Episode 43 · · 40 min
Rana Khalil From Cryptography to Pentester!
Senior Cybersecurity Assessment Analyst (pentester) in the financial sector
Episode summary
Journey into Cybersecurity and OSCP Certification with Rana Khalil
This episode features Rana Khalil, a Senior Cybersecurity Assessment Analyst with a rich background in pen-testing, especially in the financial sector. Rana shares her non-traditional entry into technology, starting with a dislike for her first laptop and phone, transitioning from biochemistry to a math degree, and eventually finding a passion in computer science, leading her to cryptography and cybersecurity. Her academic journey includes significant work in cryptography, under the tutelage of Carlisle Adams, and a master’s project on web application vulnerability scanners. Rana discusses her motivation and relentless pursuit of the OSCP certification, highlighting the importance of hands-on experience, teaching, and documenting the learning process through write-ups. She also conveys the value of previous experience in related fields, the significance of specializing and pacing in learning, and shares insights into her career progression, including valuable advice for people aspiring to enter the cybersecurity field.
Thank you for listening!
Before infosec: Mathematics and cryptography student, QA co-op
Chapters
- 0:00
Intro: Rana Khalil and her OSCP journey
Ayman introduces Rana, her conference talks and her OSCP write-ups.
- 2:44
From biochemistry to math, computer science and cryptography
Rana explains switching degrees, her homomorphic encryption honours project and her supervisor Carlisle Adams.
- 7:38
A QA co-op that led to web application security
Asking to test her company's apps for security led her to buy The Web Application Hacker's Handbook.
- 10:03
Master's research on web vulnerability scanners
She found open source scanners caught less than 40 percent of vulnerabilities, especially on modern apps.
- 12:56
Landing her first security job through a BSides talk
Her mentor encouraged her to present at BSides Ottawa, and her future manager attended.
- 14:58
Studying for the OSCP with Hack the Box write-ups
She worked through TJ Null's list with IppSec's videos and wrote up each box.
- 18:53
Going back into the OSCP labs and passing
Armed with prior practice, she finished the course exercises in two and a half weeks and reflects on tunnel vision.
- 22:48
OSWE and who should take it
Rana says the OSWE is a white box, code review certification that is not for complete beginners.
- 25:07
Life as a pentester: specializing and prior experience
She advises focusing on one area and says sysadmin or developer backgrounds are an advantage.
- 32:07
Common mistakes and pacing your learning
Rana explains that employers expect existing skills, and urges using free resources while not trying to learn everything at once.
- 37:07
Why source code and fundamentals matter
Ayman and Rana discuss code review expectations for pentest teams and learning fundamentals before breaking them.
- 39:01
Closing: Ayman's new community
Ayman thanks listeners and points them to the show notes link for his new community.
Key takeaways
- Ask to do security testing in your current role, as Rana did during a QA co-op, to gain real experience.
- Share your research at conferences like BSides because it can get you noticed and even hired.
- Prepare for the OSCP by working through Hack the Box machines similar to the labs and writing up each one.
- Writing up what you learn exposes gaps in your understanding, since you only know it if you can explain it.
- Specialize in one area first, then expand once you are comfortable instead of trying to learn everything at once.
- Previous experience as a developer or sysadmin is an asset in security, so apply for security jobs while you keep building those skills.
Notable quotes
you learn more by writing it because if you can explain something properly to someone, then you know you properly understand it.
previous experience in other fields really matters in security.
if you focus on one area, you become really good at that area.
Questions answered in this episode
- How did Rana Khalil become a pentester?
- Rana studied math and computer science and fell in love with cryptography, then moved into web application security after a QA co-op at a security company. She researched vulnerability scanners for her master's, presented at BSides Ottawa and was hired as a pentester right after graduating.
- How did Rana Khalil prepare for the OSCP?
- She did TJ Null's list of OSCP-like Hack the Box machines, watched IppSec's walkthroughs and wrote up every box. She then returned to the labs and completed the roughly 800-page course material and exercises in about two and a half weeks.
- Should beginners take the OSWE?
- Rana does not recommend it for complete beginners. She suggests having a year or two of web application testing experience and being comfortable reading code and scripting before attempting it.
Show notes and links
Show the original episode notes
Journey into Cybersecurity and OSCP Certification with Rana Khalil
This episode features Rana Khalil, a Senior Cybersecurity Assessment Analyst with a rich background in pen-testing, especially in the financial sector. Rana shares her non-traditional entry into technology, starting with a dislike for her first laptop and phone, transitioning from biochemistry to a math degree, and eventually finding a passion in computer science, leading her to cryptography and cybersecurity. Her academic journey includes significant work in cryptography, under the tutelage of Carlisle Adams, and a master’s project on web application vulnerability scanners. Rana discusses her motivation and relentless pursuit of the OSCP certification, highlighting the importance of hands-on experience, teaching, and documenting the learning process through write-ups. She also conveys the value of previous experience in related fields, the significance of specializing and pacing in learning, and shares insights into her career progression, including valuable advice for people aspiring to enter the cybersecurity field.
00:00 Introduction and Guest Background
01:47 Rana's Journey into Cybersecurity
02:45 Rana's Early Interest in Mathematics and Cryptography
05:47 Transition into Computer Science and Web Security
10:52 Master's Research on Web Application Vulnerability Scanners
13:02 First Security Job and the Impact of Public Speaking
15:11 Journey to the OSCP Certification
17:36 The Value of Self-Study and Accountability
18:53 Reflections on the OSCP Experience
20:59 Understanding the OCP Exam
21:13 The Importance of Lab Time
22:18 The Value of Documenting Your Journey
22:49 Introduction to the OSWE Certification
25:07 The Role of Experience in Security
25:16 The Life of a Security Professional
25:25 The Importance of Specialization in Security
26:24 The Value of Previous Experience in Security
29:55 The Challenges and Rewards of Pen Testing
30:43 The Balance of Work and Personal Time in Security
34:58 The Importance of Focusing on One Area in Security
37:07 The Importance of Understanding Source Code
38:11 Final Thoughts and Advice
Thank you for listening!
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
In the sense that, wow, you're able to create something from nothing when it comes to software development, creating programs. It felt the same way. Just the ability to do something that you didn't think was within your reach.
My latest guest is Rana Khalil. Rana is a senior cybersecurity analyst and has an amazing professional background. She has spoken at many different conferences, including B-Sides, ISSA OS, Ottawa, and Hackfest.
I admit that I want to finish all the boxes and he just kept updating them. But even looking back, I'm glad that he did because the OSCP is not just about getting the certification, but actually knowing how to pen test and the more experience you gain, the better.
Rana was relentless in her pursuit of the OSCP and knew that the best type of learning is by doing.
If you can explain something properly to someone, then you know you properly understand it. But if you can't, then there's definitely certain areas in your understanding that you didn't know were lacking.
Another tried and true method of learning is to teach. This episode will surely motivate and help others looking to obtain certifications in full-time careers in information security. Please share with us your greatest takeaways from this episode by tagging us on social at GetIntoInfosec. All right, on to the show.
My guest today is Rana Khalil. She is a senior cybersecurity assessment analyst and has a really diverse professional background. She has spoken at many different conferences, including B-Sides, ISSA, OWASP Ottawa, and Hackfest. And she's recently received the OSCP, a coveted security certification out there in the community. If you haven't heard of her, she has definitely written up and done tons of write-ups on the OSCP and different Hack the Box write-ups. Okay, as you can see, I'm totally messing it up.
That's okay. I'm probably going to do the same, so it's all good.
Yeah. So let's just hop into it. So hi, Rana. Welcome to the show.
Hi, Eamon. Thank you for having me.
Yeah, I've been looking forward to this episode for a while. And we've been connected for quite some time. And I've been following your path into security. And here we are. So I'm really excited to talk with you today.
Thank you.
Great. So for those out there that may not know who you are, can you take a second and tell us about yourself and what you do today?
I'm currently a pen tester in the financial sector, so I moved to this team a month ago. I do not have the typical story growing up that most hackers do, where they grew up interested in technology and wanting to break things and put them back together. In fact, I remember when my dad got me my first laptop, I remember saying thank you and then telling him to give it to my younger sister because she'll make more use of it than I will. And the same thing with my first cell phone. And this lasted until university. I didn't start out in tech in university. I did a full year of biochem. And after a full year, I realized that I hated biology. But I loved calculus, so the mathematics courses that were part of my degree.
And so a year after that, that's when I decided to switch to a mathematics degree. But because I knew that there were very little jobs in that field, As a backup plan, I decided to take a computer science degree. And it was just a backup plan, but that was probably one of the best decisions that I made in my life. Because as the degree progressed, I realized I kind of had a love-hate relationship with mathematics. I loved math, but it hated me. It's just like when you get deeper and deeper into it and the more abstract the concepts become and the more difficult it becomes to relate them back to applied mathematics. So through my journey of trying to make sense of it, that's where I came across cryptography.
I think that's the first security related field that I came across and I still do. It's an amazing field and in another life I would be a cryptographer. But anyways, that was the first security related field I got introduced to. I ended up doing my honors project. So my bachelor's honors project in scale invariant fully homomorphic encryption over the integers. And for anyone listening that doesn't know what that is, it's a type of encryption that allows you to perform calculations on encrypted data without having to decrypt it first. It wasn't like conjunctured to be true. Well, it was conjunctured in 1978 by one of the guys that created RSA. And it was, I think, a year after RSA or around the same time as RSA.
But it was only proven to be true in 2007, which is not too long ago at all.
That's amazing. That's pretty cool.
Oh, I was just going to say, and what's even cooler is the professor that I did it with, like that I did my honors project with and ended up being my master's supervisor was actually pretty well known in the cryptography circles. He created an algorithm called CASP. His name is Carlisle Adams, and his algorithm was called CAST, and it competed with AES back when this created the competition for a new algorithm that replaces DES. It was an amazing field, and I had been set to do my master's in it, but then things took a 180 turn when I did my last co-op term, and that's how I ended up in the field that I'm in right now.
Okay, so there's a lot to unpack there. So did you discover cryptography before or after computer science?
During my computer science degree, towards the end, because there was a course specific to cryptography that I took.
And was it optional?
It was optional.
Oh, wow. Okay.
Yeah. But because I love math, I specifically picked the computer science courses that mathematics-related, so discrete, what was it called? The courses that were related to math. So most of my courses were not actually in software development courses, theoretical computer science courses.
Oh, really? Okay. Okay. How did you feel when you discovered that there was a conjunction between math and computer science?
Amazing. I absolutely loved it. Because like I said, when you get deeper into math, it just becomes so abstract. When numbers start, there's no number at all on the paper that you're studying. And it's all letters. That's when you know you've lost a grip on reality. Obviously, they all have real applications, right? It becomes so difficult to relate it back to reality. And so when I discovered cryptography, which is real applied math, it was amazing. Like I love the field and I still do.
What are some good cryptography courses that people out there can study? I know about Dan Bonet's cryptography course on Stanford, but there's that you would recommend to folks out there?
I was just going to mention that one. I haven't studied ones online. It was purely through what I studied in university. I know, I don't know if I say it correctly. It's Siberia, is that right?
Siberia?
Yeah, they have a couple of courses, but I personally haven't done them myself to recommend them.
Right. And so stepping back to your transitions, what was that turn that happened at the end of your master's that you're referring to?
So beginning of my master's, it was my last co-op term of my bachelor's degree. As usual, I was right in the fact that there aren't many job opportunities in the mathematics field. That's why every co-op term, that means work term, every work term that I had, it was always in computer science and it was always in software development. And so the last term just happened to be in a small security company. And I was working in quality assurance as part of the QA team. Like I tested, we had automated test cases that we ran on the applications that were developed in-house. And as part of the team, I was like, well, we should not just test that the applications are functional. We should also test if the applications are secure.
And so I asked my supervisor if he would let me take some time out of my day to test the security of the applications. That we were developing. And I told him that I knew how to do it because we did it in school. And to my surprise, he said, yes. And that's when I realized do something that I actually did not know how to do. And so I remember that day I went back home and I went on Amazon and I bought the application hackers handbook, which is those that don't know. It's like the Bible. It's considered the Bible of web security.
Right, right. That's right. Yeah.
Yep. And I remember like I would spend all night reading it and then I would go back to work and test out and implement what I learned. And that's how I got introduced to the area of web application security. And through that, I got introduced to web application vulnerability scanners, which are automated tools that are used to crawl your web application and look for vulnerabilities. It was just like when I found out that there are such tools, I was like, oh my God, that's so amazing. They do what took me so long to learn to do, right? And that's how they're advertised as well as point and click tools that will find all the vulnerabilities in your application and you'll be secure if you use them.
So, yeah.
Knowing the manual way how to do it, of course, is always really beneficial and it'll teach you how the tool works, right? So I'm sure there's no time lost in doing it manually at first, right?
Oh, I'm getting there.
Oh, okay. Sorry.
Yes. The conclusion was definitely no time loss. That's when like, just because of how powerful they are and how much time I had spent into studying it and how I thought it was, it's just pretty amazing that the scanner understands the logic Of the application and can find like the types of vulnerabilities that I'm able to find. That's when I decided I'm not comfortable using these tools unless I know how they work. And that's where the 180 degree turn took because it was even more practical than cryptography. So like in cryptography, yes, it is practical, but then once you graduate There are very few cryptography related positions, right? The algorithms are already there. There's a lot of positions right now for quantum cryptography because that's a new thing right now.
But this was way more practical. So that's when I convinced the same professor that I told you about. He was a little bit disappointed, but he agreed that I should do what I'm passionate about and what I want to do. And that's when I asked him that if it's okay that he stays my supervisor, but I do my master's degree in comparing open source web application vulnerability scanners and understanding what their limitations are and how they work. And the conclusion of that was these scanners, they're advertised to do something that they don't actually do. I would say like my research showed that they find less than 40% of the vulnerabilities and The vulnerabilities that they do find are low hanging vulnerabilities.
And if the application uses like the more modern technologies that the application uses, the less, the lower the percentage of vulnerabilities found because crawling is apparently a very important factor. Because if you can't even get to the vulnerability, you're definitely not going to find it, right? And crawling the application, it was just like some of the scanners had difficulty with AJAX requests or just modern technologies. If an application is built solely in Node.js, You need a scanner that is able to crawl Node.js before it even looks for vulnerabilities in the application. So that was very insightful. Well, the knowledge that I gained from the master's degree that I did.
Yeah, that's amazing. So is that research paper available? Can people read it if they wanted to?
It is. I can send you the link after.
Awesome. I'll put in the show notes and walk us through your first exploit. You've bought the web hackers handbook, right? And given the green light to assess and test the application. How was that? Walk us through like the first time you, you were able to exploit something or take advantage of something.
So I don't exactly remember what the bug was that I exploited. But yeah, the first time is like when you developed a program in the sense that, wow, you're able to create something from nothing when it comes to like software development, right? Creating programs. It felt the same way. Just the ability to do something that you didn't think was within your reach.
Yeah, that's amazing. That's cool. So now you're doing your master's, you're scheduled to graduate. Walk us through getting your first security job. Did you get it right after graduating or did it take some time?
I did get it right after graduating. I had applied to the job that I'm currently in. And it just so happens that there was the B-Sides Ottawa conference at the same time, timeframe as the interviews for the job. And Tanya Jenka, I think you know her, at the time she was my mentor.
Yeah. Oh, wow. That's cool.
Yeah. And she had convinced me and encouraged me to give a presentation at Besides Ottawa about my research, about my master's research. So I asked supervisor when I first started. He was also attending Besides Ottawa. And so he attended my talk. And apparently that was one of the prominent reasons that he decided to hire me.
Wow, that's awesome. That's amazing. That's the second time I've had a guest say that they were hired because their future manager saw them in the audience. So that's the lesson learned there is you have something to present, you know, just present something. I think Tanya said this, that there's always someone else that could benefit from what you have to say, right?
Absolutely. Yeah. And she played such a huge role. I would have never done it if it wasn't for her. I remember she even sent the organizers that she's going to speak and she's amazing and you should accept her. And so she played a huge role in getting me to speak at the conference.
Yeah. Tanya is awesome. We've had her on the show before and she's just an amazing human being. So that's really good to know. And there is, for those out there, there is a lot of imposter syndrome about trying to speak. I mean, I've had it before. Sometimes I still have it, but like I never tried to give talks and stuff, but you have to put yourself out there, right? So that other people can discover you and for your own benefit, just so you can share what a research or knowledge you have with others. So
Yeah. If you benefit even just one person, it's worth it.
Yeah. Well said. I've seen you do a lot of write-ups. I think I was also watching you go through the OSCP. So, you know, it wouldn't be just to have you on without talking about the OSCP, I guess. So, and some of the things you did was chronicle your path throughout. Maybe you could share some of that with us. How was your journey to the OSCP? And looking back, are there things you would have done differently?
I'm trying to remember. It feels like it's been forever.
Yeah.
I had started my OSCP right when I started work, but I was a complete, so like, no, the OSCP is not just web security stuff, which is what I knew. Everything else I had zero experience in. And we were still with the old version of the OSCP, which is not as detailed as the newer version right now that they came up with last year. So I had zero knowledge in the other areas of pen testing. So I found it really difficult to follow the course material and be able to actually solve boxes in the lab and so on as a complete beginner. Between work and having to study and like a bunch of other things in my life, I ended up letting my lab time pass. And just not working on the OSCP. And then I promised myself, though, that when I do get into back into the labs in the OSCP, I'm going to be completely prepared to even just like do the exam.
So I will go back into the labs and I will do the labs. But before I even do that, I want to be like in my head prepared enough to do the OSCP exam. So that's when I started studying for the OSCP on my own, so outside of the course material and outside of the labs. I remember looking for resources online and finding TJ Null's list of Hack the Box OSCP-like boxes. These are boxes that are in Hack the Box, and they're similar to the boxes that are in the OSCP labs. So I started doing them one by one and watching Ipsac's videos. So he does videos for walkthroughs for Hack the Box. And this way, I kind of learned his methodology of how to solve boxes. And I remember being adamant to do all the boxes.
And every couple of months, DJ Nell would update them. And I'd be like, oh my god, my goal just got further away.
That's funny.
Yeah, because like I said, Adam meant that I want to finish all the boxes and he just kept updating them. Even looking back, I'm glad that he did because the OSCP is not just about getting the certification, but actually knowing how to pen test and the more experience you gain, the better. And so I started doing the boxes. I wanted to hold myself accountable on finishing them. So I came up with the idea of doing write-ups, which a lot of people do for Hack the Box. But I think I remember Tijanel commenting on my Twitter that I was the first one to actually complete the entire list and write about it. Which is awesome. But yeah, I started documenting them. I would post to, I think I started with one write up a week and then I just taking too long because there was like 50 boxes or a little bit more.
So I started doing two a week and sometimes three a week. It felt like it was a full-time job. Like, Doing it and then writing it up and making sure it's presentable, so on. And people started responding to that, surprisingly. And they like my write-ups. They like the way I explain things. I do have to mention that did motivate me even more, like at times where you feel like, well, I already know what I'm doing. Why am I writing it up? It helps that someone out there says that they benefited from the write-ups. Because I owe a lot of gratitude. I don't know him, but I owe him a lot of gratitude, IPSAC, or all the videos that he puts out there. So just knowing that someone out there values my write-ups, even if it's just one person in the same way, that's enough for me to do them.
So once I finished in all the boxes, I decided to go back into the OSCP labs. At the time, they had updated the material. They Implemented pretty much everything that I would have complained about after getting the OSCP because I wanted to get the OSCP first before I started complaining. But in the update, they actually implemented everything that I thought was missing. And now that I had like the document itself, the course is like 800 pages or like 900 pages. And just because I already had that knowledge and that experience, I was able to finish the like 800 pages in two weeks, including all the exercises that they have in that document in two weeks and a half.
What 800 pages?
They give you like a lab manual. Oh, okay.
Lab manual. Okay. Gotcha.
In that manual, if you complete all the exercises, I can't remember exactly, but my final like lab report for just the exercises, not the exam report was like over 200 pages. And just like doing that in two weeks and a half, the only reason I was able to do that was because none of the material was new to me. I had all learned it on my own through my like Personal journey of studying for it the past i don't know like eight months oh wow amazing that's amazing okay Yeah. And then I spent the rest of the time in the labs. And one thing that I do regret is not spending enough time in the labs because I was focused on getting the certification. Because after spending this much time on it, you have tunnel vision, obviously, right?
You're like, I spent so much time on it. There's no way I'm not passing right now, which is the incorrect way. I'm not approaching like the OSWE. That's the next cert that I'm doing. I'm definitely not approaching that cert that way. For the OSCP, I had approached it that way. So I was focused on getting the certification because I felt like it validated what I knew and I needed that validation. But I don't right now.
What do you mean you would have spent more time in the labs? What would you have done more?
Oh, like solved all the boxes in the labs because the labs are not just like individual boxes. They're connected just like a real network would be.
If I understand correctly, like I'm trying to think from the perspective of someone who doesn't know what the OCP entails. Is it that you just did the minimum number of boxes to pass? Is that what you're saying? And you would have spent more time just to get all the boxes you can? Is that what you're saying?
Well, there is no minimum number, right? You don't have to do any labs if you don't want and you can pass the exam. It doesn't matter as long as you can't buy the exam itself. You have to buy the lab time. But I know people who didn't even touch the labs at all and just did the exam. Yeah.
Oh, I see. I see the labs. I see. Gotcha.
Yeah. So for me, like, no, I didn't do the minimum. I actually did a good portion of the labs, but I do wish that if you talk to me then, like, I'd be like, no, don't talk to me until the OSCP is done. So I had like before OSCP and after OSCP time once that's it.
Oh, that's funny.
Yeah. I was like super focused because it was something that I had spent so much time and so much work studying for. I wasn't not going to get it.
I see. But you still have access to the lab even after you pass, right? So it's like a prearranged amount of time. Is that right?
Well, it depends. So if you do the exam during your lab time, then yes, you'll have access to the labs. But I did the exam after my lab time. I had just registered in a shorter period of lab time than, yeah.
Okay. That's amazing. I mean, there's so much there, as you mentioned, about writing up and doing write-up. One of the things I think a lot of people say is to catalog your journey, right? So it helps you collect your thoughts and organize and really verify the stuff you're doing as you're writing it, right? Because you want to make sure that it's perfect.
So you learn more by writing it because if you can explain something properly to someone, then you know you properly understand it. But if you can, then there's definitely certain areas in your understanding that you didn't know were lacking.
Yeah. So tell us about the OSWE that you're currently going for right now.
Yeah. So that cert is the OSCP is advertised to be more beginner friendly. The OSWE is rated as intermediate and it focuses specifically on web application security. And the way it approaches it is not from black box perspective, but from a white box perspective. So it's very, very heavy on code review and finding vulnerabilities by reviewing code. And like if for anyone listening and wondering if they should do it, I personally do not recommend doing it if you're a complete beginner because it's not catered towards beginners. I think you should have at least a year or two of web application and testing experience before you approach that cert or you wouldn't appreciate it for what it is. It is an amazing cert and the content that's taught in the cert is amazing and
I don't know how the instructors found the vulnerabilities that they found. It's just amazing. But from a perspective of a beginner who hasn't even done black box pen testing when it comes to web applications, which is much easier than white box pen testing, they might not value the search for what it is.
Okay, that's useful. What if you have experience like bug bounty hunting? Would that be applicable?
Yeah, so most of bug bounty hunting is web apps, right? So yeah, it would definitely be applicable. Like you'd be able to create yourself. The applications that are being used are syllabuses online, it's public, and they're open source applications. So you'd be able to evaluate yourself if you think you have enough experience and you're comfortable with reading code. Then go for it. If you're not, then maybe you should spend a couple of months just learning. I had a software development background when I started it. So that wasn't an issue. But if you're starting from scratch when it comes to coding, you definitely need to know how web applications work. You need to be able to read web app code.
You also need to be able to write in a scripting language because all the attack vectors are scripted from like zero to end. It's just like a point and click. You have to write a script that does all that for you. And if you don't have any experience in scripting languages, your three months lap time is going to pass by while you're just like learning how to use Python, for example, and it's not a good use of your time.
Cool. So let's shift gears a little bit and talk about the life of a security professional. It's been a couple years now as a full time security professional. What are some reflections you could share with the audience in your career so far?
For me, it's been two years. I do consider myself relatively new to the field. One thing that I will mention is when you get into the field, you'll realize that there is so many different areas of security that you can specialize in or even learn about. And as a beginner, something that I suffered with is wanting to know everything all at once. So pursuing, trying to know everything all at once and learning everything all at once just led me to have like very, very basic understanding of the areas that I was learning versus actually sitting down and focusing on one area or two areas and having a proper understanding that you would be able to do your job in that area. So one thing that I do recommend as a new person in the field, as a beginner in the
Find out what interests you in security, what field of security interests you, and just sitting down and focusing on the area until you're comfortable with it. And then once you're comfortable with it and you want to learn more about a different area, then move to that area. That's one thing. And the second thing that I would say is previous experience in other fields really matters in security. So it's not just a matter of I'm going to give you a course like a certification or a book and that's it. You know how to do pen testing. If you have a background in software development, that's going to really help. If you have a background as a sysadmin, that's going to really help. So on it just people who are in those fields and want to break into security think that they've wasted their time but they haven't at all your background is going to be very handy once you do enter security so just be patient apply to security jobs while you do your normal job but know that your time is definitely not wasted with the skill sets that you have are developing i guess
Yeah, there's a lot of people out there that say go in somewhere in IT first. If you're having a hard time going directly into security, which can be challenging depending on the industry and area you're in. So if you're having that difficulty, then go somewhere in technology. And at least that experience will help feed into security. Just have the security focus. But so many times I've heard all these experiences culminating together in their current security job.
And you will have a skill set like other people who just started in security from the beginning of their career don't have. Like, for example, like with web apps, right? Someone who has developed web applications for, I don't know, 10 years and then entered the security field and started learning web app security will probably be better at it than someone who just, the first thing that they learned was how to pen test web applications. Because the person who has a software development background actually knows exactly how web application works. They know exactly the logic of developers, the mistakes that they're going to do and so on. So they will be better at that job than you are if you entered it from the get go.
So I always say, if you want to specialize in the area, you're going to have to develop these skills while you're in security anyway. So if you're developing them before, good for you.
Yeah, absolutely. 100,000%. That's amazing. There's a lot of pentesters that don't know basic sysadmin stuff and vice versa. So there is a threat of being very tunnel vision and not having the big picture. And so are you sometimes communicating with developers? So you find the vulnerability and then you have to discuss that vulnerability or get someone to fix it, I imagine. How's that experience been? Do you have to explain it and kind of step back or walk us through that?
So far, so good. It really depends on the team. But yeah, you explained the vulnerability. I think from developers, most of the time, the reaction is positive because it is their code and it's like their baby, right? It is their code and they want it to be the best that it could be. And so the reaction is mostly positive. They go like, oh, wow, cool. I didn't know that you could do that. And I know exactly why this vulnerability is occurring because they developed it, right? They developed the application and they would fix it. Sometimes there's resistance from teams. You really experience all of it. It depends on the team, really. But most of the time it is a positive reaction.
Okay, yeah, okay, great. And I don't know what, I guess, I don't want to dig too deep into your work, because I know they might be a little sensitive for that.
As long as it's general, I mean, it's okay.
Yeah, okay. Are there any war stories you could share with us, either where you've discovered something or any war stories you could share with us from either somewhere you've worked or anywhere you've been online?
Yeah, you're right. I can't talk about that because I've been in one place this entire time. So it's so obvious.
I know, right? Yeah.
Yeah. And I know people will listen to this. So including the people who like the project teams that I tested applications for. So yeah.
We could actually say, make a theory. Are there any war stories you've heard of that you could share with us? But I don't know. Do you do bug bounty or no?
No, I don't.
You don't participate in bug bounty. Okay.
No, no one has that time. Yeah. So, okay.
I don't get to talk about that. So tell us, you work full time. So let's talk about like all the things that are out there. So there's a lot of attraction to being a pen tester out there. But as you mentioned, there's so many different jobs in the information security field, right? AKA cybersecurity field. So for those out there that are just kind of really focused on being a pen tester, what is something you could share? And I know you're a pen tester, but what are some other jobs outside of pen testing that can use pen testing skills?
Wow.
Yeah, that's kind of a tough one.
A bunch of jobs. I would say like there are detection engineering is becoming a big thing. And in order to know what to detect on like the MITRE ATT&CK framework, it would be useful to work with pen testers to see how they even attack things and like the Tactics and techniques that they use. So that's one thing that would require a pen tester skill set. Let's see. Again, application security, there is a security testing component to it, which is related to pen testing of web applications. Yeah, I'm sure there are others. I just can't think of them right now.
Yeah, yeah. I think we have a couple more questions. Is there anything we didn't talk about that we should discuss?
I don't know. I'm just going to be sure I made note of the questions that you were going to ask. No, we covered all of them.
Yeah. Okay.
Yeah.
I could ask a question about like degree versus no degree. I don't know if you've come up. Okay, how about this? So what are some mistakes that you see are being done out there that you can share with the audience that maybe might help them accelerate their career or save them time? Written up a lot about the OSCP. So you've sought out a certification. You've done a lot of things. You've talked to a lot of people out there. I'm sure. So what are some mistakes you're seeing people make out there? If you had three pieces of advice for people out there, what is common mistakes you're seeing being done out there for people trying to get into the security field that you would ask people to stop making that maybe that can help them accelerate their career a little bit or prevent them from wasting time?
Well, it depends on the person, right? Like one of the things that I've seen happen is people thinking that you won't gain the skill set in order to do your job until you get the job and you get trained on the job. However, that's not the case at all with security. Most employers want you to already know what you're doing. And I think that expectation comes from the fact that there are so many free and almost free resources online that you can use in order to improve your skill set and build your skill set. So I can say bar is high when it comes to hiring people, whether that's incorrect or not. I'm not going to get into gatekeeping and so on. One thing that my advice would be, there are a lot of resources online for you to build your skill set.
It's just a matter of having the advantage of like having the personal time dedicated to do those things. So I guess my advice would be if you are in, if you do have the...
I guess don't wait for getting the job to get the experience or...
Yeah, but what I'm trying to say, I guess, is if you're fortunate enough that you can dedicate some of your personal time into learning the skill set, because I know some people don't have that personal time. If you're fortunate enough to have that personal time, I would dedicate a large portion of my personal time to improve my skill set. At least that'll get through the door from the beginning. At least that'll get you through the door and then you could slow down Your pace of learning a little bit because you are spending eight hours, for example, if it's a full time job, eight hours a day learning that material. So you could slow down the learning in your personal time. I feel a large curve when it comes to studying security because it's mostly not taught in schools, especially if you did a degree that is not security related.
Even when it should have been like in software development, you're supposed to learn how to code securely, right? And that's not really taught. So there is a large curve at the beginning to get into security and to build your skill set. But there is also a bunch of resources online that will help you get there. So that's one. Second one for the complete opposite people who are like me, who will dedicate an insane amount of their personal time trying to learn everything and then get lost between the material. I would say pace yourself down. You could go slower, pace yourself and just focus on one area and become really good at that area. At least you'll become functional in that area. And then once you are, start exploring other areas.
For me, it was web security. I am pretty good at it and I was good at it when I got my first job and that's what got me my job. So once I became like really comfortable with that area, I decided I wanted to experience more of the holistic approach of pen testing, right? And all the different areas. And that's why I pursued the OSCP certification. And then when I did get it, I came back to web security and I was like, well, I know how to do web security, but I've actually never done Source code review. And that's something that will level me up in, in the area of web security. And so I came back to it. And then after that, I'm going to switch completely, I think I want to be more involved in like infrastructure pen testing.
But the idea is that to pace yourself, don't try to do everything at once, or your best, you just have a basic understanding, which is not really helpful in the workforce.
Yeah, I'm glad you touched upon that because I think people get overwhelmed with all the information that's out there and they start getting distracted and go into different directions. So I've been a victim of that myself. So I guess pace yourself is what you're saying and just focus and set your mini goals. Is that what you're saying?
Absolutely. Yep, that's what I did. I definitely did get lost at the beginning. And then this is where imposter syndrome kicks in. But if you focus on one area, you become really good at that area. And then you always have that area to fall back on if other areas don't work, right? So once you become really good at an area, you start moving around into other areas, see if you like them more. And then maybe you want to specialize in those areas. If not, you know, you still have that one area of pentesting that you're really good at. That would help you do the job that I guess you've been hired to do.
Yeah. And having an understanding of source code is really important. I know all the applications that are out, a lot of them are web-based. So when a company hires a pen test team, they expect that team to review the source code and also test it from a white box perspective. So knowing that source code, it's even an interview question. I've been asked before, how would you store passwords? How would you do password storage? So write some pseudocode to do like a password storage mechanism, for example. So Knowing how to do some of the basics from web application security is really important.
Absolutely. And I think it all goes back to not even just web app security. It all goes back to understanding the fundamentals before you learn how to break them. If you have that understanding of the fundamentals, it'll go a long way when you're learning about the misconfigurations and about the certain vulnerabilities that might exist. Because at that point, you actually have the fundamental knowledge to get you through the next step of learning, I guess.
Okay, cool. Any parting advice you have for folks out there?
I don't know. Like most of your guests. I already mentioned that, right? A couple of times.
Yeah. Okay, we could skip it.
Sorry.
No worries. I let silence do the talking. So sometimes things come up. It's a tactic. So Rana, thank you so much for coming on the show. I really appreciate the wisdom you've shared. Thank you so much for all the write-ups that you do. I absolutely love them. I love it when anybody tries to take something complex and explain it. We really appreciate all the work you're doing and look forward to hearing more and seeing more on your journey.
And thank you for having me. And thank you for organizing a podcast that actually makes it easier for beginners to get into infosec.
Yeah, my pleasure.
You're definitely doing your part.
Oh, I appreciate that. At least I could do. Well, thank you so much.
Thanks.
Thank you. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon.
