7.4K
Downloads
32
Episodes
Exploring the defensive side of cybersecurity through the eyes of the experts and innovators.
Episodes
Thursday Dec 22, 2022
Thursday Dec 22, 2022
Daniel Borges, Senior Red Team Engineer at CrowdStrike and author of Adversarial Tradecraft in Cybersecurity, brings his unique perspectives on learning, training, and failure to the pod. Collaboration is key in any purple team, and Dan believes collaboration comes from a place of knowledge and understanding— of ourselves, others, and the security tools we use every day. In this episode, Daniel talks about the process of writing a book as a cyber practitioner and where he sees the gaps in purple teaming today.
Timecoded Guide:
[00:00] Pivoting from robotics to computer science to InfoSec
[08:06] Finding a purple team in the Target breach aftermath
[14:19] Understanding the trends of cyber practices & purple teaming
[22:09] Deconflicting & blue team maturity ratings
[30:40] Writing a book that covers blue & red perspectives
[38:43] Failing as an opportunity for upward career mobility
Sponsor Links:
Thank you to our friends at Axonius and Plex Trac for sponsoring this episode!
The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley
PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley
What is one of your purple teaming pet peeves?
In Dan’s experience, a huge purple team pet peeve is how red and blue teams hinder one another. When there isn’t solid communication between red and blue, bad blood is easily bred and the tension of a high-pressure situation, such as an attack incident, becomes so much worse. Jumping into an engagement or a test without communication and cooperation between both sides doesn’t unify, it only divides and burns out practitioners.
“It's extremely important when bringing people in, they know there's going to be an exercise, so they don't think the world is on fire. If you're doing incident response and detection, it's a marathon, not a sprint. You can't be putting out fires every day, you're gonna burn out.”
What are your key takeaways about collaboration from your experiences in purple team settings?
Collaboration, especially between red and blue teams, requires compromise and conscious thought. Instead of the selfish “us vs them” mentality of the red and blue silo structure, a purple team unites everyone on the same team, under the same end goal. Dan also recommends that practitioners stop and think about their reactions when collaborating together. Reactionary behavior hurts your team— and it wastes your time, too.
“Sometimes, you have to let somebody fail. Sometimes, you have to let them do it and learn the lesson and if the impacts are not big enough, it's just better that way. It's just better that they see for themselves why this was a bad idea.”
For those who might be interested in buying your book, Adversarial Tradecraft in Cybersecurity, what can they expect from it?
When Dan began writing his book, he knew he wanted to look at techniques from both red and blue team perspectives. Part of his book is logistical, including how techniques can be applied in general situations. Another part of Dan’s book is about lessons learned, especially from the failures he’s experienced as a practitioner. The final piece, and perhaps the most important, is theory and ideas to consider to expand your perspective on the situations you may encounter in the field yourself.
“[My book] is a lot of lessons learned from my time doing this. I've been attacking somebody and they found my code this way, or how I stopped a real campaign of attackers doing this technique. I think it's a lot of practical advice.”
What advice would you give to anyone looking to get into InfoSec?
InfoSec, or information security, is a field that requires balance to avoid burnout. Dan advises considering a career in InfoSec as a marathon, not a sprint. While the learning process can be long and difficult, Dan believes that InfoSec, just like purple teaming, isn’t as difficult as someone might think from the outside. If you’re able to think about a problem in a new way and engage your intelligence in your work, you can and will succeed.
“I think a lot of InfoSec people are just smart people that can sit there and think about a problem. And if that sounds like you, then give it a shot because it's probably easier than you think and we need the people.”
---------------
Links:
Keep up with our guest Daniel Borges on LinkedIn and his blog
Check out Daniel’s book Adversarial Tradecraft in Cybersecurity: Offense versus defense in real-time computer conflict
Thank you to our friends at Axonius and PlexTrac for sponsoring this episode!
Connect with Davin Jackson on LinkedIn and Twitter
Watch the live recording of this show on our YouTube
Continue the conversation by joining our Discord
Hear more from Hacker Valley Media and Hacker Valley Blue
Thursday Dec 15, 2022
Thursday Dec 15, 2022
Jorge Orchilles, Chief Technology Officer at SCYTHE and Principal SANS Instructor, brings his expertise in purple teaming to the pod this week to talk about the uniquely human and the understandably technical parts of red and blue collaboration. As the Purple Team Ambassador at SANS, Jorge lives for all things purple team, pioneering the purple team framework used in different SANS courses. This week, Jorge talks about transitioning from tech to security and remembering we all are working for the same goal.
Timecoded Guide:
[00:00] Growing up in tech & discovering the cybersecurity world
[13:52] Moving from SOC & ethical hacking to pen testing
[26:25] Encountering the human side of a purple team engagement
[32:02] Proactive cybersecurity collaboration with PlexTrac & SCYTHE
[45:57] Transitioning from red vs purple to purple through knowing all sides
Sponsor Links:
Thank you to our friends at Axonius and Plex Trac for sponsoring this episode!
The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley
PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley
What was your experience writing a book as you got into working security?
As a system admin just starting to get into SOC, Jorge agreed to write a book on Windows 7. In the course of just a few months, Jorge ended up writing a book, finishing up his Master’s degree, and working the night shift for his new SOC job. This type of grind paid off for Jorge’s career, but he doesn’t miss the amount of stress and strain he felt by trying to get everything done at once--- a common feeling amongst overworked tech employees.
“It was a great experience [writing a book], but at the same time, I was finishing my Master's, and I just got the SOC job, so I had to work three months of night shift, and it was like 7pm to 7am. So, that night shift along with the Masters, along with writing a book was just a lot.”
What was the moment that the purple team idea clicked for you?
In 2016, Jorge encountered a purple team activity for the first time as an employee at Citigroup. Back then, Jorge explains that the term “purple team” didn’t even exist yet, and their exercises were instead referred to as collaborative red team engagements. Still, the concept of purple teaming immediately piqued Jorge’s interest, especially when he began to encounter the personal collaborative efforts of purple teaming within the rigid world of cyber and tech.
“A lot of people think purple teaming is just these collaborative, hands-on exercises, but there's a psychological part of purple teaming no one ever talks about and that is the understanding that we are all human, we all have different goals, we all work for the same company.”
What are things that we could do or exercises to perform to create a bonding experience in a purple team exercise?
Purple teaming is much more than seating your red team and blue team in the same room. Jorge explains that goals for purple team engagements have to be thoroughly defined and understood by members of the team before the engagement begins. Through his work with SCYTHE and SANS, Jorge often encounters practitioners and managers with the wrong perspective on purple teaming, thinking it's just a forced effort instead of an active collaboration.
“The overall goals need to be covered first. What is the goal? Is it to run an adversary emulation together so that the blue learns from the red and the red learns for the blue? Or, is it to foster a collaborative culture? Because those two goals are different.”
What advice do you have for a security practitioner making that transition from red and blue team to a purple team?
Jorge has two pieces of advice for up -and-coming practitioners looking to make the most of purple team opportunities: remember the human element and learn as much as you can. Remembering the human element reminds you that everyone you work with, blue or red teamer, is a real person striving to make your company a more secure place to work. Learning as much as you can allows for a well-rounded approach in everything you do, from red to blue and everything in between.
“I do think that if you want to be good at either offense or defense, you have to understand the other side. It’s hard to be a defender if you have absolutely no idea what the attackers are doing, and it's hard to be an attacker if you have no idea what the defenders are doing.”
---------------
Links:
Keep up with our guest Jorge Orchilles on LinkedIn, Twitter, and his personal website
Learn more about SCYTHE on LinkedIn and the SCYTHE website
Find out more about SANS course on the SANS website
Check out Jorge’s Purple Team Exercise Framework
Thank you to our friends at Axonius and PlexTrac for sponsoring this episode!
Connect with Davin Jackson on LinkedIn and Twitter
Watch the live recording of this show on our YouTube
Continue the conversation by joining our Discord
Hear more from Hacker Valley Media and Hacker Valley Blue
Thursday Dec 08, 2022
Thursday Dec 08, 2022
Angela Saccone, Community Manager at MetaCTF, Cyber Competitions Coordinator at Women’s Society of Cyberjutsu, and Youtube Content Creator, joins the pod this week to talk about content of all kinds— from cyber competitions to online courses, k-pop dance videos to Python programming videos. Angela talks about her experiences from a red and a blue perspective, her drive to educate future cybersecurity practitioners, and why it's important to be transparent about the daily routine of cyber professionals.
Timecoded Guide:
[00:00] Getting involved in cyber with a communication-focused mindset
[10:18] Falling in love with blue team & red team aspects of the cyber field
[18:23] Collaborating in cyber competitions for Cyberjutsu
[26:11] Mentoring the next generation of purple teamers
[35:55] Learning something new with cloud software & purple teaming
Sponsor Links:
Thank you to our friends at Axonius and PlexTrac for sponsoring this episode!
The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley
PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley
Did you learn anything while being in CIO/CISO type roles that helped you better understand how to communicate with management and c-level executives?
Working with upper-level management and c-level executives early in her career gave Angela a unique perspective on the importance of communication. Instead of focusing too heavily on jargon and technology-heavy vocabulary, Angela takes a more personalized, understanding tone with her c-level interactions. Bring those technical concepts into real-world examples in order to achieve that effective communication from the practitioner level through the c-suite.
“We're all in this together. That sounds so cheesy, but that's really what it is, at the end of the day. Communicating is really important, and also, don’t use so much jargon. You have to learn how to bring technical concepts into everyday plain English. That's not easy, but it's a skill.”
When you had those purple team exercises, how much more of a benefit was that as opposed to when you're just working with your individual team?
Cyber competitions were Angela’s gateway drug to purple teaming. Experiencing such a collaborative yet competitive environment taught Angela to think in terms of real-world scenarios for red and blue team exercises. She learned to push her perspective beyond her individual team and consider each side of the red vs blue debate, which has made her a more well-rounded, collaborative, and educated cyber practitioner.
“If I'm blue, I need to think red. I need to think about how they're getting in. How are they getting privilege escalation? With the red team, we need to think blue, in my opinion, because we need to think about: How are they defending? We need to dig in deeper.”
What inspired you to start cyber content creation with your YouTube channel?
Angela was originally exposed to content creation through MetaCTF, who asked her to create CTF walkthroughs on their YouTube channel. What started off as an experiment in expertise became a major passion for Angela, who was bitten by the content creator bug. She’s since adapted her YouTube channel to focus on day-in-the-life vlogs and videos about her career as a community manager and her volunteer work with the Women’s Society of Cyberjutsu.
“I've always been this example for my social media audience, and even in person, where people are always asking me for help on cyber concepts. Instead of me just verbally saying it, I feel like video is the next best thing. It was really just to help people and also help myself.”
What advice would you give someone in tech looking to transition into a purple teaming, collaborative environment?
Although the idea of entering an environment that’s collaborative might be daunting to those who have spent time in the red vs blue silo, Angela advocates for practitioners to always learn and grow. Expanding your knowledge and opening your mind to new experiences helps you achieve a new level with your career. Leveling up together should be the goal for all cybersecurity practitioners, regardless of if you’re red, blue, or somewhere in between.
“We have so many different resources to help people get involved, so it's good to just not be afraid. I know it's easier said than done but don't be afraid to fail and don't be afraid to succeed as well. Own it. Own those small victories, every small win is a win.”
---------------
Links:
Keep up with our guest Angela Saccone on LinkedIn, YouTube, and her website
Connect with Davin Jackson on LinkedIn and Twitter
Watch the live recording of this show on our YouTube
Continue the conversation by joining our Discord
Hear more from Hacker Valley Media and Hacker Valley Blue
Thursday Dec 01, 2022
Thursday Dec 01, 2022
Eric Thomas, Detection & Response Engineer at HD Supply, brings his 15 years of experience in tech and cyber to the show this week to discuss collaboration— the most essential piece of the purple team formula. Eric walks us through his day-to-day routine as an engineer and provides us with his own unique insight into his current company's purple team process. Additionally, Eric teaches us about his unique approach to training future professionals with red and blue team skills and philosophies.
Timecoded Guide:
[00:00] Transitioning from a tech/IT environment into cyber engineering
[12:03] Walking through the day-to-day of a defense and response engineer
[16:48] Collaborating with the DETH purple team
[29:27] Developing security protocols for IoT and OT devices
[39:33] Going beyond the "back in my day" training stereotype
[51:22] Being the not-so-smartest person in the room
Sponsor Links:
Thank you to our friends at Axonius and PlexTrac for sponsoring this episode!
The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley
PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley
What is the collaboration between red and blue teams like in your current role as a detection and response engineer?
Although Eric is humble enough to admit that the purple team processes in his current work are not his singular idea, he will admit that he led the charge for a more collaborative environment. Leading this initiative started with the desire for a better SOC team. Eric's collaboration wasn't formal at all— he would simply ask other departments for help with their expertise— but this process led to a massively successful process that continues to this day.
"My idea was, if we're trying to detect adversarial behavior, we have a resource internally. Who are experts at adversarial behavior? Why try to figure this out ourselves, right? It started off as a very informal thing. It started off as [collaborative] teams."
Can you give a brief description of what IoT devices are and what type of testing you do with them?
IoT is more than another acronym in the cyber industry— it refers to the Internet of Things, or the way everyday devices connect to the internet and to each other. The concept of IoT heavily connects to OT, or operational technology. Unfortunately, because these are lesser known systems, they're less secure and less understood by security teams. Eric's team of consultants aims to fix that issue, providing security protocols where there are none.
"We have the technology and the mechanisms to protect our traditional IT. When it comes to OT and Internet of Things (IoT devices), this has been significantly overlooked. What we're seeing is a push to get security professionals more interested in protecting these devices."
How are you training future professionals and teaching them to do things differently from the problematic ways you learned back in the day?
It's almost too easy to slip into the problematic "back in my day" mindset of an experienced professional, but Eric actively combats the idea that the old ways of doing security were better when training students. Instead, Eric advocates for students to take a different, more unified approach to their learning process. Aspiring professionals shouldn't work in a silo and should instead be exposed to red and blue team processes during their learning journey.
"Don’t go into the silo, build your network, talk to people across the aisle, it's gonna make you a better pen tester. That’s what I tell [upcoming professionals], that the more blue team friends you have, it's going to make you a better pen tester.”
What advice do you have for any up-and-coming security folks who want to move into the industry?
Collaboration is the name of the game, and Eric wants up-and-coming security practitioners to approach collaboration from a place of learning. No matter how knowledgeable or skilled you are in a certain process or technology, remember that you’re not the smartest person in the room in every situation. Be curious about the work of others around you, and don’t be afraid to ask questions and learn from your peers, no matter what team they’re on.
"If you can learn anything from my story, it's that you should collaborate, network, and talk to people. Never go into a room where you know you're going to be the smartest person, and never think you're the smartest person in the room, because then you won't ask questions."
---------------
Links:
Keep up with our guest Eric Thomas on Twitter and LinkedIn
Connect with Davin Jackson on LinkedIn and Twitter
Watch the live recording of this show on our YouTube
Continue the conversation by joining our Discord
Hear more from Hacker Valley Media and Hacker Valley Blue
Thursday Nov 17, 2022
Thursday Nov 17, 2022
Nick Popovich, Hacker in Residence at PlexTrac, drops by to say hi to the Hacker Valley crew and give some insight into PlexTrac’s purple teaming services. Starting his career in offensive security as a pen tester, Nick gained great insight into purple teaming at companies like Optiv before he joined PLexTrac’s team of hackers. This week, Nick talks about PlexTrac’s unique software integrations, practical purple team collaboration, and differentiating between his experiences in red teaming and pen testing in offensive cyber.
Timecoded Guide:
[00:00] Getting involved in tech through the Army & continuing as a civilian
[07:02] Transitioning from security analyst into pen testing & offensive security
[14:41] Explaining the difference between red teaming & pen testing
[36:11] Collaborating red & blue to make the perfect purple team
[43:16] Using PlexTrac for purple team engagements
[50:07] Avoiding burnout & disengaging from hacking after work
Sponsor Links:
Thank you to our friends at Axonius and PlexTrac for sponsoring this episode!
The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley
PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley
What was that transition like for you from security analyst to pen tester?
Nick describes his transition from being a security analyst who looked at pen testing reports to becoming a pen tester as nothing short of fascinating. After struggling to re-engineer the reports he was seeing at work as an analyst, Nick took his chances on becoming a practitioner through getting certified, expanding his education, and working for a small pen testing consulting company. Working in that boutique environment gave him an overall appreciation for the nuance and knowledge needed to be a successful pen tester.
“I've gotten lucky to see both sides of the coin, meaning that raw boutique with six folks where you're the entire pen testing practice. And also, I've been in a pen testing practice with dozens upon dozens of team members supporting me.”
People misunderstand purple teaming. Can you talk about what purple team collaboration really looks like?
Many perceive purple teaming as the red team and the blue team just working together. In reality, Nick explains that an actual purple team requires a lot more than occasional proximity and communication— it requires strategy, established procedures, and set goals and outcomes. Instead of forcing proximity without the proper leadership or planning, a program like PlexTrac needs to be in place to further facilitate and create that complete purple team integration.
“Folks still have their day job. During a purple team engagement, the blue team still has to protect the fidelity of the environment, they have a day job they're doing. So, establish rules, establish a procedure, and then, really come up with outcomes that you want to see.”
How does red vs blue team collaboration translate into PlexTac’s application?
Purple team collaboration starts with having a clear plan and communication strategy. Enter PlexTrac, a program designed to be a place for collaboration. The best part of PlexTrac in Nick’s opinion? They’re the pane of glass to look through, not the replacement for other programs. Being able to integrate programs like SCYTHE into PlexTrac not only maximizes collaboration opportunities, but also avoids issues of conflicting technology.
“It's a place for collaboration. It's a place where the data lives and you work on it together. Whether you're starting your purple team journey, or you have an established purple team and you want to derive more value, a platform like PlexTrac can go a long way.”
What do you do outside of cybersecurity to avoid burnout?
In his years of working with pen testers and practitioners, Nick has seen a lot of burnout and a lot of overworked cyber professionals. To avoid the burnout that feels all too common during the industry’s current labor shortage, Nick hikes, plays pool, and tries to keep his screen time down. No matter what your hobby is, be it the media you consume, the content you create, or the games you enjoy, having an outlet outside of the industry will save you from burning out.
“I'm not saying screens are bad. I'm just saying to find something that can disengage your mind from the hacks and the cracks, from the tech debt that your brain is incurring, is absolutely important. If you don't find a way to have balance, your brain is going to fry.”
---------------
Links:
Keep up with our guest Nick Popovich on LinkedIn and Twitter
Learn more about PlexTrac on LinkedIn and the PlexTrac website
Connect with Davin Jackson on LinkedIn and Twitter
Watch the live recording of this show on our YouTube
Continue the conversation by joining our Discord
Hear more from Hacker Valley Media and Hacker Valley Blue
Thursday Nov 10, 2022
Thursday Nov 10, 2022
Alexia Crumpton, Lead Cybersecurity Engineer at MITRE, joins the pod this week to cover leaving the old ways of cybersecurity behind to embrace the new generation. As both an engineer with MITRE and an educator for future cybersecurity practitioners, Alexia understands the complexity of new and emerging concepts in modern day cybersecurity— and she sees the confusion our current training methods are creating. Alexia helps us answer: How can we teach the purple team perspective to the next generation?
Timecoded Guide:
[00:00] Gaming MMOs & becoming a cybersecurity engineer for MITRE
[08:36] Knowing defensive & offensive cyber to sharpen any practitioner’s skills
[23:04] Teaching the new generation of cybersecurity & changing the old ways
[32:13] Using Fortnite gaming to accessibly teach cyber skills
[42:09] Learning cyber skills & being patient with the cybersecurity salary
Sponsor Links:
Thank you to our friends at Axonius and PlexTrac for sponsoring this episode!
The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley
PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley
Do you think knowing both the red and blue sides sharpens whatever side you're working on?
Alexia describes defensive and offensive knowledge like a marriage— both have to not only coexist, but also work together. Having both defensive and offensive skills under your belt gives you, as a cyber practitioner, an overwhelming advantage in your ability to work efficiently. Instead of having to wait for someone to explain or struggle through systems you don’t understand, you can rest assured nothing is missed and everything is understood.
“When I first got into the defensive side, the way the SOC was moving, the way the blue team analysts were moving, I was like, ‘You guys are missing a lot of things that I had to develop to bypass all of the things that you're looking for.’”
What would you say is the biggest challenge with trying to build that cohesive purple team mentality?
In Alexia’s opinion, two challenges hold back companies from being able to build a cohesive purple team: communication and training. Without proper communication protocols between team members, everyone fends for themselves and neither red nor blue team practitioners can fully understand each other. Without proper training and knowledge, teams are stuck arguing between the old ways of past technology and the new ways of present day programs.
“If I know what you know and you know what I know, we can work together as two brains to create something that is innovative and better for the cybersecurity community as a whole. Us working as a team is better in the fight against adversaries than me working by myself.”
How do we get corporations to embrace creating content developed around bringing people in, teaching them, and most importantly, investing in their talent? 28:51
Unfortunately for many new practitioners entering the industry, a large majority of cybersecurity companies still rely on the “old” way of doing many tasks and working with a lot of modern day tools. In Alexia’s perspective, this “old” way of thinking creates a massive gap between new employees and experienced professionals where confusion and dissatisfaction thrive. If they embraced the new way and asked new professionals how they learn best, many companies would find talent more willing to learn and stay in cyber roles at their organization.
“I think it’s about working with a new generation, just asking them: How do you learn? How do you retain information? What do you want to know? What are you interested in? So that we're giving information that helps people, that tells them the resources that are out there.”
What is a piece of advice that you wish you would have known early on in your career?
As an educator herself, Alexia understands the money-driven, certificate-driven mindset of newer cybersecurity practitioners. However, for the next generation of cyber professionals, Alexia recommends not chasing a salary. Instead, be willing to learn different skills, roles, and teams within cybersecurity. When you have the information you need to be a well-rounded practitioner, the salary will follow and you will avoid burnout or dissatisfaction with your role.
“Don't worry about chasing a salary, because when you find the field that you want to be in, that you love to be in, the money will follow. The money is definitely going to follow. Learn about the different career fields, because having that information is going to help you.”
---------------
Links:
Keep up with our guest Alexia Crumpton on LinkedIn
Learn more about MITRE on LinkedIn and the MITRE website
Connect with Davin Jackson on LinkedIn and Twitter
Watch the live recording of this show on our YouTube
Continue the conversation by joining our Discord
Hear more from Hacker Valley Media and Hacker Valley Blue
Thursday Nov 03, 2022
Thursday Nov 03, 2022
Bryson Bort, CEO and Founder of SCYTHE, dons his unicorn getup and joins the pod this week to talk about purple teaming and building businesses with community in mind. After founding GRIMM, his first company, Bryson wanted to carve a path of purple team innovation in cyber and created SCYTHE to do just that. Along the way, Bryson saw a need to further engage the cyber community in education and accessibility, and co-founded the ICS Village to encourage training opportunities and bridge industry skill gaps.
Timecoded Guide:
[00:00] Transitioning from army intelligence into founding GRIMM & SCYTHE
[11:38] Education, certifications, & training efforts with GRIMM & ICS Village
[23:53] Data driven security efforts vs compliance checklists
[32:32] Combining Plex Trac with SCYTHE & MITRE ATT&CK
[41:34] OT vs IT environments & the key to understanding risks for both
[50:50] Cooking up community philanthropy as the Unicorn Chef
Sponsor Links:
Thank you to our friends at Axonius and PlexTrac for sponsoring this episode!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask adaptive athlete Amy Bream. Want to learn more about how Amy controls complexity? Watch her video at axonius.com/amy
PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley
How was the transition from Army intelligence into the world of commercial cybersecurity?
Before attending West Point, Bryson had his own cybersecurity experience hacking small devices like calculators as a curious kid. He credits this early curiosity as a foundational knowledge that led him not only to a career in intelligence, but later becoming a founder of cybersecurity companies. Transitioning away from working for the government allowed Bryson to achieve a level of freedom with consulting opportunities that he previous didn’t have.
“From a discipline side, it's a unique experience. I couldn't get it anywhere else. That being said, working with government is working with government. I had fun with the missions, but it was time to go. I wanted to do cyber more on my own terms, which is why I founded GRIMM.”
GRIMM and other projects you’ve worked on seem to see staff training as a priority. Why is that?
As skills gaps widen and employee shortages continue, Bryson explains that companies that don’t provide training opportunities for staff stand out as major barriers to entry in cyber. Bryson’s previous company, GRIMM, and his current one, SCYTHE, both offer mentorship and training opportunities for team members. Expecting to hire someone with all the skills is unrealistic, Bryson explains, and training is necessary for security to manage threats.
“There's more work and need than there are people, which means we need to invest in folks. Most jobs really don't come through cold calls or the web. Most jobs come through relationships. If you know somebody who's interested, help them get into your company.”
Why is that “blue team vs red team” mindset so hard for security practitioners to break out of?
Bryson explains that the error of security practitioners’ ways lies in not seeing security as process improvement. Unfortunately, cybersecurity is still overrun by egotistical employees, relying on whiteness or masculinity to inflate their intelligence and self importance. This only succeeds in creating tension-filled environments where there is no comprehensive assurance of security. Blue teams end up overwhelmed and red teams end up frustrated.
“We don't need the pen tester or the red team to just win. Sure, that feels good, but that's not the point. We cannot be ego driven, we can't be win driven, and we can't continue to just create work that we're throwing on top of people when they already have a day job.”
How do we get more companies to embrace the “purple team” mindset as more than a buzzword?
Sometimes, companies misunderstand the purpose of creating a purple team and force the blue and red teams into the same working space instead of having them work together. Bryson explains that business buy in and leadership focus are essential to the success of any purple team. If the business doesn't want to buy into creating that workflow and leadership doesn’t care about creating a real purple team, nothing good will come of the situation.
“The starting point to any purple team is leadership. If leadership doesn't care, don't bother. At the end of the day, if business doesn’t buy in, it's not going to happen. The purple team process can build that momentum once you've got that, but you can't do it without that buy in.”
---------------
Links:
Keep up with our guest Bryson Bort on Twitter and LinkedIn
Learn more about SCYTHE on LinkedIn and the SCYTHE website
Thank you to our friends at Axonius and Plex Trac for sponsoring this episode!
Connect with Davin Jackson on LinkedIn and Twitter
Watch the live recording of this show on our YouTube
Continue the conversation by joining our Discord
Hear more from Hacker Valley Media and Hacker Valley Blue
Thursday Oct 27, 2022
Thursday Oct 27, 2022
In this episode, we’re joined by Maril Vernon. Maril is a purple team lead and co-host of the Cyber Queens Podcast. From a background in marketing, Maril’s natural curiosity and determination lead her to a new career in cybersecurity with the Air National Guard and beyond. She discovered that there isn't one job in the field, but many types to choose from. She landed her first job in cyber security by applying her soft skills and tenacity. Maril says never to be afraid to ask “stupid” questions.
Timecode Guide:
- [3:21] Maril’s origin story
- [7:27] Beating imposter syndrome
- [12:33] Curiosity of a pentester
- [16:47] Red Vs Blue
- [21:24] Purple works together
- [41:46] Invest in people
- [45:44] Maril’s hobbies
- [52:10] Cyber Queens Podcast
- [58:12] A piece of advice
- [59:56] Where to find Maril
Sponsor Links:
Thank you to our sponsors Axonius and PlexTrac for bringing this season of HVR to life!
Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone
PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley
Give the Rookie a Chance
Maril explains that entry-level employees aren’t given the trust or space to grow. These employees are the future of the industry, and frankly, the older employees are burned out. When given the proper training and investment they can share the load and lift companies to higher places.
“I leaned in hard to those soft skills that I knew that I brought with me, in lieu of the technical skills I did not have. And for that company, that was enough, that got my foot in the door.”
Red and Blue are Fighting the Same Enemies
Red and Blue teams are often pitted against each other, but in reality, they are fighting the same war. Maril believes you should make small talk before you talk shop. Rapport, discourse, and transparency are key to creating workplace communication.
Davin and Maril explore the relationship between Red teams and Blue teams, how they differ, and what possibilities happen when they work together as a purple team.
“One of the things purple teams are able to do is on the tangible side, it’s to definitively demonstrate proactive and reactive cyber resilience. If it's done properly you can actually say this is our quantified ability to sport and attack proactively or to reactively.”
------
Keep up with Hacker Valley on our website, LinkedIn, Instagram, and Twitter.
Follow Maril on Twitter and LinkedIn. Listen to Cyber Queens Podcast.
Follow Davin on LinkedIn.
Continue the conversation by joining our Discord.
Friday Apr 29, 2022
Friday Apr 29, 2022
In this episode, host Davin is joined by Tyson Supasatit, the Director of Product Marketing at Uptycs, to discuss how Upytcs is leveraging the MITRE D3FEND framework to further build upon their defensive capabilities. Tyson shares how Uptycs utilizes their robust use case library to demonstrate and provide creative solutions to their customers, compares the ATT&CK and D3FEND frameworks, and explores how Uptycs is leveraging the D3FEND framework to better implement defensive countermeasures. Lastly, Tyson gives his advice to folks looking to break into cybersecurity.
Guest Bio:
Tyson Supasatit is the Director of Product Marketing at Uptycs. He's been in the infosec space for over 10 years and has been fascinated with cyber defense for longer than he can remember. In his spare time, Tyson raises chickens, along with two children and various other pets.
Links:
Thank you to our friends at Axonius and Uptycs for sponsoring this episode!
Learn more about the MITRE ATT&CK and MITRE D3FEND frameworks
Stay in touch with Tyson Supasatit on LinkedIn and Twitter
Connect with Davin Jackson on LinkedIn and Twitter
Watch the live recording of this show on our YouTube
Continue the conversation by joining our Discord
Hear more from Hacker Valley Media and Hacker Valley Blue
Friday Apr 22, 2022
Friday Apr 22, 2022
In this episode of Hacker Valley Blue, host Davin is joined by McKenna Yeakey, a Corporate Security Engineer at Plaid, to discuss the importance of human-centric security. Mckenna explores the “human” aspects of her job and why end user impact plays such a major role in her decision making. She shares how she leverages her natural curiosity and problem solving skills to perform the ins and outs of threat intel as well as her thoughts on The Great Resignation and skill gaps in cybersecurity. Lastly, McKenna expresses her passion for mentoring the next generation of cyber professionals and her tips for newcomers in the field.
Guest Bio:
Mckenna Yeakey is a Corporate Security Engineer in the FINTECH industry. She leverages her technical skills and domain knowledge to bring value to the organization and the cybersecurity community. She is also a very active member of the Women’s Society of Cyberjutsu, Cybersecurity Gatebreakers Foundation, and an SME for CompTIA.
Links:
Thank you to our friends at Axonius and Uptycs for sponsoring this episode!
Stay in touch with Mckenna Yeakey on LinkedIn and Twitter
Connect with Davin Jackson on LinkedIn and Twitter
Watch the live recording of this show on our YouTube
Continue the conversation by joining our Discord
Check out Hacker Valley Media and Hacker Valley Blue