Getting Into Infosec, Episode 28: Page Glave - Professor of Kinesiology to Cybersecurity Analyst!
Published November 16, 2019 · 31 minutes
Episode page: https://www.gettingintoinfosec.com/episodes/page/

[0:00] Page Glave: You know, when you sit in your office and you look around and it's like, do I really want to do this for the next 30 years? And you just kind of get that sense of, no, no, I do not want to do this for the next 30 years and

[0:27] Ayman Elsawah: Welcome to Getting Into Infosec. I'm your host, Ayman Elsawah. My guest this week is Paige Glaive. Paige was a tenured adjunct professor of kinesiology when she realized this was not what she wanted to do forever.

[0:37] Page Glave: Finding that I was really enjoying the statistical analysis and the programming aspects of that more than the kines side of things. It's like, okay, well, maybe I need to do a little bit more of that outside and formalize what I've always done and implicitly just find better choice.

[0:50] Ayman Elsawah: When trying to switch, she got creative about her resume. What are your resume?

[0:54] Page Glave: Is what you're seeing on the front page is a job? It seems very unrelated.

[1:01] Page Glave: I think you can help increase your odds a little bit though.

[1:05] Ayman Elsawah: We also discuss things you can do to help employers see that you're committed or interested in the field.

[1:09] Page Glave: You just have to do something that gives someone a reason to take a chance on.

[1:14] Ayman Elsawah: And tactics for getting in the door.

[1:16] Page Glave: If you're talking to somebody in cybersecurity and they can't really talk about their home lab, that's a bit troubling, especially for someone trying to break in because if you don't have systems to work on at work, how are you getting this experience? I would like to say that helps me break into the field.

[1:31] Ayman Elsawah: All right. On to the show. Hi, Paige. Welcome to the show.

[1:34] Page Glave: Hi. Thanks. I'm happy to be here.

[1:36] Ayman Elsawah: Great. Yeah. Thanks for coming on. So from what I understand for listeners out there, you're relatively new to the information security field. Is that right?

[1:44] Page Glave: I am. I've been officially in information security only since February. So I guess I'm up to five months now.

[1:51] Ayman Elsawah: That's awesome. Well, congratulations. Welcome.

[1:54] Page Glave: Thank you.

[1:54] Ayman Elsawah: Yeah. So maybe you can give folks a little background on what you do today and how you got into the field.

[2:00] Page Glave: So today I'm involved with the information security for a large K-12 school district, which is a lot of fun. You get to see a lot of different sides of things. It's I think we often don't think about schools as a critical target.

[2:14] Ayman Elsawah: Yeah.

[2:14] Page Glave: But when you look at the technology that most K-12s have and the number of users, it's really a great environment to work in lots of advantages. And one of the things that I like best is I get to play with a lot of different things. We have a much more A much more varied environment than I think you get in a lot of corporate settings. And that makes it a lot of fun for me. So I get to do everything from governance and policy development to pen testing. And being able to play with all the toys, get your hands on all the things is probably the favorite part of this job for me because it's really a pretty big adventure on a daily basis because no day is the same.

[2:51] Ayman Elsawah: Nice. And well, I mean, it seems like every day is different for you.

[2:54] Page Glave: I'm fortunate to be kind of in control of my schedule. So one day I may focus on working on developing our government's framework. Another, I may work on going through and doing bone scans on all of our external facing IPs. And then you also have the triage aspect when something doesn't look right. So it's nice to be able to touch on all the different pieces of the industry right now.

[3:17] Ayman Elsawah: And is it a big team that you work in? Does everybody have, you know, similar roles?

[3:22] Page Glave: The IT department is, I think, fairly large for a school district. But in terms of cybersecurity, we have a pretty small team, but I'm fortunate to have very security minded folks in other areas. We have a really solid infrastructure and

[3:40] Page Glave: Who have really strong security mindsets. So it makes my life a lot easier when it really is an environment where security is everyone's job. It may be my primary job, but I think we do a good job of keeping it at the forefront of everybody's mind.

[3:54] Ayman Elsawah: Yeah, there's something to be said about being in an environment where other co-workers have that security mindset and you're not just the only one out there. You know, it's a really good support system, wouldn't you say?

[4:04] Page Glave: It is. And what I like is being able to bounce ideas off of other people. You know, sometimes having a focus team is great, but I think you can get a little insular and it's nice to bounce your ideas off of other people. I would, of course, take a bigger team. But for the situation I'm in, I think I'm really fortunate to work with some really great people.

[4:22] Ayman Elsawah: Great. That's awesome. And so I met you before you were in information security. So, you know, walk us through how life was before you got this job. Interviews or trying to study and things are going. And, you know, what made you want to go into this field?

[4:37] Page Glave: Well, I do have kind of a humorous background, I guess. So I think when we first started talking, I was a tenured associate professor of kinesiology with a specific focus on exercise science. My main areas were biomechanics and obesity. So not a lot of obvious overlap there. But for me, technology has always been a big part of my life. And with my specific focus, I did motion capture and things like that. So I was in a position where a lot of times I kind of functioned as an ad hoc network administrator with making sure that our systems are functional and doing what they were supposed to do. I'd taken basic in high school and learned...

[5:23] Page Glave: That and i'd always enjoyed it and were you the go-to person when things went wrong yeah i was you know in-house tech support right it's funny because i'm like that i think i will always be in house tech support for as long as i live that's like i'm not getting my gmail messages right the internet is down yeah the internet is down i can completely fix your isps problem 500 miles away but You know, that's IT life, I guess.

[5:50] Ayman Elsawah: Right.

[5:51] Page Glave: But it's always done that, been responsible for that side of things. And then as funny as it sounds, I just kind of got bored. You know, I love teaching. I love doing research, but I didn't want to keep doing something that wasn't challenging.

[6:05] Ayman Elsawah: Were you at the top of your game at that time?

[6:07] Page Glave: You know, it's, it's hard to define top of your game. I was doing well. I was on track to go up for full professor in a few years.

[6:13] Ayman Elsawah: Oh, okay.

[6:13] Page Glave: You know, in academia is kind of, I guess, top of your game.

[6:16] Ayman Elsawah: Right.

[6:17] Page Glave: But I was at a regional, I was at St. Houston state and I really, I really did enjoy it and loved a lot of things about it. But you know, when you sit in your office and you look around and it's like, do I really want to do this for the next 30 years? And you just kind of get that sense of no, no, I do not want to do this for the next 30 years.

[6:34] Ayman Elsawah: Okay.

[6:34] Page Glave: Doing statistics because that's a big secondary area for me and finding that I was really enjoying the statistical analysis and the programming aspects of that more than the Knie side of things. It's like, okay, well, maybe I need to do a little bit more of that outside and formalize what I've always done and implicitly just find better toys. Right. Because it's hard to justify a high-powered laptop when you're just writing documents.

[7:01] Ayman Elsawah: Right.

[7:01] Page Glave: But... Kind of got to that point where I'm like, oh, I need something. I need something else. And looking at academia, your trajectory is basically become full professor. And then if you want to advance anymore, it's go into administration. And looking at what deans and department heads and all that is not something that held a lot of appeal. Not saying that I would never consider going into management because I do enjoy project management and that sort of thing. But it was in the academic setting, you completely get away from kind of why you go into it in the first place. And, you know, sitting there going, well, I could do data science. I like that. But I also really like the security side of things.

[7:41] Page Glave: I like breaking things. I like fixing things. So that was a good fit and stuff that I'd always done a little bit of on the side. I remember having Outlook Express back when it was kind of the thing or one of the things you could do email with. Levy virus came through and those things back in the early 2000s. Getting into Outlook Express back when you could right click on an email and pull up the entire email in its text format and going through the headers and things like that. That should have been a clue that maybe tech would have been a good fit for me. Basically just started studying as much as I could and jumping into things and was fortunate enough to get a ticket through a friend of a friend of HUSECON in 2018 and kind of decided at that conference oh yeah this

[8:30] Page Glave: Is the direction i'm going to go into nice and just kind of studied my full head off for the next eight months or so and have continued that but yeah what kind of things did you do when you're you know quote unquote studying what are the things you did so i spent a lot of time on cyber and i've done a lot of bone hubs and pen test labs and all of these really cool online resources that

[8:55] Page Glave: So those were big ones. You know, hack the boxes has come up several times. I've done some book clubs that have really been helpful at going through the hacker playbook three chapter by chapter and writing that up. And that was really educational because one of the aspects of it, you go and build out an active directory domain. And if you can do that on a small scale, it really helps prepare you to do it on a larger scale.

[9:21] Ayman Elsawah: You said book clubs. How did you find these book clubs or like these like meetups and stuff?

[9:25] Page Glave: Well, this one was actually through another podcast. Okay. Breaking Down Security. And they have a Slack and I just kind of jumped in there and found a book club. Nice. Yeah, it's a good resource. I think we're fortunate at this point in time in information security is that we do have a lot of really great resources. Resources for people to learn from yeah they're good folks i met i think it was brian blake at DEF CON last year really cool guy yeah they're good people yeah they are and there's a lot of good people on the slack that you know they'll help with resume reviews and things like that and then awesome do a ton of podcasts really i will say i wish your book had come out like six months earlier

[10:03] Ayman Elsawah: Hey, what's up? I just want to step in here for a second and just let you know that I did not solicit this from Paige at all. She came up with this on her own. So there was no solicitation or anything about the book at all before recording. I mean, I do appreciate her comments, but yeah.

[10:18] Page Glave: Really, I will say I wish your book had come out like six months earlier.

[10:23] Page Glave: Because I think for people looking to get into it, it's such a concise overview of those insider things that it's a really great resource too. I've kind of been like, okay, if you really want to know about getting into information security, listen to these podcasts, read this book. It's crazy because there's so much information out there and it's channeled.

[10:43] Ayman Elsawah: Yeah, I appreciate that. You know, I'm not trying to plug here, but I did write it, you know, for someone who's trying to start from zero. I really like all the stuff that's out there. I wish that was available for me when I was trying to get in.

[10:54] Page Glave: Yeah.

[10:55] Ayman Elsawah: But I think now it's kind of overwhelming, all the stuff that's out there. And so I wrote it in such a way that it's kind of a methodical step by step. But anyway, I don't want to talk about my book.

[11:06] Page Glave: Yeah, it's a big thing. And then we can stop talking about it. Probably the thing in there that would be most, I hate to say most valuable, but was incredibly valuable is talking about the different roles and different aspects of information security. And I think it's easy to see information security and just think it's pen testing.

[11:25] Ayman Elsawah: Oh, my God. Such a pet peeve of mine.

[11:27] Page Glave: Exactly. Yeah.

[11:32] Page Glave: You know, I want to do infosec.

[11:33] Ayman Elsawah: Right, right.

[11:34] Page Glave: Good luck with that.

[11:35] Ayman Elsawah: Yeah, it's almost as bad as the black or gray hoodie.

[11:37] Page Glave: Yeah, exactly. Yeah, but it's a hard thing to kind of learn the ins and outs of an industry without being in it. And I think you've just got to kind of put yourself out there. Meetups are great. Being in the Houston area, there's some really good ones. And I was fortunate, fairly early. Early to go to one and Kirsten Brazier was talking about it and met a couple other women there that we've kind of been supporting each other as we either continue in information security or get into it. And those in-person networking things I think are invaluable, both getting in and then after you are in.

[12:08] Ayman Elsawah: Absolutely. I mean, you said it yourself when you, I think you were thinking about the field, but until you went to that one conference in 2018, right, is when you're like, okay, I can do this or I want to do this. Yeah.

[12:20] Page Glave: Yeah, that was, it was, I'm pretty sure I want to do this.

[12:23] Ayman Elsawah: Right.

[12:24] Page Glave: I have no idea how long it's going to take me to learn what I need to know, you know, to take the foundation that I have and learn enough to actually do the job and then going to Hughes at Con. Okay, yeah, I know I have some gaps, but I feel like I can fill them in relatively quickly instead of going and going, oh, there's no way I could do this.

[12:42] Ayman Elsawah: Yeah. And even for folks who have been in the field for any number of years, I think conferences are a good way to re-energize because... You kind of get drained because security is sometimes almost a lot of times an uphill battle, depending on the environment. And going to a conference just kind of helps reenergize you and kind of reinvigorate you, in my opinion. I don't know.

[13:03] Page Glave: Oh, yeah, definitely. And it's I made the comment, I think last week, like, you know, being in

[13:11] Page Glave: Morning thinking, okay, is this the day that everything's going to hit the fan? I didn't mean it in as pessimistic way as it sounded because that challenge is part of what I like about the job. But it does wear you down. You do this for, I can imagine, five, 10, 20 years. And there comes a point where waking up and going, man, today could be the day where everything falls apart. It's no longer challenging. It's completely disheartening and

[13:39] Page Glave: Are a great way to help save that off.

[13:41] Ayman Elsawah: Yeah. So you've been in the field, quote unquote, for what, five months? Yeah. Are you still feeling the honeymoon period or is it wearing down on you?

[13:51] Page Glave: I think it's still pretty much the honeymoon period.

[13:53] Ayman Elsawah: Okay.

[13:54] Page Glave: And who knows how long that may last, but it's one of those where you get to come in and you're learning so much.

[14:00] Ayman Elsawah: Yeah.

[14:00] Page Glave: I don't really have time to sit around and be like, wait, is this what I thought it was going to be or Is this what I want it to be? And being in a little different position, I think, than a lot of people who transition over mid-career, I still have a lot of autonomy. And I'm able to have more control than say in what I do than maybe your typical SOC analyst. And I think that's been a big advantage for me from coming from a place where I didn't really have anybody who was kind of telling me what to do on a day-to-day basis.

[14:27] Ayman Elsawah: Yeah. And how was it getting into the field? Interviews? Can you walk us through some good or bad interviews that you had and your experience in that?

[14:35] Page Glave: I had a couple of phone interviews and then the job that I got was my first in-person interview. I think the interview process is about what you're going to expect in anything.

[14:48] Page Glave: About tech that you just don't know like have you worked with this piece of technology and you're Mm-hmm.

[14:54] Page Glave: Like no i've worked with this that i think is kind of sort of similar even though i don't think it Really is and that uncertainty i think is always a little traumatic but at the same time it's Impossible to know all the tools in the field just there's no way yeah and And the big thing for me with interviewing, doing some, I did some mock interviews and resume interview and that helped a lot that just being able to go and talk to people about infosec, you know, I thought it was fun. It's like, okay, I'm going to go on an interview, but I'm talking about the stuff that I really enjoy. So it doesn't necessarily matter if I get the job or not, because I get to go geek out for a little bit. You know, that's certainly a position of privilege because I was in a job that I may not have enjoyed as much as I once did, but it wasn't.

[15:39] Page Glave: Job. So I didn't have to have that kind of fear of not getting a job. I knew I could hang out in my current one and do the job well, but also knew that it was coming to an end. Trying to think if anything else stands out, you know, it's just being prepared, doing your homework on the companies, knowing what you're getting yourself into. And I still kind of chuckle at job descriptions. You look at them and you're like, obviously HR wrote this because These certifications do totally different things. And I like seeing that you could have SecPlus or a CISSP, but that also tells me you don't really know what you want.

[16:14] Ayman Elsawah: Yeah. Like having three to five years experience for a junior position. Really?

[16:18] Page Glave: Yeah. We will take SecPlus or CEH. It's like those, okay, I understand there's both kind of entry-ish level certs, but very different focus.

[16:31] Page Glave: Young in some ways that we don't really know what we want in job descriptions a lot of time. That's a tough thing to write.

[16:37] Ayman Elsawah: Absolutely. Yeah. Any bad interviews?

[16:39] Page Glave: None that I left just going, wow, that was horrible. And I may be fortunate that I don't mind public speaking and I'm usually okay talking to people in those interview settings. I listen to one of my phone interviews just going, I don't even know why you were talking to me because you're looking for somebody with five years of experience on a specific tool. And I don't have that. And I can't think of anywhere where I may have given you that impression, but it's a good learning experience.

[17:04] Ayman Elsawah: Yeah, I think with every interview, there's always something to add. I sometimes tell folks, interview jobs that you don't plan on getting or you don't want to get just to get the experience. Yeah. After a couple then save the interviews for the ones you want to get because then you're really built up yeah get the awkwardness out of the way right early exactly yeah awesome any war stories that you can talk about publicly talk about i could i think i can talk about this one it's amazing to me how good fishes are getting because it's always kind of i guess fun

[17:46] Page Glave: I can't believe people fell for that. We had one come in and we were collateral damage. I don't think we were the specific target, but cred harvesting thing. And looking at it, it was exactly the way that Gmail abbreviates messages. So, you know, when you view a message on your phone in Gmail.

[18:04] Ayman Elsawah: Mm hmm.

[18:05] Page Glave: Or a long thread in Gmail web access, and it'll truncate them and basically just say message clips.

[18:11] Ayman Elsawah: Oh, yeah.

[18:12] Page Glave: It was indistinguishable to the human eye.

[18:15] Ayman Elsawah: Oh, wow.

[18:16] Page Glave: That it was different. And it was sad because I'm sitting there going, this was really well done. Seriously, this was a great phishing campaign. And it's like, I wish you would not be so excited about this. I'm like, no, I mean, we shut it down.

[18:31] Ayman Elsawah: That's funny, isn't it?

[18:32] Page Glave: This was a really well done one. And then the same week I got one on my personal email, looked exactly the same. And I'm like, you've got to be kidding me. I'm like, okay, I have to click on this because I have to see if it's actually that. No, it was the real one, but looked exactly the same. The only difference was the legit ones, instead of just expanding to show you the message, the fish took you to a sign-in page. And that was a pretty ingenious campaign. And I completely understand how people fall for it, because when you're checking email on your phone, it's not unusual to click on a link or something like that and get redirected to a login page.

[19:10] Ayman Elsawah: Right. Yeah. And, you know, what are some unique challenges that you're facing in the K-12? I know I had Jared on before and he runs OPSEC EDU, like a nonprofit for security and education industry. So, you know, what are some unique challenges that you're facing there? Yeah.

[19:27] Page Glave: Probably the biggest one is, you know, we have all of the students who are old enough to really be online are a huge insider threat. It's a little bit different type of insider threat than you get in the corporate world. But yeah, it's just like, think about it for some of us. What would we have done sitting with a laptop in front of us for eight hours a day?

[19:46] Ayman Elsawah: Right.

[19:47] Page Glave: And high speed internet access.

[19:50] Ayman Elsawah: Oh, man.

[19:50] Page Glave: I mean, I can just imagine. And it's like, oh, these kids, like, it's hard to resist that. So the number of insider threats is a challenge. One of the other things that's kind of unique is in the typical corporate world, you see maybe two or three login floods a day where you've got just everybody getting on their system. And maybe the start of the workday and then again at lunch in the K-12 space, you're likely to see that in higher education as well. You see that almost hourly because as people transfer classes or shift classes, they're shutting down and then reconnecting. So you have to kind of norm your environment differently to deal with that. You know, when you're dealing with a large industry sized environment on a sled budget, that's

[20:36] Page Glave: Of course, a challenge as well. But I think you'd be hard pressed to find anyone in information security who's just thrilled with their budget. So that's probably not unique.

[20:45] Ayman Elsawah: Right. Yeah. And have you ever had to work with law enforcement in the time you've been there?

[20:51] Page Glave: Not yet.

[20:51] Ayman Elsawah: Mm hmm.

[20:52] Page Glave: I know that it can happen. And we do have an internal police department.

[20:56] Ayman Elsawah: Oh, really?

[20:57] Page Glave: A big ISD is basically a city. And we have 40 plus different sites and a lot of challenges associated with that sort of thing. But no police involvement yet, thankfully.

[21:08] Ayman Elsawah: Okay, that's good. Cool. And so what are the top three things that helped you in particular in landing where you are right now?

[21:15] Page Glave: Probably the biggest one is just being a very self-directed learner because being able to go out and research and that research background certainly paid off because I was able to dig in and find resources and find free trials of things or free tools online. That I could learn as much as possible. So that just being a self-motivated learner. And I think that holds for the industry in general. The second thing would be using the free resources, the online resources.

[21:48] Page Glave: And Professor Messer and all these other things, you have a ton of tools at your disposal. So you have to have that motivation and then you get the resources. And then the last thing that I think helped me was being able to translate that self-directed learning Into something on my resume. And that seems to be something that as I'm involved in hiring now, that I'm seeing some disconnectives. If you've built up a home environment where you've set up Active Directory and you have run different pen testing scenarios, that needs to be on your resume as you're trying to transition in to demonstrate that you have those hands-on skills.

[22:28] Ayman Elsawah: Yeah. Where does someone put that in the resume though? That's kind of a tough place to put.

[22:32] Page Glave: So for me, when I was interviewing, I basically turned my resume on its head.

[22:36] Ayman Elsawah: Okay.

[22:37] Page Glave: Instead of leading with employment, which is I think your norm, my resume started with kind of a skills section.

[22:47] Ayman Elsawah: Okay.

[22:48] Page Glave: And then for my current job at the time, I picked out items that were relevant to my

[22:56] Page Glave: Like with research studies, data security comes into place and risk management. So I highlighted things like that.

[23:02] Ayman Elsawah: Oh, interesting.

[23:03] Page Glave: Then I also had an activity section where I talked about, I've worked through this book. This is my home environment. This is the setup that I have. These are some of the tools I've worked with. I wasn't coming into it as, oh, I want to do information security and I want you to hire me so I can learn how to do it. It's, I'm learning, I'm doing, I'm just not getting paid for it yet. And that's one of the things that I heard on, and I don't even know where at this point, podcasts or whatever. It's if you're talking to somebody in cybersecurity and they can't really talk about their home lab, that's a bit troubling, especially for someone trying to break in. Because if you don't have systems to work on at work, how are you getting this experience?

[23:46] Page Glave: I would like to say that helps me break into the field.

[23:49] Ayman Elsawah: Okay. Yeah. I think employers want to see that you've taken some initiative to start some of this on your own.

[23:59] Page Glave: Yeah, definitely. And I think not being afraid to reorder your resume is important because when you're just looking at resumes and you're having to do it so quickly, if all you're seeing on the front page is a job that seems very unrelated.

[24:16] Ayman Elsawah: Yeah.

[24:17] Page Glave: You're going to have trouble getting looks, but if you can find a way to highlight the work you're doing with information security, I think you can help increase your odds a little bit. Though, realistically, probably the best thing you can do is network and talk.

[24:31] Page Glave: System. But making sure your resume is on point has got to help.

[24:35] Ayman Elsawah: Yeah, I think that's a really great piece of advice. Just reordering your resume so that it highlights right in the beginning what is relevant to the job. Because if you're trying to be a career switcher, you know, being a specialist in exercise science might not be directly... No.

[24:53] Page Glave: I would hope that people look at that and go... This has nothing to do with this job. What are you thinking? Because that's kind of my fault about it. So I had to really be mindful of that and show, well, how does what I've done connect with this? And how have the things that I've done in the past prepared me to work in this field? I bring the things every day that benefited me going through and getting a PhD. You learn certain skills.

[25:25] Page Glave: To work every day. It may not look exactly the same, but being able to relate that to information security, I think helps me quite a bit.

[25:34] Ayman Elsawah: Yeah. And it's kind of like a tournament, right? At the end of the day, the resume, you're trying to just get that first phone interview. And then after the phone interview, you want to get to the next stage and in-person interviews. So these are all part of the steps, right? You know, the

[25:48] Page Glave: You just have to do something that gives someone a reason to take a chance on you. And when you turn in a resume that may look very much like what you've turned in the past, it doesn't give anybody who's looking to interview a reason to say, this person may have potential. That's one of the things that you see as people debate the whole, is there a talent shortage in cybersecurity thing? Well, is it or is it other issues? Is it just people... There's a job shortage, there's a skill shortage, but a lot of people talk about wanting to hire on potential and enthusiasm and talent. But you have to give the people who are looking for that a reason or justification to at least interview. And if nothing, there looks promising.

[26:32] Page Glave: If you can't show potential, then you're never going to get a chance to get your foot in the door.

[26:36] Ayman Elsawah: Yeah. So let's talk about two things. One, your blog, you have a lot of walkthroughs on your blog. Would you say that helped you in getting into the mindset, right? Like writing up the walkthroughs of activities you did? Oh, definitely.

[26:49] Page Glave: You know, it's one thing to read a book or to go through some tutorials and, oh yeah, I get this. But then when you're writing it up and putting it out for public consumption, even though we

[27:05] Page Glave: That it's solid and put it in a way that people could understand. One of the targets that I have is other people trying to break into information security. I want to give them enough information to get where they need to go, but not so much that they don't have to do some research on their own. And being able to communicate that, I think also really helped me prepare for interviews because I'd already written down what I was doing. And once you've written it down, talking about it becomes much easier.

[27:34] Ayman Elsawah: Yeah. Just like anything, if you want to really learn something, teach someone else that item and you'll learn so much faster and thoroughly. So that's good. I recommend everyone check out your blog, apageinsec.wordpress.com. I'll have the link in the show notes. Thanks. One last thing, you know, it's always controversial, but I do see it listed in here about me, but certifications. What's your hot take on certifications?

[27:57] Page Glave: Oh, that's...

[27:58] Ayman Elsawah: So controversial.

[27:59] Page Glave: Certifications versus degrees. No, that's...

[28:07] Page Glave: I think it really depends on who you are and where you're at in your career. Because for me, I wasn't going to invest in doing a degree while I was working in another industry. It wasn't to me the right thing, but a certification was a good way to demonstrate that. If you're in the field, you're working your way. And you're not having trouble getting into the roles that you want, certifications probably aren't that important. And degrees may or may not be depending on the situation. But if you're trying to break in or you're trying to pivot in your career, as much as we like to malign certifications, it's a good CYA thing for the people who are hiring. And unfortunately, I don't think we'll ever completely get away from that gatekeeping.

[28:48] Page Glave: You know, if you're just a prodigy who can do whatever they want behind the keyboard, Probably don't need them. You may be able to get away without them for a good deal of time. But if you need something to demonstrate ability or give some people some confidence or reasons to call you in, they're a good tool for that.

[29:07] Ayman Elsawah: There you go. It's a tool.

[29:08] Page Glave: It's a tool just like anything else. And you should use them strategically. I see people sometimes with certifications and 20 different things and Ooh, that would be fun. But you also have to think about where you want to go. Is a particular certification the best for getting you where you want to go?

[29:27] Ayman Elsawah: Really well said. I really appreciate that. Thanks.

[29:30] Page Glave: That's a soapbox topic right there.

[29:32] Ayman Elsawah: Yeah, it is. Any parting words and advice for folks out there?

[29:35] Page Glave: I think the biggest thing is just keep learning and know when you need to step away. It's easy in infosec for it to turn into a 24-7 job. And you have to keep learning or you're going to fall behind. But it's OK to take a day or a week or a month and just step back and enjoy life and get back into your normal learning routine. Just make it something sustainable because burnout is real.

[30:01] Ayman Elsawah: Yep. Did you experience any burnout when you were learning?

[30:03] Page Glave: Not really with learning. I've had burnout in the past. I kind of know what to look for with it. And when I get to the point where I start to recognize.

[30:16] Page Glave: Just putting it aside. And it's hard because you want to learn everything and you want to get better and you want to do things. But there are periods of time and periods of your life where it's, you know, I'm going to do my learning and do my job. And outside of work hours, I need to be focused on other things. And it's just getting to know yourself well enough to know whether that's an excuse or a need.

[30:38] Ayman Elsawah: Interesting. Well said. Thank you. Well, Paige, thanks for the words of wisdom. It was really fun talking with you.

[30:44] Page Glave: Oh, thanks. I've enjoyed it.

[30:45] Ayman Elsawah: And yeah, look forward to meeting in person.

[30:47] Page Glave: All right. Yeah.

[30:48] Ayman Elsawah: Awesome.

[30:48] Page Glave: Sounds good.

[30:49] Ayman Elsawah: All right. Thanks. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon.