Getting Into Infosec – Details, episodes & analysis

Hey folks, I'll be at DEF CON in Vegas this year! Would love to see you all there!

• 
  
• Jack's Parties: https://twitter.com/JackRhysider/status/1686785376327987200
• Checkout Miscreants at the Vendor Area: https://www.miscreants.com/
• 
  

yFDrTl54ZSu3KAmLWbmi

Mentioned in this episode:

Stay In Touch

Journey into Cybersecurity and OSCP Certification with Rana Khalil

This episode features Rana Khalil, a Senior Cybersecurity Assessment Analyst with a rich background in pen-testing, especially in the financial sector. Rana shares her non-traditional entry into technology, starting with a dislike for her first laptop and phone, transitioning from biochemistry to a math degree, and eventually finding a passion in computer science, leading her to cryptography and cybersecurity. Her academic journey includes significant work in cryptography, under the tutelage of Carlisle Adams, and a master’s project on web application vulnerability scanners. Rana discusses her motivation and relentless pursuit of the OSCP certification, highlighting the importance of hands-on experience, teaching, and documenting the learning process through write-ups. She also conveys the value of previous experience in related fields, the significance of specializing and pacing in learning, and shares insights into her career progression, including valuable advice for people aspiring to enter the cybersecurity field.

00:00 Introduction and Guest Background

01:47 Rana's Journey into Cybersecurity

02:45 Rana's Early Interest in Mathematics and Cryptography

05:47 Transition into Computer Science and Web Security

10:52 Master's Research on Web Application Vulnerability Scanners

13:02 First Security Job and the Impact of Public Speaking

15:11 Journey to the OSCP Certification

17:36 The Value of Self-Study and Accountability

18:53 Reflections on the OSCP Experience

20:59 Understanding the OCP Exam

21:13 The Importance of Lab Time

22:18 The Value of Documenting Your Journey

22:49 Introduction to the OSWE Certification

25:07 The Role of Experience in Security

25:16 The Life of a Security Professional

25:25 The Importance of Specialization in Security

26:24 The Value of Previous Experience in Security

29:55 The Challenges and Rewards of Pen Testing

30:43 The Balance of Work and Personal Time in Security

34:58 The Importance of Focusing on One Area in Security

37:07 The Importance of Understanding Source Code

38:11 Final Thoughts and Advice

Thank you for listening!

Mentioned in this episode:

Stay In Touch

Gabriel Agboruche (@ICS_Gabe) is a senior ICS and OT cybersecurity consultant, helping organizations solve their most challenging industrial control security problems. And that was a mouthful, but that's what he does. His journey's unique one, and almost didn't happen.

Notes

• Gabe was a math whiz in the Detroit Public school system
• During college, he had some unique experiences as an African American, one of which was due to him being the top of his class
• Gabe was an electrical engineer working at a nuclear facility, then #Stuxnet happened
• The demand for cybersecurity skills combined with his experience and love for growth paved the way for where he is today.

Quotes

• "All these systems are air-gapped by regulatory guidance."
• "I'm here for my education. I'm going to get this education. And not even necessarily prove this person wrong, but I'm going to be here and do what I have to do in order to get where I desire to be."
• "He's like, wow, you're the first black guy that I have ever seen in person."
• "I almost rushed with him for one (a fra)."
• " I saw that I would gain a greater exposure to a lot more technologies within my field. I get to see different plants. I get to touch different areas."

Links

• Twitter: @ICS_Gabe
• ICS with Gabe Podcast
• Darknet Diaries Triton Episode
• An Episode with Jack Rhysider

Getting Into Infosec Info

• Breaking IN: A Practical Guide to Starting a Career in Information Security: https://www.amazon.com/dp/B07N15GTPC/
• T-Shirts, Mugs, and more: https://gettingintoinfosec.com/shop/
• Stay in touch and sign up for sneak peeks, updates, and commentary: https://gettingintoinfosec.com/subscribe
• Ayman on Twitter: https://twitter.com/coffeewithayman

See omnystudio.com/listener for privacy information.

Mentioned in this episode:

Stay In Touch

Lisa Jiggetts is the founder of the Women's Society Of Cyberjutsu. After recording, we continued talking and the topic of salary negotiations came up. It was so good I started recording again. This topic is super important. I have seen both experienced and inexperienced people make these mistakes.

• Salary Negotiation Tips: https://www.thebalancecareers.com/what-can-employers-say-about-former-employees-2059608 (see the video too)
• Lisa on Twitter: https://twitter.com/lisajiggetts
• A recruiter's comment on the topic: https://twitter.com/Zavala_CyberSN/status/1294398519994773505

• Ask A Question: https://gettingintoinfosec.com/ask
• Website: https://gettingintoinfosec.com
• Ayman on Twitter: https://twitter.com/coffeewithayman
• Breaking IN Book: https://gettingintoinfosec.com/book
• Join My Mailing List: https://gettingintoinfosec.com/list

See omnystudio.com/listener for privacy information.

Mentioned in this episode:

Stay In Touch

Today's episode features a story that was sent to me by a listener.  He reached out to me on LinkedIn, telling me of his success story posted on Reddit. This is the audio version.  I think you're going to be really interested in what he had to say.  He talks about his struggles and what he went through in his journey to Information Security.

Original Reddit post:  

https://www.reddit.com/r/ITCareerQuestions/comments/fw44sg/career_change_success_story_starting_my_first/

Getting Into Infosec Links:

• Site: https://gettingintoinfosec.com/
• Book: https://breakingintoinfosec.com/
• Follow Me Twitter For More Resources To Help You On Your Journey: https://twitter.com/coffeewithayman

See omnystudio.com/listener for privacy information.

Mentioned in this episode:

Stay In Touch

Transcript

Hey everyone… 

So, as if this time was not hard enough as it was with Covid, the American Black community has been affected yet again.

It's difficult to post motivating content while so many are feeling a sense of outrage and so much going on. So I'm going to pause, slow down, or at least take into consideration the posting of new content during this period. Of course, people still need to work, so I can't stop completely, and I do have episodes coming down the pipe.

There's a personal story I want to share related to this.

A friend and I were driving once, but he realized he left his wallet at home, which had his driver's license. I said, "Not a big deal. They can just look you up if you get pulled over." He then looked at me, and I then figured it out: he's black.

It hit me then how privileged of a life I had. It then hit me how scary driving while back really is. I may not be white, Christian, and from the suburbs, but I'm not black and male.

I may not have the best things to say at this moment, but I realize staying silent isn't an option. I don't have a TV, and I'm not on Twitter often, but the little I did see made me realize silence or status quo is almost as bad.

Diversity and inclusion are an integral part of this podcast. I've never called it out as I just wanted my lineup to speak for itself. Many of my guests are black. For the longest time, it was rare to see a brown or black person at a security conference. It was quite lonely.

For listeners outside of the US, please try to empathize with whatever social divide you have in your country. It could be the religious minority in your country, the darker-skinned, those of a "lower" social caste, the poor, or whomever it may be. There are always those that are marginally suppressed or oppressed.

So….

I stand with the Black community against racism, violence, and hate. Now, more than ever, we must support one another as allies and speak up for justice and equality.

#BlackLivesMatter

******************************************

Website: https://gettingintoinfosec.com/

Twitter: https://twitter.com/coffeewithayman

See omnystudio.com/listener for privacy information.

Mentioned in this episode:

Stay In Touch

Hello! Wanted to let you know I'm creating daily (almost) videos on YouTube called Getting Into Infosec BITES: https://www.youtube.com/c/gettingintoinfosec

Please like, subscribe, and spread the word.

The best thing you can do to support this media is to spread the word and let others know. Thanks!

Links:

• Site: http://gettingintoinfosec.com/
• Book: http://breakingintoinfosec.com/
• Twitter: https://twitter.com/coffeewithayman

See omnystudio.com/listener for privacy information.

Mentioned in this episode:

Stay In Touch

Kavya Pearlman is an award-winning cybersecurity professional with a deep interest in immersive and emerging technologies. Kavya is the founder of the non-profit XR Safety Initiative (XRSI). XRSI is the first global effort to promote privacy, security, ethics, and develop standards and guidelines for Virtual Reality, Augmented Reality, and Mixed Reality (VR/AR/MR), collectively known as XR.

Kavya is constantly exploring new technologies to solve current cybersecurity challenges.

Quotes:

• "Money, money, money. How much money [are] you going to make? I was so put off. No, it's not about money. I really just want to learn." 
• "What would you become when you grow up? I would be a D.I.G. (Deputy Inspector General)."
• "This country needs me. This world needs me."
• "You owe it to yourself to explore this little itch, and figure out whether this is your passion or not." 
• "You will inevitably make (sometimes) bad decisions."
• "Technical support IS security." 
• "I don't think anyone read that [report], but then it gave me some satisfaction that this is awesome. I can actually take what I'm learning and apply it to the job." 
• "Believe in yourself. Not just for information security." 

Links:

• Kavya Pearlman - https://twitter.com/KavyaPearlman
• XRSI - https://www.xrsi.org/
• Caroline Wong - https://twitter.com/carolinewmwong
• Steve Hunt [22:17] - https://twitter.com/Steve_Hunt

Getting Into Infosec:

• Breaking IN: A Practical Guide to Starting a Career in Information Security: https://www.amazon.com/dp/B07N15GTPC/
• T-Shirts, Mugs, and more: https://gettingintoinfosec.com/shop/
• Stay in touch and sign up for sneak peeks, updates, and commentary: https://pages.gettingintoinfosec.com/subscribe

See omnystudio.com/listener for privacy information.

Mentioned in this episode:

Stay In Touch

We are in the middle of a worldwide pandemic (COVID-19), a recession is here, a depression might be coming, and everyone is remote! Everything has changed. What can you do? How can you find a job in these crazy times? What are the challenges? How can you make yourself valuable? What's going through the company or hiring manager's mind?

Please share or leave an awesome review if you found this helpful.

See omnystudio.com/listener for privacy information.

Mentioned in this episode:

Stay In Touch

Syntax, an internal pentester for a large organization, had an interesting ride into infosec, filled with pitstops, detours, and countersteering along the way. At an early age, he was influenced by his father, got started hacking, and was wrongfully arrested for reporting a vulnerability in his High School. Hear his exciting journey into infosec, filled with life lessons.

Shownotes

• Was arrested in High School for disclosing a vulnerability in the school IT system
• Went to college for computer science, but dropped out
• Inspired by the movie hackers
• His first computer had a 1MB hard drive (yes, not a typo!)
• Still went to Defcon even when he was not in IT or working in security
• Was a professional motorcycle racer
• Kept all his rejection letters as a way of motivation to keep going
• Had some business and entrepreneurial experience in the past, which helped him get back into the field
• Got back into security through… IT!

Quotes

• "A lot of our time is spent arguing with the other departments and justifying our findings." [2:58]
• "Is this cross-site scripting really a problem?"
• "I get stuck a lot… it's kind of the nature of the beast." [5:17]
• "I'm not going to work in tech again." [12:21]
• "You're a motorcycle mechanic… why should we hire you?"[19:07]
• "It's my hacker family. These are my people. Everyone in security, they make sense to me, cause they're all kinda like me." [19:41]
• "I kept getting [these] projects coming my way and I constantly said, 'YES.'" [22:07]
• "Have you done this before? … no, but I'll learn!" [25:06]"
• "Because I had that mindset… I was seeing [from a] different [perspective] than other analysts." [26:00]

Links

• Syntax on Twitter:  https://twitter.com/syntax976
• DCZIA: http://dczia.net/
• Queercon: https://www.queercon.org/
• Outro Music: "Pure Decking" by Patient Zero from the album "Screen Saviour" her link is http://patientzero.bandcamp.com and she is @DoctorKraft on the Twitter

Getting Into Infosec

• Breaking IN: A Practical Guide to Starting a Career in Information Security: https://www.amazon.com/dp/B07N15GTPC/
• T-Shirts, Mugs, and more: https://gettingintoinfosec.com/shop/
• Sign up for sneak peeks, updates, and commentary: https://pages.gettingintoinfosec.com/subscribe

See omnystudio.com/listener for privacy information.

Mentioned in this episode:

Stay In Touch