Getting Into Infosec, Episode 30: Tanya Janca - From Insecure Developer to Appsec, Diversity/Inclusion Advocate, and Mentor
Published February 23, 2020 · 39 minutes
Episode page: https://www.gettingintoinfosec.com/episodes/tanya/

[0:00] Tanya Janca: Information security, we need you. We do. We need all of you. We really need the help. We're not winning right now. You know, a group of person, right? We need everyone. We need people in wheelchairs, please work a sec. Put like every type of person, old people, young people, like you just got out of school, great. You've already been an assistant for 20 years, great. We want you.

[0:34] Ayman Elsawah: Welcome to Getting Interned for Sec. I'm your host, Ayman Elsawah. My guest this week is Tania Janka, aka SheHacksPurple. Tania is an awesome giving person. She's a huge proponent of mentoring, diversity, inclusion, and application security. She's quite involved in the community from starting her own company to running her own OWASP chapter for four years in Ottawa, founding a new OWASP chapter in Victoria, and co-founding the international women's organization, WOSEC. Her full bio is in the show notes. Tania's journey was one of discovery and fascination.

[1:01] Tanya Janca: And I thought I really wanted to be a penetration tester until I discovered that there's this weird spot in between software development and like in between red team and blue team that I was just like, oh, that's the best part. Because, you know, I find a vulnerability, but then I show the developer how to fix it. And then I teach all of them about it because it turns out all of them are making this mistake.

[1:24] Ayman Elsawah: We talk a lot about mentoring and missteps people make when first starting out.

[1:27] Tanya Janca: Wow, like you don't have to spend money at the beginning necessarily.

[1:30] Ayman Elsawah: Computer science is not just about technology though, but about the people too.

[1:33] Tanya Janca: Oh, the people I like the best are the people in my computer science class.

[1:37] Ayman Elsawah: Her family history is also quite extraordinary.

[1:39] Tanya Janca: My aunt is the first woman to ever graduate from computer science in Ontario.

[1:43] Ayman Elsawah: And that was only part of it. Take a listen for the rest. All right, on to the show. Hi, Tanya. Thanks for coming on the show.

[1:48] Tanya Janca: Thanks for having me.

[1:49] Ayman Elsawah: Yeah, this is exciting. Cool. So maybe for those out there that don't know what you do, maybe you could talk about what you do in information security.

[1:59] Tanya Janca: I have a very unusual job. I work for Microsoft as a cloud advocate. So my previous job was web app pen testing and application security and the job before that and before that and before that. But I started doing public speaking and I started writing content about it and it turns out that I'm really good at explaining things. So I have a very strange job where basically I try to teach everyone by like writing blog posts or creating lessons or we have like a learning platform called Microsoft Learn and I make a module for that teaches everyone basically like how to use the cloud securely, how to launch apps and create apps that are secure, you know, how to add a whole bunch of security to our DevOps pipeline and stuff like that.

[2:42] Tanya Janca: And it's super fun because I just get to break things and then knock them down.

[2:46] Ayman Elsawah: Nice.

[2:47] Tanya Janca: And then build more things.

[2:48] Ayman Elsawah: Do you get to stay technical?

[2:50] Tanya Janca: Yeah, exactly. So I get to play with anything new that they make, which is ridiculous.

[2:56] Ayman Elsawah: That's fun.

[2:57] Tanya Janca: I know. When I started, I'm like, can I have a free license for everything? And they're like, yep.

[3:03] Ayman Elsawah: Cool, cool.

[3:06] Tanya Janca: Yeah. So I work with all the different Microsoft security teams a lot.

[3:10] Ayman Elsawah: Okay.

[3:10] Tanya Janca: So I kind of get to hear all the cool stuff that's happening. Yeah. And help make their lives better if I can.

[3:17] Ayman Elsawah: Okay. And your audience is primarily the non-security folks at Microsoft or?

[3:21] Tanya Janca: My audience are people outside Microsoft generally.

[3:24] Ayman Elsawah: Oh, okay.

[3:25] Tanya Janca: So let's say you're trying to pick a cloud provider and you're like, oh, you know, what is the security like in Azure? Then, you know, I have endless content on that topic or if you're using it and then you're wondering, okay, so how can I, you know, implement zero trust in Azure or Oh, I'm launching an app, but like, what are the settings I should use? Or where is that darn thing I'm looking for? I know it exists. I just don't know where it is. I've probably written something about it or someone has written something about it. And then to make sure that, you know, you can do whatever you want to, but securely.

[3:55] Ayman Elsawah: Yeah. And, you know, you said something how about the ability to teach people? I mean, I think that's such a huge thing in security, right? Part of your job is to help educate others on security, wouldn't you say?

[4:06] Tanya Janca: Yeah, absolutely. And I feel that is something that we're lacking a bit. Because I know, in college, I didn't get any courses on security. Now I did graduate a long time ago. But even people graduating now are telling me that, you know, there's a cursory course that's optional, and it'll just explain identity and identity super important. But it's not the only thing that's important. And so we're ending up graduating like a lot of people that know how to make insecure software, unfortunately.

[4:37] Ayman Elsawah: Oh, interesting.

[4:39] Tanya Janca: We're graduating people who don't know how to make secure software, but they do know how to make software. So that ends up being insecure software, which is, as you know, quite problematic.

[4:51] Ayman Elsawah: What would be your recommendations to institutions that are graduating these folks?

[4:55] Tanya Janca: Well, we need to start covering security. I think there's a lot of problems in our industry in regards to incentives. So, for instance, I don't have a PhD. I don't even have a degree. I just have a diploma, which in Canada has lesser value than a degree. And you need to have a PhD in order to be a professor at a university. So if I was going to teach a software security course at a university, they would pay me as an abject professor and they would pay me almost nothing. It would almost be equivalent to volunteer work. And why on earth would I do that when instead I could I could apply at SANS, I could try to be an instructor there, they get paid quite well. There's a lot of different places where you could become an instructor and do private teaching and you could get paid just astronomically more.

[5:44] Tanya Janca: So then the universities say they can't find anyone that's willing to teach because if you have a PhD in computer science, It's rare, especially if you specialize in cybersecurity, that you would decide to remain in academia when you could instead perhaps start your own company and create products. Right.

[6:01] Ayman Elsawah: Like, yeah.

[6:02] Tanya Janca: So there's just such a small group of people that remain in academia and then of those like finding one. And so there's just not enough to meet the demand. And I feel like their system perhaps is. Not doing well for us as an industry where we're graduating people that only know half the thing. You would never assume someone that went to trade school to learn about electricity wouldn't learn how to run electricity safely, right? Of course, they would be taught safety, but we're like, oh, we're graduating people from computer science, but we can't find any professors because we don't want to pay them anything. So I guess we just won't teach safety.

[6:39] Ayman Elsawah: Yeah, exactly. It's funny you say that because, you know, I wanted to teach a master's course on cloud security and I was talking to the university and they ran into an issue because I didn't have a master's degree. Even though I had plenty of certifications and plenty of industry experience, you know, not trying to talk more about this, but basically what I'm trying to say is that like, here you are, you have someone that's willing to, you know, teach a class, you know, I'm not doing it for the money, right? Yeah.

[7:04] Tanya Janca: Yeah.

[7:04] Ayman Elsawah: Nobody really does teaching for the money, but you know, I couldn't because I didn't meet this one very specific criteria. So that was really interesting. That's happened to me, I think a couple of times.

[7:14] Tanya Janca: Yeah. And then who's missing out? The students, right?

[7:17] Ayman Elsawah: Right.

[7:18] Tanya Janca: Like, you're not like, oh gosh, I wish I could get that $400 a month. Yeah.

[7:25] Tanya Janca: I like that yeah exactly it's that you want to share and improve our industry that's what your motivations are and then you're kind of being blocked that's why i give away a lot of stuff for free online because i'm like haha i'll just do it for free on twitch yeah then i can do it from my living room and wear pajamas yeah there you go and make just slightly less money

[7:49] Ayman Elsawah: Yeah. And not to rant on here, but like as an educator, for me, I actually wanted to have more challenging or more engaged students. Yeah. So, you know, having a master's student.

[8:01] Tanya Janca: Oh, yeah.

[8:02] Ayman Elsawah: You know, then that way they're motivated. They're in it. A lot of times they're people that are working already and they're just nighttime. So, you know, when I give them homework, they're actually going to do it. So that's actually that was actually the exciting part I was looking forward to. You know, it's funny. After teaching, I've learned that I was a really bad student in college.

[8:22] Ayman Elsawah: I'm like, wow. Now I know what infuriates teachers. I'm like, holy. I feel so bad for all the teachers that taught me.

[8:32] Tanya Janca: Yeah, I know what you mean. I know what you mean. Yeah.

[8:34] Ayman Elsawah: Yeah, it's so interesting. Anyway, so tell us a little more about some of your previous positions before Microsoft, like what you did.

[8:41] Tanya Janca: Yeah, before Microsoft, I worked for the Canadian government for 13 and a half years. And first I did software development for nine years. Maybe, yeah, around nine-ish years. And then I switched over into security. Slowly, as a software developer, I just got more and more obsessed with security. I met a hacker. Then I met another one and another one. Turns out there's not that many in Ottawa. I met a whole bunch of them through this learning program I was running for my devs, where I would just invite people in to teach us cool stuff at lunch. And as I got more and more interested, one of them was like, you should become a hacker, man. You'd be so

[9:23] Tanya Janca: And he became my first professional mentor.

[9:25] Ayman Elsawah: Oh, nice.

[9:26] Tanya Janca: Yeah. And so I ended up getting to try a whole bunch of different things. So I got to do some network security stuff as some, you know, like scanning networks and looking for vulnerabilities, like some architecture. I got to play the CISO role for the 42nd general election for Canada where we elected Mr. Trudeau.

[9:46] Ayman Elsawah: Oh, okay.

[9:46] Tanya Janca: And that was really cool. I got to do instant interviews. I got to do a lot of web app pen testing and a lot of scanning of all the things. And then I learned AppSec. And I thought I really wanted to be a penetration tester until I discovered that there's this weird spot in between software development and And like in between red team and blue team that I was just like, oh, that's the best part because, you know, I find a vulnerability, but then I show the developer how to fix it. And then I teach all of them about it because it turns out all of them are making this mistake. You know, I help implement tools to make sure, you know, we're capturing the right things or that everything's getting scanned before this happens or whatever.

[10:31] Tanya Janca: And It just felt like the right place for me, if that makes sense. And I didn't even know that existed. So a lot of people who want to get into security, they all tell me they want to be penetration testers.

[10:43] Ayman Elsawah: I know.

[10:44] Tanya Janca: But I think a lot of them don't know. Okay, so I'm going to air some dirty laundry here. A lot of penetration testers get a little depressed. Like after a few years. So at first it's like, this is so exciting.

[10:58] Ayman Elsawah: Right.

[10:58] Tanya Janca: They can get pretty bored because you find the same problems over and over. And if you're doing consulting, you go in and you're like, bam, bam, bam, bam. And you find a whole bunch of things that are wrong and you write a report. And then quite often no one reads it. Where they just pick the top thing they fix that and then that's it then you have to leave you don't feel you've done a good job maybe yeah you know like if i write a report but then nothing actually happens personally i feel like a bit of a not like a failure but like i haven't done good by my client and so AppSec i felt so satisfied with because i'm like i'm Look at me, I'm helping, like I'm making a difference. Like I created a secure coding guideline and it makes sense.

[11:42] Tanya Janca: And then I can help them, you know, if they're having problems with parts of it, we can change or we can, like I can teach them or this one place I kept finding cross-site scripting everywhere. And so I did this deep dive into it. And at lunch and I appealed to all the people, you know, only 10 people showed up and my manager felt it was quite a failure. You know, we have 400 devs and, you know, like 12 showed up. This sucks. But one of them, it turned out, was a team lead for a big team. And then he went and searched for cross-site scripting in every single legacy app. And they made an entire sprint and they just knocked out cross-site scripting for a crap ton of apps. And he was like, that was thanks to you.

[12:21] Tanya Janca: I can't wait till you show me the next thing because we're just going to keep doing this and just knocking things out. And so we had like more and more people interested. And for me, that feels amazing. Have like that glow inside of like, I'm making a difference. And so, although like it's a lot of people view like red team activities or like penetration testing is very glamorous, I guess maybe AppSec is slower or more down in the weeds. But for me, like when I'd go home, I'm like, yeah, that's right.

[12:48] Ayman Elsawah: That's awesome.

[12:48] Tanya Janca: Fix this and that guy fixed that. And now they know what a waitlist is versus a blacklist and our inputs are so much more secure now. And like, for me, that feels really good.

[12:58] Ayman Elsawah: And yeah, I'm getting tingles myself.

[13:01] Tanya Janca: Yeah like it just it just and that's part of why I guess that I like doing talks and writing blog posts and teaching is because like you know people will write me and say like oh yeah you know I did that workshop with you and then after you know we started using this tool and like this you know technique or this strategy that you told us and yeah like our incidents have gone down or like we haven't had an incident now or you know it caught all the things and it's just like yes I'm helping yeah

[13:29] Ayman Elsawah: Actually affecting change. So that's, you know.

[13:32] Tanya Janca: Yeah.

[13:33] Ayman Elsawah: That's right. I mean, when you talk about the pen tester, you have this level of emotional drain where, you know, not only are you trying to find, you get the high of like finding issues, but then.

[13:43] Tanya Janca: Yeah, that's fun. Right.

[13:45] Ayman Elsawah: But then you also have to have the art of telling people their baby's ugly.

[13:51] Tanya Janca: Oh, yeah.

[13:52] Ayman Elsawah: And I think it's a good skill if you can master it.

[13:55] Tanya Janca: Yeah.

[13:55] Ayman Elsawah: But it is emotionally draining. And then, you know, you come back next year, do the same pen test, and you find out that they didn't fix half the stuff that you reported. And it's like, what?

[14:04] Tanya Janca: Yes. Right?

[14:06] Ayman Elsawah: So...

[14:06] Tanya Janca: Yes. So when I would do consulting for pen testing, what I would do is explain like a vulnerability assessment and explain like a security assessment and like threat modeling and whiteboarding and all of those things. And I'd be like, so that's what I'm going to do. And then we would sign the contract and it would say pen test. But then it would have like all the things that I was actually going to do. And like, it's like, I'm not going to set your app on fire. I'm going to test it, but I'm not going to like break into your network. You don't want me. You want someone else if that's what you're looking for. And that's cool. Like, I'm glad that people know those things because I suck at that.

[14:40] Tanya Janca: I'm not going to own 20 boxes. I'm not that person.

[14:43] Ayman Elsawah: Right. We have to work on our strengths.

[14:44] Tanya Janca: So yeah, exactly.

[14:46] Ayman Elsawah: Yeah.

[14:46] Tanya Janca: You know, this podcast is for people that are wanting to get into information security. And I think that part of the problem is that people just don't even know how many super awesome, cool things that there are out there.

[14:57] Ayman Elsawah: Yeah.

[14:58] Tanya Janca: Right.

[14:58] Ayman Elsawah: Yeah.

[14:59] Tanya Janca: And I feel really lucky and blessed to have had, you know, like a mentor that pushed me and then eventually more mentors. And then also at work, I just had this team of like, oh, do you want to do that? Okay. I'm like, what? Am I managing an incident now after I saw you do too? Like what?

[15:16] Ayman Elsawah: Yeah.

[15:18] Tanya Janca: And it was just really exciting. And they're like, if you need me, just tag me in and I'll take over. But you've got this. I believe in you. And oh my gosh, the power. I still go for beers with those guys sometimes.

[15:31] Ayman Elsawah: Nice.

[15:31] Tanya Janca: Yeah. And I think that if people who are interested in information security can find out all the different types of roles that exist, they could then concentrate a lot faster because it took me years to figure out what AppSec Was and how to do it. And that's why I'm writing that blog post. I have like this series called Pushing Left Like a Boss, where I'm explaining like, what is application security? What is this trying to create secure software business? How do you do that? Try to explain from the beginning because no one just laid it out for me. So I'm like, I'm just going to lay it out and hopefully some people will read it.

[16:07] Ayman Elsawah: That's right. That's great work. Yeah, I really appreciate that. That's really good work. There is a NICE framework. I'm really thankful for the NICE framework that's come out. I wish that was around before, where it kind of lists all these types of positions that I don't even know about, right?

[16:21] Tanya Janca: Oh, what's that called?

[16:22] Ayman Elsawah: It's by NIST. They released something called the NICE framework. NICE. And yeah, I'll link to it in the blog. I'm in the post.

[16:29] Tanya Janca: Yes, please.

[16:30] Ayman Elsawah: And in there, they have like a spreadsheet of all these different positions and skills required for some of these positions and things like that.

[16:38] Tanya Janca: So that's awesome. That's really awesome. I want to take a look at that. I want to start sharing that with people that write me.

[16:43] Ayman Elsawah: Yeah, that'd be great. Because everybody wants to be a pen tester. And it's like, okay, there's more.

[16:47] Tanya Janca: But they just don't know.

[16:49] Ayman Elsawah: They don't know.

[16:49] Tanya Janca: Yeah. And I think that we see hackers and pen testers as this like glorified thing where like, you're just going to press two keys and then you've just hacked the NSA and the NSA is just like face palming. Like, no. Yeah. No.

[17:06] Ayman Elsawah: Yeah. And, you know, if you want to do that, that's fine, too. I think the main thing is to be realistic about it. Right. And there's no direct path. So, I mean, one goal here is to find as many different kind of people in infosec and have people talk about their jobs. Right. Whether it be product security or IoT or anyway, I digress. But one thing I'm curious about, do you think that Tanya of like, say, five or even 10 years ago wrote SecureCode?

[17:31] Tanya Janca: No, she did not. No, she did not at all. Yeah, so she did what she was taught in school, which did not have very many things. One of my last software development gigs was at the Treasury Board Secretariat of Canada. And we actually did pretty well compared to a lot of other departments because We had a couple guys on our team who just never stopped going to school, who were like really, really bright. And like they continued to take computer science courses at night indefinitely.

[18:03] Ayman Elsawah: Lifelong learners.

[18:05] Tanya Janca: Yeah, they wanted to learn everything. One of them created our own DLL, like our own library. So we were a.NET shop. Nice. Yeah, and it would, you know, like validate email addresses and it would validate inputs. And then we just ended up adding like more and more security things to this framework. And we would just use the framework. And it wasn't until, and I worked there like forever. And then when I went to work other places, I'm like, oh my gosh, you guys don't have this? What do you do? Yeah. And so like, I'm lucky, like my boss was really cool and I could just be like, yo, can I just have like a latest copy of this? And he'd be like, yeah, of course, because it's not private industry, it's the government.

[18:41] Tanya Janca: And why recreate the wheel? So like all of my previous software development bosses would just be like, yeah, of course you can have a copy of that code or that project you did. And you can like just throw out half of it and then like write this new thing that you're going to do. You know, can you share it back after? Because I'm extroverted. That works. Most people are introverted. They're in computer science. Not most, but let's say more than half and many, many. So like I just call my old teams and be like, yo, I'm working on this. Do you guys have anything like that? Or like, how are you fixing this problem? My team's kind of at a loss. And I found that went really great. But I think that I was a bit spoiled having, you know, like really awesome people on the team who are more security aware than I was until I became obsessed.

[19:22] Tanya Janca: And then I want to learn everything about something. I'm that person. Yeah. I'm like, oh, I'm going to learn about kayaking. I'm just going to go 10,000 percent into it. That's how I am.

[19:31] Ayman Elsawah: Nice.

[19:32] Tanya Janca: Which is fine. Right. So I'm really good at a couple of things.

[19:36] Tanya Janca: Yeah. So eventually, like I left and I got a security job. And then I was like, sorry, guys, I'm not coming back because they loaned me. But then I never came back from the loan. Because again, like unlike private industry, like, you know, we don't usually loan employees to other companies, but you could do that in the government. It's like, we're going to loan her out to elections and she's going to help with the election. I'm like, I'm sorry, guys. I like it too much. Yeah.

[19:58] Ayman Elsawah: Yeah. That's awesome.

[19:59] Tanya Janca: Yeah. It leads to great opportunities too.

[20:02] Ayman Elsawah: Yeah. So tell us a little about the younger Tanya. Were you always into computers? Like how did you get into computers?

[20:10] Tanya Janca: So I think that I have a very not traditional way that I did all the things.

[20:15] Ayman Elsawah: Oh, sure.

[20:16] Tanya Janca: My aunt is the first woman to ever graduate from computer science in Ontario.

[20:20] Ayman Elsawah: Oh, wow. Cool.

[20:21] Tanya Janca: Yeah, my other aunt was one of the first 10 to graduate from computer science. Four of my five uncles are computer scientists.

[20:28] Ayman Elsawah: Okay.

[20:29] Tanya Janca: My mom's a mathematician chemist. My dad's a technologist mechanic. Okay. And then my cousins, most of them are like computer science or engineers or mechanics. So in my family, we have a garage. There's a bunch of mechanics that work at the garage. Then when I was like, oh, like I was thinking of taking computer science. So all of them were like, uh-huh. Like, what else would you do?

[20:53] Ayman Elsawah: Ah, that's funny. Yeah.

[20:55] Tanya Janca: Right. And I know little girls, that's generally not the case. So like my uncle, one of them had created a computer for us that would talk to us when we were little. And he like programmed the whole thing himself. And I was like, hi, my name's Mikey. What's your name? And we type in her, hi, Tanya, how are you? And like, we had things from the very beginning.

[21:13] Ayman Elsawah: Wow. When did you write your first line of code?

[21:16] Tanya Janca: I think when I was 16, I don't think I was really coding before that. I think I was just more playing around. It wasn't until my parents were like, you have to take a computer science class. And I was like, oh, I really like English and drama and all these other things. They're like, you're awesome at math. Just go do some. You'll notice. I'm like, I'm not that great, but it turns out they're right. And when I decided to go to college, honestly, I thought about it. So I was accepted for history, English. Dramatic arts, computer science, like just everything I applied to because I am scholastically inclined. So it was very effortless for me in high school. Honestly, I just smoked a lot of weed and hardly showed up and would just ace things because and I didn't understand what everyone else's problem was.

[21:59] Ayman Elsawah: Oh, wow. Okay.

[22:00] Tanya Janca: And I didn't understand these things. Right. But then I thought about it and I was like, oh, the people I like the best are the people in my computer science class.

[22:08] Ayman Elsawah: Mm-hmm. Mm-hmm.

[22:08] Tanya Janca: And so I think that if I go into a career in that, if I'm going to like all the people that I get to work with, that's important, because I remember in dramatic arts, like I wasn't pretty enough to get the leading role, even also like that my classmates were wildly annoying.

[22:25] Ayman Elsawah: Different personalities.

[22:26] Tanya Janca: Yeah, exactly. And I'm just really drawn to the computer science-y type of personality. And so I upped it. Then I took computer science in school, and that was great. And I started working at Nortel in high school. And then I started at a software programming startup while I was in college. And then as soon as I graduated, I started my own company, which failed. I joined Another startup which failed okay then i got jobs and then eventually landed in the government but those failures taught you something right oh yes they did what did they teach you so the failures taught me a lot of things that you shouldn't go into business with someone just because they're your friend okay and that i am good at tech and that i don't know enough to run a company

[23:11] Tanya Janca: And I need a person that really understands how to run a company if I do want to venture into that space again. Also that I function at a high level. So like I'm okay with just like working and working and working and working and working and I don't mind because I like it. But normal humans don't tolerate that crap. Yeah, and like, I can have a full time job and a part time job and even another job and then go speaking places and then also like be on a sports team because I just like to do something every single moment of the day and normal people need rest. And like, that's okay. But then I can't like have expectations of others like I do of myself, because I'm gonna get disappointed. And also, just because you have a great idea doesn't mean it will go somewhere.

[23:57] Tanya Janca: Yeah, I've had a lot of people secretively tell me their business ideas. And like, some of them are really cool. Some of them I don't like, obviously, like not every idea is great, but they're really worried someone will steal it. Unless like you've already conducted the research or already built the product and they're stealing like the already made product. Like the work not only is creating the product, but getting people to use it.

[24:16] Ayman Elsawah: Yeah.

[24:16] Tanya Janca: Like someone last night, he's creating this super cool new infosec product that he's going to open source and give away for free, which is awesome.

[24:23] Ayman Elsawah: Nice.

[24:24] Tanya Janca: And I said, how are you going to promote it? Because there's no point in working really hard to create an amazing product, open source it, and then no one actually hears about it or uses it. Because I've seen that happen.

[24:35] Ayman Elsawah: Yeah.

[24:36] Tanya Janca: Where like only four people know about this thing. And the thing is amazing. And the person worked really hard on it. And so he had this plan. And then I offered it like a bunch of suggestions of like, okay, well, You know, I have the OWASP show. You could come on and show your cool thing that you made and you're giving it away free. And we could tell lots of people about it. And he's like, awesome.

[24:54] Ayman Elsawah: And yeah, there's a lot to unpack there. That's more of an entrepreneurial discussion. But yeah, it's just telling people keeping it secret is basically a recipe for failure. Yeah. Yeah.

[25:04] Tanya Janca: I think a lot of people are uncomfortable with self-promotion.

[25:07] Ayman Elsawah: Yeah.

[25:07] Tanya Janca: And no one will know about your cool thing you're doing if you don't tell them. You're not saying like, oh, those other products suck and I'm the best and you should worship me. I'm cool. That's not what you're doing.

[25:17] Ayman Elsawah: I mean, I run into that too. You know, I like I was never on Twitter, you know, I was always the lurker. And now you guys are the podcast, I have to do this stuff. And you know, I still find it difficult, frankly. But yeah, you're right. You know, self promotion, it's not easy. You can have an awesome product. But if people don't use it or read it, it doesn't matter. Yeah. And it's tough.

[25:35] Tanya Janca: If a tree falls in the forest, and no one's around to hear it, does it? You know, did it happen?

[25:41] Ayman Elsawah: Yeah, that's right. So what would be some advice for folks that are not scholastically inclined necessarily that are looking to get into infosec? What are some basic steps or what is your advice in general?

[25:51] Tanya Janca: So there are a bunch of things. So definitely listening to podcasts like this, checking out that NIST document that you're going to link in the notes about all the different types. Of areas of infosec and then reading about them, listening to podcasts about them, blogs, whatever you can to figure out like as closely as you can, which one or ones interest you. And then from there, try to see if there's certain people that you can follow who are releasing content, right? So for instance, like let's say there's a specific cloud provider that you want to follow. All of them have tons of free content to learn about their cloud, right?

[26:26] Ayman Elsawah: Yeah.

[26:27] Tanya Janca: So that you can narrow that down with certain security things. Sometimes there's free content online, so absorb as much free content as you can. I also suggest joining clubs or groups. So for instance, OWASP, the Open Web Application Security Project. I am their biggest fan. I love OWASP. And there are 280... Chapters now, I think. Worldwide. Yeah.

[26:51] Ayman Elsawah: That's awesome.

[26:52] Tanya Janca: We, because I'm one of them, are amazing. They do so many great things. The community is so welcoming and so lovely. So go to their meetups, check out their cool projects. Also, I'm part of Women of Security or WOSEC, as we call ourselves. So if you're a woman and you want to meet other cool chicks, we brunch and bitch. We crap. Yeah. Where we just like hang out and meet each other and eat cookies. We will go as a group. To other events, so a conference or a meetup or something so that you're not the only woman there. Because that can be really intimidating. And then we have, you know, women only safe spaces for learning where it's just, you know, like I'll give a talk and there's just 10 women there.

[27:36] Tanya Janca: And then we have like this open discussion about whatever the security topic is. Because a lot of women will speak less if there's a lot of men in the room. They just feel a little intimidated for whatever reason, not all women, but some women, like a large enough Amount. Like I see huge differences. So we have 20 something chapters around the world at this point, but we're only a year old. So we're working on it.

[27:58] Ayman Elsawah: Okay.

[27:58] Tanya Janca: And then also online, I'm running a campaign on Twitter every Monday called mentoring Monday. So you use the hashtag and all one word mentoring Monday and say what you're looking for.

[28:10] Ayman Elsawah: Oh, okay.

[28:11] Tanya Janca: So it's Say, hi, I'm interested in learning about incident response and I'm looking for someone that could mentor me or give me a list of podcasts I should listen to or point me in the right direction or hi, I'm interested in doing security research. I want to become a bug hunter. I want to kick ass epic bouncies and I want to learn from someone who has experience who can help steer me so I can have a good head start. And every Monday I'm doing this and I'll retweet you if you tag me or if you send it to me in a direct message. I try to look for all of the Mentoring Mondays and retweet them every Monday. But sometimes I miss them. And some people have told me that 20 different people reached out to them to help them and they found it overwhelming.

[28:54] Tanya Janca: The information security community has been so amazing in answering all of these people because we're not going to have enough people to meet the demand of our industry if we don't train them up, right? My first professional mentor hired me for my first pen test contract. And then he got like a big consulting gig somewhere and he told them he wouldn't come without me. And like someone going like advocating for me like that, like that's just, I mean, I did do all of his crap work, but I was like, I'll write all the reports. No. Problem right but like that's how you learn that's how you learn anyway yeah exactly and then he would proofread them and approve them and then eventually like i could write my own reports not being supervised and eventually i moved beyond and then found even more advanced mentors who could teach me even more and then in return i mentor several people right

[29:47] Tanya Janca: If you find someone that is right for you, it's rather magical the way that they can kind of push you to succeed and give you opportunities. Just having someone believe in you, basically.

[29:57] Ayman Elsawah: Yeah.

[29:57] Tanya Janca: One of the women that I have been working with, she was so shy and she said she would never, ever want to present anywhere. But, you know, a year later, she made this amazing pipeline where she has like a WAF, a web app firewall, and then she has like a hacking tool, a WASP SAP attacking it and then like a vulnerable app behind it. So you could auto tune your WAF in your pipeline.

[30:22] Ayman Elsawah: Wow.

[30:23] Tanya Janca: Right? Isn't she awesome?

[30:24] Ayman Elsawah: That's so cool.

[30:25] Tanya Janca: Yeah, that's Frances Skipula. She's standingly, amazingly brilliant. And so she's been doing talks and all sorts of stuff and building proof of concepts. And she's a whiz at WAF and Reverse proxy. And so then I've learned a whole bunch of stuff about that from her.

[30:42] Ayman Elsawah: That's very cool.

[30:43] Tanya Janca: Do you know what I mean? And so like, it's, yeah, we both benefit. And so I think that a lot of people will tell me like, Oh, I don't know enough to be a mentor. Like, well, have you done your job two years or more? And, you know, a lot of people are able to say yes to that. I'm like, well, you didn't get fired. So that means you're doing a good job, right? So that means you know enough to do your job. Well, there's someone else that wishes they knew enough to do your job.

[31:07] Ayman Elsawah: Right.

[31:07] Tanya Janca: Right. Like you don't have to meet with them every week. You don't have to coach them every single day. Like people will write me and say like, oh, you know, which certification should I get so that I can be a good pen tester? Right. And they'll have, you know, like the certified ethical hacking one. And I'm like, oh, God, don't take that. It's just a bunch of random questions. And it's not helpful. And I certainly wouldn't. Hire or not hire someone based on that instead. Then I give them a list of all these different resources and a lot of them are like, oh, wow. You don't have to spend money at the beginning necessarily. I know a certification really can help show that you know things, but maybe once you specialize, because CH is rather random, it's a whole bunch of things, as opposed to if you really, really specialize really deep into something like the CSSLP, the secure coding

[31:59] Tanya Janca: Specific one that's from the people that make CISP. It's like application security, secure coding, like life cycle, like the whole thing. And it's very, very in-depth, right?

[32:10] Ayman Elsawah: Yeah. Well, let's talk about this. What's the responsibility of the one seeking mentorship?

[32:15] Tanya Janca: You definitely need to have energy and time and respect your mentor's time. You definitely need to have already looked for the answer yourself online before you ever ask them something. They are not a free consultant, so you shouldn't ask them to do your work. Because definitely that is a thing. You shouldn't stand them up for meetings like recognize and have gratitude for the fact that this person has a crap ton of knowledge in their brain that they're sharing with you for free. They're taking time out like you're not their daughter or their son. You're not their friend. You're like a person in their industry and they're trying to pay forward like people that have mentored them in the past.

[32:52] Tanya Janca: Right.

[32:53] Ayman Elsawah: Yeah.

[32:53] Tanya Janca: And like when we remember that and we are gracious and grateful, it shows like the gratitude I have for my mentors. Like I mentioned them in blog posts and podcasts and they know they know my feelings.

[33:07] Ayman Elsawah: Right.

[33:09] Tanya Janca: And they know my appreciation. And I think that also you want to actually do the exercises that your mentor gives you.

[33:16] Ayman Elsawah: Right.

[33:17] Tanya Janca: So if they're like, read this book, at least read some of the book, right?

[33:21] Ayman Elsawah: Yeah.

[33:22] Tanya Janca: I have a lot of trouble reading textbooks.

[33:24] Ayman Elsawah: Okay.

[33:24] Tanya Janca: I find that very, very difficult. So I read the first three. I don't know, 13 chapters of the shell coders handbook and did the exercises. And then I told my mentor, like, listen, my brain is melting. Like, could I just have exercise? Just reading a textbook is so difficult. So then he made me read the web app hackers handbook, which is also a textbook. I know. But then eventually, like, you could see I was so frustrated. And then he's like, great. Now you've graduated to doing more things.

[33:51] Ayman Elsawah: Yeah.

[33:51] Tanya Janca: Yeah.

[33:52] Ayman Elsawah: It's like Daniel Sun in Karate Kid, you know, just clean these cars and then clean more cars.

[33:58] Tanya Janca: Yeah, exactly. He's like, how much patience does this woman have?

[34:05] Tanya Janca: But I think that also choose your mentor wisely. Like a lot of the women have told me their mentors have made passes at them.

[34:12] Ayman Elsawah: Wow.

[34:12] Tanya Janca: In OWASP, in my chapter, we made a code of conduct. And one of the things was that you cannot date your mentor or mentee.

[34:19] Ayman Elsawah: Yeah, that's right.

[34:19] Tanya Janca: And so that if that starts, your mentoring relationship is over. And like if people, adults want to go date, they can date, right? But that you're no longer part of our program and we're no longer responsible for what's going on. And that you shouldn't be asking for such favors. And a bunch of the men were really shocked that we put that in. But then a man offered to be my mentor and I pointed out that clause and he threw the paper at me and said that he would never sign it.

[34:45] Ayman Elsawah: What?

[34:45] Tanya Janca: Yeah.

[34:46] Ayman Elsawah: Wow.

[34:46] Tanya Janca: Which is why I pointed it out to him because I was pretty sure I knew what his motivations were.

[34:50] Ayman Elsawah: Oh, wow.

[34:52] Tanya Janca: And when I told the men that are like part of the core chapter that they were like, oh my God. And I'm like, so I'm very extroverted and I'm fairly confident person. So I just pointed it out to him and he like, it was clear it was not going to work out, but maybe someone with less experience or who's less confident or who's less assertive Might not have the strength to say that, right? And so that's why we put it in, you know, your mentor should not be hitting on you. Your mentor should not be expecting special favors. Your mentor should not be asking you to do all of their work for free all the time.

[35:26] Ayman Elsawah: Yeah, it's just weird.

[35:27] Tanya Janca: And you should not be expecting that your mentor has to find you a job. It's not their responsibility to find you a job. Hopefully that they would recommend you if an opportunity comes up and they think you're a good fit and they would advocate for you. But it's not like, I spend six months with them and now they owe me a job.

[35:46] Ayman Elsawah: No way. No. Someone asked me a question recently and I really appreciated it was a long email. But what the person did was explain their background. And then second paragraph was a very specific question that or something that they're struggling and dealing with. So it actually made it easier for me to answer that question. Right.

[36:06] Tanya Janca: Yeah.

[36:06] Ayman Elsawah: And I think what a lot of people are looking for, or at least, you know, just to ease the burden on both sides or to make it really synergistic, they're just looking for a direction, right? Yes. Just be pointed in the right direction and hopefully they can keep going. But like if your mentor points you in the right direction and then... You know, you didn't go that way. You went a different way. I don't know. So what you said earlier, I think was really good summary. I think that was perfect.

[36:29] Tanya Janca: Yeah. Like setting expectations is really important. And I would also like to add for anyone that's listening, that's considering being a mentor, please consider being a mentor for those who are underrepresented in information security, especially women. Yeah. I know that some men feel uncomfortable mentoring women because they're afraid that potentially, you know, the woman will think they're hitting on them or whatever. Just don't hit on them and it'll be fine. Just don't be weird and we'll be weird. And so sometimes like women have a lot less options for mentors because men have had a bad experience with one woman. We're not all the same. Most of us are great, just like most of you.

[37:08] Ayman Elsawah: Right.

[37:09] Tanya Janca: And so please give extra consideration for giving time to someone that is from an underrepresented group, because we're never going to even the playing field if we don't try to give extra consideration or extra options to try to draw in and try to attract. Every type of person to infosec yeah because we won't fill all the jobs if we only accept one type or one group of person right we need everyone we need yeah people in wheelchairs please work in infosec put like every type person old people young people like you just got out of school great you've already been a sysadmin for 20 years great we want all of you

[37:47] Ayman Elsawah: Yeah, really well said. I really appreciate that. That's really good. Awesome. Thank you so much. This has been great.

[37:52] Tanya Janca: Oh, thank you too.

[37:53] Ayman Elsawah: Yeah. Any parting words before we go?

[37:56] Tanya Janca: Please join Information Security. We need you. We do. We really do. We need all of you. We really need the help. We're not winning right now. You know, I want Have I Been Pwned to not be needed anymore because there's just like no breaches.

[38:11] Ayman Elsawah: Right.

[38:11] Tanya Janca: It's a great service, but I would love to not require it.

[38:14] Ayman Elsawah: Yeah.

[38:14] Tanya Janca: So help make that a reality by joining our industry. Thank you.

[38:18] Ayman Elsawah: Yeah. Awesome. Awesome. Well, Tanya, thank you so much for your time and look forward to meeting in person.

[38:23] Tanya Janca: Yeah. Thank you. And see you next time.

[38:26] Ayman Elsawah: All right. Take care.

[38:27] Tanya Janca: Bye.

[38:28] Ayman Elsawah: Bye. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon.