing you can still look it up hashtag trevor forget right and he's talking about this whole story i think i'm like this is great it doesn't have to necessarily be technical but look at the industry look at some hilarious antics that happen it's fun right and i think we still have to have fun with it i think the industry is still young enough that we can still enjoy it just have a good time and not have to take ourselves so seriously

[44:59] Ayman Elsawah: Yeah, I think that's pretty well said. We need to relax and be more inviting, inclusive, and just relax a little bit. You got any interesting stories you could share with the audience?

[45:11] Matt Toth: Yeah. So early, early, early in my career, We have a guy that still shaped how I run commands in the command line. He was typing out a command to remove a directory on the Linux system. And he typed in rm space dash rf space slash space directory.

[45:34] Ayman Elsawah: No way.

[45:35] Matt Toth: And he wiped out the root directory as it's going down. And here in the alias on the email server as root loser.

[45:43] Ayman Elsawah: Oh, boy.

[45:45] Matt Toth: It was great. Oh, man. Every time I start typing in commands now, I'm like, okay, what is this really going to do? Did I accidentally hit an extra space? Little things that shape your mind. Back at Symantec, we did a cyber war games internally that was absolutely incredible. And one of the early ones, you had to work your way through a nation states infrastructure, eventually working your way up to working your way into a hospital. And it was really kind of dark, but you had to write some malware, phishing email. A nurse was a bot that would click on any link in the email. But to click on it, to download the malware, and eventually you had to kick somebody off of a heart transplant list because that was one of the things you were trying to do.

[46:32] Matt Toth: But it started off with Facebook. We call it Fit Friend Face because you can't say Facebook without the L.

[46:39] Matt Toth: And through social engineering, open source intelligence, we were able to gather their information. They shared a password between that and one of their other systems. Okay, now we're able to, you know, you start moving your way up. And it really helped with adversarial thinking. It's What do I have out there that somebody else can use against me, right, against my organization? You know, it made you really want to make sure you're not reusing passwords anywhere. For everybody out there, go get a password manager. There's a lot of them out there. I don't care which one you use. Get a password manager, different password everywhere, auto-generated, so you don't even have to, it's not, it doesn't have to be something you have to remember, just click in and away you go.

[47:19] Matt Toth: And then I actually helped run a working simulation for some federal customers. And we had an actual model about the size of a pool table of an oil field with oil pumps. If you've ever been out to the Midwest, you see those little pumps that look like sickles kind of going up and down, oil drums. And you were, again, attacking another nation-state's oil infrastructure. And you had to work your way through these different levels. And the final thing you had to do was cause it to fail. And so, log into their ICS system, change it. All of a sudden, you see the physical, the kinetic effect of the pump stopping. And then the oil term overflowing. And of course, you use coffee because it weighs your cleanup and smells way better.

[48:07] Matt Toth: Yeah. But when we had executives from their organizations watching as their people were running through the simulation without, I mean, it was a contest. We had a number of teams there. And as they're going through it, wait, that only took them this long to pop, pop, pop, pop, pop. Yeah. I mean, there were some serious challenges, but you can get through it. And all of a sudden they hit that target and the executive's eyes open. They're like, oh my goodness, this is real. It's legitimate. Yeah. And that was a, it was very cool to see that, that transpire, right? Get people to really understand it.

[48:43] Ayman Elsawah: Do you ever walk into a client and find some sort of, you know, like incident, basically run into an incident as you're there? Cause you know, you're oftentimes, yeah. What are some funny, do you have any funny stories along that?

[48:56] Matt Toth: I was at a customer site and I was doing, we were doing network access control. And they're like, we want to just listen to what's going on in our environment. So just had the product listing on a tap, right? To the network traffic and risk collecting. And we're just basically, here's all the devices we're finding as they're chattering on your network. And they're like, hey, what's that domain there? I'm like, oh, it's another Windows domain. But that one doesn't shouldn't exist. We don't, this is our only domain. I'm like, oh. Well, it was an entire, somebody had built an entire Windows domain in their environment.

[49:31] Ayman Elsawah: Wow.

[49:31] Matt Toth: Yeah, and it was people trying to do their jobs. I mean, that's, most insider threats aren't malicious. They're just people trying to do their job and oftentimes working around the system to try to be more efficient, which is kind of sad.

[49:46] Ayman Elsawah: You mean it was a whole shadow IT, like infrastructure built?

[49:51] Matt Toth: Yeah. It was one of those dolls, the Russian nesting dolls, where it was an infrastructure inside their infrastructure that these people had built out to do their job. It's crazy when you see that. You're like, well, okay. And they're like, okay, well, you need to leave for a bit. Had another customer we were at, and this was, we were doing, working with data loss prevention. So we're like, hey, we're just, you know, do you want us to proof of concept? We're coming in, it's your data, you've given us access to this SharePoint. We're going to look at everybody who's touching everything, what they're doing. Yeah. Then we had a, I can't remember what the visualization is called, basically where it groups people by what they're doing, who they are.

[50:39] Matt Toth: So here are all your network admin. They all behave kind of like this. And it helps you visualize outliers. It helps you look for those outliers. When there's somebody who's kind of way off the chart, that's kind of weird. And they looked at the customers like, oh, they started looking. They're like, okay, you need to leave now. And the guy got arrested for doing things that he should not be doing anywhere. But it was interesting because we were just doing this group concept.

[51:03] Ayman Elsawah: Hey, look at all this stuff.

[51:03] Matt Toth: Look at this outlier. And to find out that the guy was doing something highly illegal, it's like, oh, well, the product works.

[51:10] Ayman Elsawah: Wow. Yeah. That's crazy.

[51:12] Matt Toth: And I think it's not abnormal to find that because... Oftentimes, the biggest issue people have is visibility into their own environment. It's something that at Slunk we work really, really hard to help people with, is giving them that visibility.

[51:28] Ayman Elsawah: You don't know what you don't know.

[51:29] Matt Toth: Exactly. The unknown unknowns, right?

[51:32] Ayman Elsawah: Yeah, I mean, that's really my favorite phrase. It's so true. Oftentimes, people are trying to fix something. Like, you can't fix something you don't know exists, right?

[51:41] Matt Toth: Exactly. Exactly. Everybody has their no-no's. Here's what we do know, right? You look at any of the, and this is not to bash on anybody, you know, when you're just going into somebody and you're like, well, what does your network look like? And they're like, well, this is all of our employees. You're like, okay, well, now you need to add at least 20% to that because there's going to be a ton of stuff that you don't know about in your environment. Oh, no, no, I know it's in my network, right? And you boot it up and you're like, oh, did I get another Windows domain? You got an entire network infrastructure. It's incredible what you can find out there. And so part of my job is, again, to help people, to give people that visibility into, hey, this is your actual truth, right?

[52:19] Matt Toth: The honest truth of what's going on in your environment. And sometimes, honestly, I think sometimes companies don't want to buy it because they don't want to be, they don't, and not this, but there's certain times they'll see something and go, I don't want to know about that because if I know I have to do something about that and I don't have the ability or the manpower at this point to do it. So I'm just going to sit here with my head in the sand until the FBI comes knocking on my door saying, hey, you've been breached. I can't, I don't feel that I can solve it. And so as an industry, we were trying a bit earlier about that, but as an industry, we really do need to become better at recognizing that we're not perfect.

[52:55] Matt Toth: We're going to find bad things in our environment and we need to take it head on, look at it and say, okay, I know that this is out there now. I'm aware of it. Now I can set a risk factor to it. I can say, is this actually an issue? Then move forward and either mitigate it or at least document it so that I know what's going on.

[53:15] Ayman Elsawah: I'm sure you've been in situations where you have people not willing to work with you or like giving you resistance. Do you have any funny stories along that line?

[53:24] Matt Toth: I don't know if any of them are actually funny. I've been in a number of situations where you've gone in and everybody has their kingdom, right? I'm the Windows admin. Everything in Windows is mine. Don't tell me my baby is ugly. Or I'm the network admin. Don't tell me my baby is ugly, right? And part of your job is helping them see that their baby has a beautiful soul. Yeah. But helping them recognize, hey, it's okay that there's stuff wrong, right? It's okay. We will help you. And not just us. There are other people in the industry. We can help you solve this and help you get to a better level of security, help you get to a better baseline Yeah, because a lot of you'll go in and be like, oh, I'm not going to use this.

[54:11] Matt Toth: I had a customer who was using a competitor's, or I was in a thing, they had a competitor's product and they're like, this guy, this was his product to support. And he got paid to support this product. So there was nothing that we could tell him Because to him, we were taking his job.

[54:27] Ayman Elsawah: Yeah, he felt threatened.

[54:29] Matt Toth: Exactly. They're taking their jerbs.

[54:33] Matt Toth: Sorry, a little South Park. Fun story, one of my managers actually went to college with those guys within their dorm or frat house or whatever. He had some fun stories. But yeah, you go in and you have to help them understand, I'm going to make your job better. I'm going to make your job easier. I'm going to help you out. I'm not going to... Just because it's easier doesn't mean that you're not going to still be able to do your 40 hours, right?

[54:59] Ayman Elsawah: Yeah. Yeah. We're all on the same side, basically.

[55:02] Matt Toth: Exactly. And as a sales engineer, that's a lot of times who you have to connect with. You have to find the person who has the most resistance to change and connect with them and help them through that process.

[55:13] Ayman Elsawah: Yeah. So what's your earliest hacking memory, if you have one?

[55:18] Matt Toth: So earliest memory, I had a friend who, there were some systems that he needed to access and he couldn't because he didn't know what he was doing. And not that he didn't know, he just, he wasn't a computer guy. He's like, I need to get access to this. And so I remember working backwards, gathering open source intelligence. Okay, what, how do I get this? How do I get into the system? But what are possible attributes? Admittedly, it was a little bit of brute force, but it was educated brute force. Here's what should work. Okay. And then working your way through that. It was incredible when we actually got active. I was like, oh my goodness.

[55:55] Ayman Elsawah: I did it.

[55:57] Matt Toth: I made it. And then just honestly a lot of fun messing with people early on in IT, like popping into other people's systems, having fun with them.

[56:06] Ayman Elsawah: Sending pop-ups on desktop.

[56:08] Matt Toth: Sending pop-ups. One of my buddies, I worked an overnight shift for a while. Again, you are not too good for any job if you're coming into this. We've all worked crop jobs. I was working an overnight shift. I actually love that shift because I've learned so much. Me and one of my coworkers, who's a good friend of mine because again, spent a lot of time overnight with people who become friends or mortal enemies, but we became friends. He wrote this script. It was hilarious. It had a timer, but it was kind of randomized and it would pop out. And this is again, CD-ROMs when people still had CD-ROMs in their systems.

[56:43] Ayman Elsawah: You mean not the cup holder?

[56:44] Matt Toth: Exactly. It's not the cup holder. It would just randomly throughout the day open these different people's CD-ROM drives and then close it. And it's like people would drive, people would be like, what is happening?

[56:57] Ayman Elsawah: Why does it keep, what is going on?

[56:59] Matt Toth: And it just makes you chuckle. You're like, oh, again, little light pranks. Don't hurt it. Yeah, it didn't hurt anybody. It wasn't like white people's drives. Things like that.

[57:07] Ayman Elsawah: Computer lab stories, man. Oh, yeah.

[57:11] Matt Toth: Teaching people that early VoIP wasn't encrypted. It's like, hey, this isn't encrypted. They're like, what do you mean? It's a digital phone call. It's great. Like, look, here's a hub. I'm going to plug the hub into this line. I'm going to record everything and I'm going to play back your conversation. It's not encrypted. And then they'd be like, oh my goodness, we have to encrypt this. Yeah. Yes, of course you do. And don't talk about those things when you're on the phone. That is an in-person conversation in a room with everything turned off.

[57:39] Ayman Elsawah: And so you did all this before you got into information security officially, right?

[57:42] Matt Toth: Oh, absolutely. Yeah, this was back. I mean, one of the jobs was when I was working at the telco as just a conference operator. One of the things we did, I had access to hundreds and hundreds and hundreds of phone lines. And so you'd be like, hey, how about I could blast dial this radio station and I'm going to get callers one through 100. So I'm definitely caller 10. You know, it's just scripting that, working on an old wise term. I mean, all those things you do, and you don't think of it as hacking, but you're solving a problem. I mean, that's all hacking really is, right? It's solving a problem, finding the answer. And, you know, I think it shapes you. It's having that passion, having that desire, having almost the glee at the little things, right?

[58:27] Matt Toth: The fun. When Gentoo Linux came out, this is, again, pre-2005, I think. Maybe 2004, 2005.

[58:35] Matt Toth: My overnight buddy was like, Hey, we're going to start it at layer one, which basically you're designing your Linux kernel, right? For your system. And you're going through and doing that. You're like, Oh man, I didn't even know any of this was here. I didn't know I could do any of this and finding it out. I mean, I still remember the, so before it was Cali was backtrace or backtrack for, before backtrack, I think it was the auditors toolkit. Again, I'm, Old and so my memory's not great i still have a cd that i've kept just because me and my overnight buddy we got the cd you know ripped it and then we put a cd just a sticker on top of it the sweet skull right oh this is our tough thing look at the tools this has look what you could do with this but it was cool it was like oh i'm going to find out how this works i want to know how this works

[59:23] Ayman Elsawah: It's about the mindset. It's the mindset.

[59:25] Matt Toth: So just to reference Hollywood or whatever, Mr. Robot talks about it pretty well. He says the itch, right? The itch in his brain. You start working on something, you'll just trigger it. And you're like, what is that? I need to know how this works. It's kind of going to the matrix, right? Follow the white rabbit. You chase the rabbit. And you're like, what's going on here? And what started with a simple searcher idea, all of a sudden you're You know, way off into the boonies, but you've learned a ton. It's fascinating how often those things, those little things you've learned when you weren't intentionally trying to learn them will save your butt someday in the future because you're like, oh, I remember this.

[1:00:03] Matt Toth: I'm going to work on that.

[1:00:05] Ayman Elsawah: That's right. It'll at least give you context into what you're doing.

[1:00:08] Matt Toth: Exactly.

[1:00:09] Ayman Elsawah: Yeah. Yeah. That's awesome, man. Well, I really, I really appreciate it. I think this has been a wonderful conversation. Where can people find out more about you? Either a blog or Twitter or LinkedIn or anything? So, Solington.

[1:00:20] Matt Toth: Again, Matt Toth. I work at Splunk. It's probably pretty easy to find me there. You know, on Twitter, I'm AquilHackForFood. All spelled out. No fancy numbers or letters or anything else there. My blog, which does not get updated very often, is mostly just a writing practice for me to make sure I can still spell words. It's HackThePlanet.org. I've owned that since... I've been shaped by media and I'm okay with it. Cause there's, there's fun things. There's things to learn from it. Right. You know, we can all, we can all laugh at, I think it was NCIS where they, you know, two people typing right now. It's not how it works, but when you can take little things from a little ideas, it's, you know, it can't be, it's not all bad.

[1:01:02] Ayman Elsawah: Definitely with you on that one. Definitely with you. Anything else you want to share with the audience?

[1:01:07] Matt Toth: We run a lot of work. Splunk runs a lot of workshops. We do everything from just some 101 for our stuff all the way to advanced APT threat hunting. We ran that at DEF CON and B-Sides Vegas this year. I'm going to be running a Threat Hunting 101 course coming up in a few weeks. So if you look in your industry, you look around your neighborhood, we run Splunk Live events where we'll be doing some of these contests. We do a Blue Team CTF, which is a lot of fun, called Boss of the Sock. And we run those, again, coast to coast, so you'll be able to find them Contact your local small person or just look online and see where we're going to be. You know, there's a lot to learn though. So go out and happy hacking.

[1:01:45] Ayman Elsawah: Is there a URL that they could go to find out more information about that?

[1:01:49] Matt Toth: Yes, Splunk.com. I know it sounds simple, but we have, again, our free versions right up there on the top right. Then there's also, we have all of our social pieces there. All of the events we run are there. You'll find some of our security folks on Twitter, and they've written tons of things, threat hunting basics, all sorts of cool things that you can find on that site.

[1:02:10] Ayman Elsawah: Awesome. Well, definitely appreciate your time. This has been great.

[1:02:13] Matt Toth: Well, thank you. I appreciate you having me on. Talk to you soon.

[1:02:17] Ayman Elsawah: Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.