Hacker Valley Blue

Hacker Valley Media

Exploring the defensive side of cybersecurity through the eyes of the experts and innovators.

Start Here
Collaborating Capabilities in the DETH Squad with Eric Thomas
Yesterday
Collaborating Capabilities in the DETH Squad with Eric Thomas
Eric Thomas, Detection & Response Engineer at HD Supply, brings his 15 years of experience in tech and cyber to the show this week to discuss collaboration— the most essential piece of the purple team formula. Eric walks us through his day-to-day routine as an engineer and provides us with his own unique insight into his current company's purple team process. Additionally, Eric teaches us about his unique approach to training future professionals with red and blue team skills and philosophies.   Timecoded Guide: [00:00] Transitioning from a tech/IT environment into cyber engineering [12:03] Walking through the day-to-day of a defense and response engineer [16:48] Collaborating with the DETH purple team  [29:27] Developing security protocols for IoT and OT devices  [39:33] Going beyond the "back in my day" training stereotype [51:22] Being the not-so-smartest person in the room    Sponsor Links: Thank you to our friends at Axonius and Plex Trac for sponsoring this episode! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley   What is the collaboration between red and blue teams like in your current role as a detection and response engineer? Although Eric is humble enough to admit that the purple team processes in his current work are not his singular idea, he will admit that he led the charge for a more collaborative environment. Leading this initiative started with the desire for a better SOC team. Eric's collaboration wasn't formal at all— he would simply ask other departments for help with their expertise— but this process led to a massively successful process that continues to this day. "My idea was, if we're trying to detect adversarial behavior, we have a resource internally. Who are experts at adversarial behavior? Why try to figure this out ourselves, right? It started off as a very informal thing. It started off as [collaborative] teams."   Can you give a brief description of what IoT devices are and what type of testing you do with them? IoT is more than another acronym in the cyber industry— it refers to the Internet of Things, or the way everyday devices connect to the internet and to each other. The concept of IoT heavily connects to OT, or operational technology. Unfortunately, because these are lesser known systems, they're less secure and less understood by security teams. Eric's team of consultants aims to fix that issue, providing security protocols where there are none.  "We have the technology and the mechanisms to protect our traditional IT. When it comes to OT and Internet of Things (IoT devices), this has been significantly overlooked. What we're seeing is a push to get security professionals more interested in protecting these devices."   How are you training future professionals and teaching them to do things differently from the problematic ways you learned back in the day? It's almost too easy to slip into the problematic "back in my day" mindset of an experienced professional, but Eric actively combats the idea that the old ways of doing security were better when training students. Instead, Eric advocates for students to take a different, more unified approach to their learning process. Aspiring professionals shouldn't work in a silo and should instead be exposed to red and blue team processes during their learning journey.  "Don’t go into the silo, build your network, talk to people across the aisle, it's gonna make you a better pen tester. That’s what I tell [upcoming professionals], that the more blue team friends you have, it's going to make you a better pen tester.”    What advice do you have for any up-and-coming security folks who want to move into the industry?  Collaboration is the name of the game, and Eric wants up-and-coming security practitioners to approach collaboration from a place of learning. No matter how knowledgeable or skilled you are in a certain process or technology, remember that you’re not the smartest person in the room in every situation. Be curious about the work of others around you, and don’t be afraid to ask questions and learn from your peers, no matter what team they’re on.  "If you can learn anything from my story, it's that you should collaborate, network, and talk to people. Never go into a room where you know you're going to be the smartest person, and never think you're the smartest person in the room, because then you won't ask questions." --------------- Links: Keep up with our guest Eric Thomas on Twitter and LinkedIn Thank you to our friends at Axonius and PlexTrac for sponsoring this episode! Connect with Davin Jackson on LinkedIn and Twitter Watch the live recording of this show on our YouTube Continue the conversation by joining our Discord Hear more from Hacker Valley Media and Hacker Valley Blue
Collaborating Capabilities in the DETH Squad with Eric Thomas
Yesterday
Collaborating Capabilities in the DETH Squad with Eric Thomas
Eric Thomas, Detection & Response Engineer at HD Supply, brings his 15 years of experience in tech and cyber to the show this week to discuss collaboration— the most essential piece of the purple team formula. Eric walks us through his day-to-day routine as an engineer and provides us with his own unique insight into his current company's purple team process. Additionally, Eric teaches us about his unique approach to training future professionals with red and blue team skills and philosophies.   Timecoded Guide: [00:00] Transitioning from a tech/IT environment into cyber engineering [12:03] Walking through the day-to-day of a defense and response engineer [16:48] Collaborating with the DETH purple team  [29:27] Developing security protocols for IoT and OT devices  [39:33] Going beyond the "back in my day" training stereotype [51:22] Being the not-so-smartest person in the room    Sponsor Links: Thank you to our friends at Axonius and Plex Trac for sponsoring this episode! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley   What is the collaboration between red and blue teams like in your current role as a detection and response engineer? Although Eric is humble enough to admit that the purple team processes in his current work are not his singular idea, he will admit that he led the charge for a more collaborative environment. Leading this initiative started with the desire for a better SOC team. Eric's collaboration wasn't formal at all— he would simply ask other departments for help with their expertise— but this process led to a massively successful process that continues to this day. "My idea was, if we're trying to detect adversarial behavior, we have a resource internally. Who are experts at adversarial behavior? Why try to figure this out ourselves, right? It started off as a very informal thing. It started off as [collaborative] teams."   Can you give a brief description of what IoT devices are and what type of testing you do with them? IoT is more than another acronym in the cyber industry— it refers to the Internet of Things, or the way everyday devices connect to the internet and to each other. The concept of IoT heavily connects to OT, or operational technology. Unfortunately, because these are lesser known systems, they're less secure and less understood by security teams. Eric's team of consultants aims to fix that issue, providing security protocols where there are none.  "We have the technology and the mechanisms to protect our traditional IT. When it comes to OT and Internet of Things (IoT devices), this has been significantly overlooked. What we're seeing is a push to get security professionals more interested in protecting these devices."   How are you training future professionals and teaching them to do things differently from the problematic ways you learned back in the day? It's almost too easy to slip into the problematic "back in my day" mindset of an experienced professional, but Eric actively combats the idea that the old ways of doing security were better when training students. Instead, Eric advocates for students to take a different, more unified approach to their learning process. Aspiring professionals shouldn't work in a silo and should instead be exposed to red and blue team processes during their learning journey.  "Don’t go into the silo, build your network, talk to people across the aisle, it's gonna make you a better pen tester. That’s what I tell [upcoming professionals], that the more blue team friends you have, it's going to make you a better pen tester.”    What advice do you have for any up-and-coming security folks who want to move into the industry?  Collaboration is the name of the game, and Eric wants up-and-coming security practitioners to approach collaboration from a place of learning. No matter how knowledgeable or skilled you are in a certain process or technology, remember that you’re not the smartest person in the room in every situation. Be curious about the work of others around you, and don’t be afraid to ask questions and learn from your peers, no matter what team they’re on.  "If you can learn anything from my story, it's that you should collaborate, network, and talk to people. Never go into a room where you know you're going to be the smartest person, and never think you're the smartest person in the room, because then you won't ask questions." --------------- Links: Keep up with our guest Eric Thomas on Twitter and LinkedIn Thank you to our friends at Axonius and PlexTrac for sponsoring this episode! Connect with Davin Jackson on LinkedIn and Twitter Watch the live recording of this show on our YouTube Continue the conversation by joining our Discord Hear more from Hacker Valley Media and Hacker Valley Blue
Pentesting for a Better Purple Team with Plextrac’s Nick Popovich
Nov 17 2022
Pentesting for a Better Purple Team with Plextrac’s Nick Popovich
Nick Popovich, Hacker in Residence at PlexTrac, drops by to say hi to the Hacker Valley crew and give some insight into PlexTrac’s purple teaming services. Starting his career in offensive security as a pen tester, Nick gained great insight into purple teaming at companies like Optiv before he joined PLexTrac’s team of hackers. This week, Nick talks about PlexTrac’s unique software integrations, practical purple team collaboration, and differentiating between his experiences in red teaming and pen testing in offensive cyber.   Timecoded Guide: [00:00] Getting involved in tech through the Army & continuing as a civilian  [07:02] Transitioning from security analyst into pen testing & offensive security [14:41] Explaining the difference between red teaming & pen testing [36:11] Collaborating red & blue to make the perfect purple team [43:16] Using PlexTrac for purple team engagements  [50:07] Avoiding burnout & disengaging from hacking after work   Sponsor Links: Thank you to our friends at Axonius and PlexTrac for sponsoring this episode! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley   What was that transition like for you from security analyst to pen tester? Nick describes his transition from being a security analyst who looked at pen testing reports to becoming a pen tester as nothing short of fascinating. After struggling to re-engineer the reports he was seeing at work as an analyst, Nick took his chances on becoming a practitioner through getting certified, expanding his education, and working for a small pen testing consulting company. Working in that boutique environment gave him an overall appreciation for the nuance and knowledge needed to be a successful pen tester.  “I've gotten lucky to see both sides of the coin, meaning that raw boutique with six folks where you're the entire pen testing practice. And also, I've been in a pen testing practice with dozens upon dozens of team members supporting me.”   People misunderstand purple teaming. Can you talk about what purple team collaboration really looks like? Many perceive purple teaming as the red team and the blue team just working together. In reality, Nick explains that an actual purple team requires a lot more than occasional proximity and communication— it requires strategy, established procedures, and set goals and outcomes. Instead of forcing proximity without the proper leadership or planning, a program like PlexTrac needs to be in place to further facilitate and create that complete purple team integration.   “Folks still have their day job. During a purple team engagement, the blue team still has to protect the fidelity of the environment, they have a day job they're doing. So, establish rules, establish a procedure, and then, really come up with outcomes that you want to see.”   How does red vs blue team collaboration translate into PlexTac’s application? Purple team collaboration starts with having a clear plan and communication strategy. Enter PlexTrac, a program designed to be a place for collaboration. The best part of PlexTrac in Nick’s opinion? They’re the pane of glass to look through, not the replacement for other programs. Being able to integrate programs like SCYTHE into PlexTrac not only maximizes collaboration opportunities, but also avoids issues of conflicting technology.  “It's a place for collaboration. It's a place where the data lives and you work on it together. Whether you're starting your purple team journey, or you have an established purple team and you want to derive more value, a platform like PlexTrac can go a long way.”   What do you do outside of cybersecurity to avoid burnout? In his years of working with pen testers and practitioners, Nick has seen a lot of burnout and a lot of overworked cyber professionals. To avoid the burnout that feels all too common during the industry’s current labor shortage, Nick hikes, plays pool, and tries to keep his screen time down. No matter what your hobby is, be it the media you consume, the content you create, or the games you enjoy, having an outlet outside of the industry will save you from burning out. “I'm not saying screens are bad. I'm just saying to find something that can disengage your mind from the hacks and the cracks, from the tech debt that your brain is incurring, is absolutely important. If you don't find a way to have balance, your brain is going to fry.” --------------- Links: Keep up with our guest Nick Popovich on LinkedIn and Twitter Learn more about PlexTrac on LinkedIn and the PlexTrac website Thank you to our friends at Axonius and PlexTrac for sponsoring this episode! Connect with Davin Jackson on LinkedIn and Twitter Watch the live recording of this show on our YouTube Continue the conversation by joining our Discord Hear more from Hacker Valley Media and Hacker Valley Blue
Bridging Generation Gaps in the Cyber Workplace with Alexia Crumpton
Nov 10 2022
Bridging Generation Gaps in the Cyber Workplace with Alexia Crumpton
Alexia Crumpton, Lead Cybersecurity Engineer at MITRE, joins the pod this week to cover leaving the old ways of cybersecurity behind to embrace the new generation. As both an engineer with MITRE and an educator for future cybersecurity practitioners, Alexia understands the complexity of new and emerging concepts in modern day cybersecurity— and she sees the confusion our current training methods are creating. Alexia helps us answer: How can we teach the purple team perspective to the next generation?   Timecoded Guide: [00:00] Gaming MMOs & becoming a cybersecurity engineer for MITRE [08:36] Knowing defensive & offensive cyber to sharpen any practitioner’s skills [23:04] Teaching the new generation of cybersecurity & changing the old ways [32:13] Using Fortnite gaming to accessibly teach cyber skills [42:09] Learning cyber skills & being patient with the cybersecurity salary   Sponsor Links: Thank you to our friends at Axonius and PlexTrac for sponsoring this episode! The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley   Do you think knowing both the red and blue sides sharpens whatever side you're working on? Alexia describes defensive and offensive knowledge like a marriage— both have to not only coexist, but also work together. Having both defensive and offensive skills under your belt gives you, as a cyber practitioner, an overwhelming advantage in your ability to work efficiently. Instead of having to wait for someone to explain or struggle through systems you don’t understand, you can rest assured nothing is missed and everything is understood. “When I first got into the defensive side, the way the SOC was moving, the way the blue team analysts were moving, I was like, ‘You guys are missing a lot of things that I had to develop to bypass all of the things that you're looking for.’”   What would you say is the biggest challenge with trying to build that cohesive purple team mentality?  In Alexia’s opinion, two challenges hold back companies from being able to build a cohesive purple team: communication and training. Without proper communication protocols between team members, everyone fends for themselves and neither red nor blue team practitioners can fully understand each other. Without proper training and knowledge, teams are stuck arguing between the old ways of past technology and the new ways of present day programs. “If I know what you know and you know what I know, we can work together as two brains to create something that is innovative and better for the cybersecurity community as a whole. Us working as a team is better in the fight against adversaries than me working by myself.”   How do we get corporations to embrace creating content developed around bringing people in, teaching them, and most importantly, investing in their talent? 28:51 Unfortunately for many new practitioners entering the industry, a large majority of cybersecurity companies still rely on the “old” way of doing many tasks and working with a lot of modern day tools. In Alexia’s perspective, this “old” way of thinking creates a massive gap between new employees and experienced professionals where confusion and dissatisfaction thrive. If they embraced the new way and asked new professionals how they learn best, many companies would find talent more willing to learn and stay in cyber roles at their organization.  “I think it’s about working with a new generation, just asking them: How do you learn? How do you retain information? What do you want to know? What are you interested in? So that we're giving information that helps people, that tells them the resources that are out there.”   What is a piece of advice that you wish you would have known early on in your career?  As an educator herself, Alexia understands the money-driven, certificate-driven mindset of newer cybersecurity practitioners. However, for the next generation of cyber professionals, Alexia recommends not chasing a salary. Instead, be willing to learn different skills, roles, and teams within cybersecurity. When you have the information you need to be a well-rounded practitioner, the salary will follow and you will avoid burnout or dissatisfaction with your role. “Don't worry about chasing a salary, because when you find the field that you want to be in, that you love to be in, the money will follow. The money is definitely going to follow. Learn about the different career fields, because having that information is going to help you.” --------------- Links: Keep up with our guest Alexia Crumpton on LinkedIn Learn more about MITRE on LinkedIn and the MITRE website Connect with Davin Jackson on LinkedIn and Twitter Watch the live recording of this show on our YouTube Continue the conversation by joining our Discord Hear more from Hacker Valley Media and Hacker Valley Blue
Villages, Unicorns, & the Not-So-Mythical Purple Team with SCYTHE’s Bryson Bort
Nov 3 2022
Villages, Unicorns, & the Not-So-Mythical Purple Team with SCYTHE’s Bryson Bort
Bryson Bort, CEO and Founder of SCYTHE, dons his unicorn getup and joins the pod this week to talk about purple teaming and building businesses with community in mind. After founding GRIMM, his first company, Bryson wanted to carve a path of purple team innovation in cyber and created SCYTHE to do just that. Along the way, Bryson saw a need to further engage the cyber community in education and accessibility, and co-founded the ICS Village to encourage training opportunities and bridge industry skill gaps.   Timecoded Guide: [00:00] Transitioning from army intelligence into founding GRIMM & SCYTHE [11:38] Education, certifications, & training efforts with GRIMM & ICS Village [23:53] Data driven security efforts vs compliance checklists  [32:32] Combining Plex Trac with SCYTHE & MITRE ATT&CK [41:34] OT vs IT environments & the key to understanding risks for both [50:50] Cooking up community philanthropy as the Unicorn Chef   Sponsor Links: Thank you to our friends at Axonius and PlexTrac for sponsoring this episode! Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask adaptive athlete Amy Bream. Want to learn more about how Amy controls complexity? Watch her video at axonius.com/amy  PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley    How was the transition from Army intelligence into the world of commercial cybersecurity?  Before attending West Point, Bryson had his own cybersecurity experience hacking small devices like calculators as a curious kid. He credits this early curiosity as a foundational knowledge that led him not only to a career in intelligence, but later becoming a founder of cybersecurity companies. Transitioning away from working for the government allowed Bryson to achieve a level of freedom with consulting opportunities that he previous didn’t have. “From a discipline side, it's a unique experience. I couldn't get it anywhere else. That being said, working with government is working with government. I had fun with the missions, but it was time to go. I wanted to do cyber more on my own terms, which is why I founded GRIMM.”   GRIMM and other projects you’ve worked on seem to see staff training as a priority. Why is that? As skills gaps widen and employee shortages continue, Bryson explains that companies that don’t provide training opportunities for staff stand out as major barriers to entry in cyber. Bryson’s previous company, GRIMM, and his current one, SCYTHE, both offer mentorship and training opportunities for team members. Expecting to hire someone with all the skills is unrealistic, Bryson explains, and training is necessary for security to manage threats. “There's more work and need than there are people, which means we need to invest in folks. Most jobs really don't come through cold calls or the web. Most jobs come through relationships. If you know somebody who's interested, help them get into your company.”   Why is that “blue team vs red team” mindset so hard for security practitioners to break out of?  Bryson explains that the error of security practitioners’ ways lies in not seeing security as process improvement. Unfortunately, cybersecurity is still overrun by egotistical employees, relying on whiteness or masculinity to inflate their intelligence and self importance. This only succeeds in creating tension-filled environments where there is no comprehensive assurance of security. Blue teams end up overwhelmed and red teams end up frustrated. “We don't need the pen tester or the red team to just win. Sure, that feels good, but that's not the point. We cannot be ego driven, we can't be win driven, and we can't continue to just create work that we're throwing on top of people when they already have a day job.”   How do we get more companies to embrace the “purple team” mindset as more than a buzzword? Sometimes, companies misunderstand the purpose of creating a purple team and force the blue and red teams into the same working space instead of having them work together. Bryson explains that business buy in and leadership focus are essential to the success of any purple team. If the business doesn't want to buy into creating that workflow and leadership doesn’t care about creating a real purple team, nothing good will come of the situation. “The starting point to any purple team is leadership. If leadership doesn't care, don't bother. At the end of the day, if business doesn’t buy in, it's not going to happen. The purple team process can build that momentum once you've got that, but you can't do it without that buy in.” --------------- Links: Keep up with our guest Bryson Bort on Twitter and LinkedIn Learn more about SCYTHE on LinkedIn and the SCYTHE website Thank you to our friends at Axonius and Plex Trac for sponsoring this episode! Connect with Davin Jackson on LinkedIn and Twitter Watch the live recording of this show on our YouTube Continue the conversation by joining our Discord Hear more from Hacker Valley Media and Hacker Valley Blue
Bridging the Gap: Purple is the Future of Cybersecurity
Oct 27 2022
Bridging the Gap: Purple is the Future of Cybersecurity
In this episode, we’re joined by Maril Vernon. Maril is a purple team lead and co-host of the Cyber Queens Podcast. From a background in marketing, Maril’s natural curiosity and determination lead her to a new career in cybersecurity with the Air National Guard and beyond. She discovered that there isn't one job in the field, but many types to choose from. She landed her first job in cyber security by applying her soft skills and tenacity. Maril says never to be afraid to ask “stupid” questions.    Timecode Guide:  [3:21] Maril’s origin story[7:27] Beating imposter syndrome [12:33] Curiosity of a pentester[16:47] Red Vs Blue[21:24] Purple works together[41:46] Invest in people[45:44] Maril’s hobbies[52:10] Cyber Queens Podcast[58:12] A piece of advice[59:56] Where to find Maril   Sponsor Links:  Thank you to our sponsors Axonius and PlexTrac for bringing this season of HVR to life!  Life is complex. But it’s not about avoiding challenges or fearing failure. Just ask Simone Biles — the greatest gymnast of all time. Want to learn more about how Simone controls complexity? Watch her video at axonius.com/simone  PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley    Give the Rookie a Chance  Maril explains that entry-level employees aren’t given the trust or space to grow. These employees are the future of the industry, and frankly, the older employees are burned out. When given the proper training and investment they can share the load and lift companies to higher places. “I leaned in hard to those soft skills that I knew that I brought with me, in lieu of the technical skills I did not have. And for that company, that was enough, that got my foot in the door.”   Red and Blue are Fighting the Same Enemies Red and Blue teams are often pitted against each other, but in reality, they are fighting the same war. Maril believes you should make small talk before you talk shop. Rapport, discourse, and transparency are key to creating workplace communication.  Davin and Maril explore the relationship between Red teams and Blue teams, how they differ, and what possibilities happen when they work together as a purple team. “One of the things purple teams are able to do is on the tangible side, it’s to definitively demonstrate proactive and reactive cyber resilience. If it's done properly you can actually say this is our quantified ability to sport and attack proactively or to reactively.” ------ Keep up with Hacker Valley on our website, LinkedIn, Instagram, and Twitter.  Follow Maril on Twitter and LinkedIn. Listen to Cyber Queens Podcast. Follow Davin on LinkedIn. Continue the conversation by joining our Discord.
One team One Fight With Christopher Peacock
Apr 15 2022
One team One Fight With Christopher Peacock
In this episode of Hacker Valley Blue, host Davin is joined by Christopher Peacock, a Detection Engineer at SCYTHE, to discuss all things blue team. Christopher explores why asset management is a great security starting point for small organizations and why advanced persistent threats (APTs) are becoming increasingly difficult to defend against. He emphasizes the importance of red and blue team collaboration and takes time to share his career advice to those looking to break into the field.   Guest Bio:  Chris is an Adversary Emulation - Detection Engineer at SCYTHE, specializing in Purple Team Exercises and Detection Engineering. His previous experience includes multiple roles such as Cyber Threat Intelligence Analyst, Cyber Threat Hunter, Tier 3 SOC Analyst, Incident Responder, Cyber Security Consultant, and Purple Team Lead. He previously worked at Raytheon Intelligence & Space as well as General Dynamics Ordnance and Tactical Systems. Additionally, he has experience in multiple industries, including Energy, Finance, Healthcare, Technology, and Defense. Current certifications include GCTI, GCFA, GCED, eJPT, and CSIS.   Links:  Thank you to our friends at Axonius and Uptycs for sponsoring this episode! Stay in touch with Christoper Peacock on LinkedIn Connect with Davin Jackson on LinkedIn and Twitter Watch the live recording of this show on our YouTube Continue the conversation by joining our Discord Check out  Hacker Valley Media and Hacker Valley Blue
Intelligence At All Levels with John Stoner and Andy Piazza
Apr 8 2022
Intelligence At All Levels with John Stoner and Andy Piazza
In this episode of Hacker Valley Blue, host Davin is joined by John Stoner and Andy Piazza to talk about the current state of cyber threat intelligence. John and Andy explore the gap that exists between technical team leads and security leadership, the urgent need for more entry and junior level hires in the field, as well as their favorite CTI resources and tools. Lastly, they share their tips and advice to those interested in breaking into cybersecurity.    Guest Bio:  John Stoner has over 21 years of experience in the US Intelligence Community (USIC), DOD, and national security industry with 12+ focused in cybersecurity. He has experience with Cyber Threat Intelligence (CTI), instructional design, cyber counterintelligence (CI), Defense Industrial Base (DIB) engagements, NIST 800-171 & 800-53 familiarity, Advanced Persistent Threat (APT) analysis, Risk Management Framework (RMF) and Governance, Risk and Compliance (GRC). Andy Piazza is a threat management expert with experience across multiple fields of operations, ranging from high level strategic management down to tactical/technical field ops. Led diverse teams in high-stress environments world-wide, from counter-narcotics to cyber threat analysis; achieving complex mission objectives through focusing on team development and process maturation.   Links:  Thank you to our friends at Axonius and Uptycs for sponsoring this episode! Stay in touch with John on LinkedIn Stay in touch with Andy on LinkedIn Connect with Davin Jackson on LinkedIn and Twitter Watch the live recording of this show on our YouTube Continue the conversation by joining our Discord Check out  Hacker Valley Media and Hacker Valley Blue
Defending Industrial Control Systems with Lesley Carhart
Mar 11 2022
Defending Industrial Control Systems with Lesley Carhart
Welcome to episode 1 of season 3 for Hacker Valley Blue! In this season, host Davin Jackson will be gathering the BEST blue team defenders in the field to share their expert advice, tips and strategies to up your defensive game in cybersecurity. In this episode Davin is joined by Lesley Carhart, an ICS Incident Response and hacker extraordinaire. The two take a deep dive into Lesley’s cyber background, address blue teaming common misconceptions, and where her “hacks for pancakes” tagline comes from.  Guest Bio:  Lesley Carhart is a Principal Incident Responder at the industrial cyber security company Dragos, Inc. She has spent the last 14 years of her 20+ year IT career specializing in information security, with a heavy focus on incident response to nation-state adversary attacks. Prior to Dragos, she was the incident response team lead at Motorola Solutions, performing digital forensics and incident handling services for both enterprise and public safety customers. Her focus at Dragos is developing forensics and incident response tools and processes for uncharted areas of industrial systems. She is also a curriculum developer and instructor for the Dragos “Assessing, Hunting and Monitoring Industrial Control System Networks” course. Lesley was named a “Top Woman in Cybersecurity” by Cyberscoop news, was voted DEF CON Hacker of the Year in 2020, and received the Guidance Enfuse conference “Women in Technology” award. She holds a Bachelor’s Degree in Network Technologies from DePaul University, A.A.S. in Avionics Systems and Electronics Systems, GIAC GCIH, GREM, GCFA, and GCFE certifications, and currently serves as a Cyber Systems NCO in the US Air Force Reserves.   Links: Thank you to our friends at Axonius and Uptycs for sponsoring this episode! Stay in touch with Lesley on Twitter and LinkedIn Connect with Davin on LinkedIn and Twitter Watch the live recording of this show on our YouTube Continue the conversation by joining our Discord Check out  Hacker Valley Media and Hacker Valley Blue
Hacker Valley Blue: Know Thyself Finale
Oct 18 2021
Hacker Valley Blue: Know Thyself Finale
This is the finale of Know Thyself. What an incredible journey, we feel like this entire experience flew by so fast, we got to talk to so many incredible people about knowing yourself, knowing your team, knowing your tech stack, knowing your environment, and even knowing your story. Make your organization better make your security posture better, strive for impact, what are the most high leverage things that you can do today to make everybody's lives easier, or more safe, and then yield the feedback, there might be some things that you might be missing, you might need to ask questions, ask for feedback, get some information from your stakeholders, what what are you thinking about that I might not be thinking about? asking these different things is how you know thyself. And this is how you get to know the people that are around you, your peers, your stakeholders, the more knowledge you have got started with that Sun Tzu quote, in the very beginning of the podcast, if you know yourself and you know your enemy, you need not fear the results of 100 battles. So if you really understand yourself, and you have good threat intelligence, understanding the externals, you have good vulnerability management that understands the externals and the internals, if you mash all that information together, I think you'll be able to do great things with your cybersecurity program.   Key Takeaways 0:02 Introduction to the show 0:49 Our Sponsor, Axonius  2:09 Welcome back 2:31 Reflecting on Know Thyself 3:17 Recap This Seasons Guest 3:22 Marcus Carey 4:17 John Strand 5:05 Aaron Reinhart & Jamie Dixon 5:54 Chaos Engineering 7:12 Lenny Zeltser, asset inventory 7:54 Kevin Allison, Storytelling is a soft skill 10:19 John Strand 12:13 Can we do better? 13:54 What kind of leader are you? 14:26 Do you have unsupported devices? 17:34 Ask yourself these questions 13:33 Go back to the EASY Framework 21:50 Learning 23:29 Exploration 24:00 Immersion 27:28 Reach Hacker Valley   Learn more about Hacker Valley Studio Support Hacker Valley Studio on Patreon Follow Hacker Valley Studio on Twitter Follow Ron Eddings on Twitter Follow Chris Cochran on Twitter Supported by Axonius
Understanding Your Story with Kevin Allison
Oct 18 2021
Understanding Your Story with Kevin Allison
In this masterclass of HVB season 2 we brought in a master story teller in Kevin Allison. The biggest thing is to get a person to understand, don't just summarize, don't just walk us through a Wikipedia like where you're just giving us a broad overview. And you're explaining; it’s important to remember sensory details that will help us see almost like movie scenes, what was happening between people. That is what brings the story alive. So that's a good case right there where the bones of the story were incredible. Like that's just on paper and an incredible overview of a story, but it's not going to work unless you can fill in all those sensory details that bring it alive and make it emotional for us. Storytelling is a soft skill that offers the ability to contextualize cybersecurity in a manner that any organization can understand to allow their business to stay safe.   Key Takeaways:   0:00 Previously on the show 2:37 Kevin introduction 3:20 Episode begins 3:39 Where Kevin is today 7:58 Kevin’s origin story 12:04 Cybersecurity is performing 17:08 Storytelling for business 21:00 Engineering a story 26:12 Authentic storytelling 34:54 Speaking isn’t perfect 41:02 Where to find Kevin   The Story Studio RISK!: True Stories People Never Thought They’d Dare To Share RISK! Podcast Twitter Facebook Instagram Risk Show Podcast Learn more about Hacker Valley Studio Support Hacker Valley Studio on Patreon Follow Hacker Valley Studio on Twitter Follow Ron Eddings on Twitter Follow Chris Cochran on Twitter Sponsored by Axonius
Understanding Where You Are with John Strand
Oct 18 2021
Understanding Where You Are with John Strand
If want to get into computer security, you're going to learn to love it, you're going to have to be successful, because a lot of computer security isn't just about bits and bytes, it's really about effectively communicating what needs to be done to the right people. In this episode we have the incredible John Strand. Organizations need to become more proactive, and see where those weak spots are to protect themselves from something like ransomware. You need to run a pen test because you can have somebody literally launch those attacks, and identify those weaknesses in those vulnerabilities before the bad people do. What's the gap that we can all learn from? It's passwords. By and large for most users, passphrases are the way to go. And, multi-factor authentication is actually a very sound strategy. If you look at one key tenant of computer security, complexity is the enemy of computer security. And security is constantly trying to catch up and protect against yesterday's attacks. So, the future is more connected, it's more complicated. And the problem is, we still have people that use weak passwords, we still have people that click on links from strangers. And ultimately, when we're looking at that future, you're going to see the exact same problems that we've always had complicated on a much, much, much, much, much larger scale. As things get more and more pushed to the cloud. There'll be no shelter here, the front line is everywhere. World of computer security.    Key Takeaways: 0:00 Previously on the show 2:02 John introduction 2:44 Episode begins 2:47 What John is doing today 3:45 John’s core tenets 5:51 How pen testing is “Blue” 6:17 Why understanding fundamentals matters 8:55 Ransomware 10:41 Organizations need to be prepared 11:58 Password gap 13:37 Password philosophy 17:07 Multi-factor authentication 21:40 What to do today 24:24 New problems 26:44 Learn your own network 28:26 Where to find John   John Strand on Twitter John Strand on LinkedIn Black Hills Information Security Learn more about Hacker Valley Studio Support Hacker Valley Studio on Patreon Follow Hacker Valley Studio on Twitter Follow Ron Eddings on Twitter Follow Chris Cochran on Twitter Sponsored by Axonius
Learning Through Chaos Engineering with Aaron and Jamie
Oct 18 2021
Learning Through Chaos Engineering with Aaron and Jamie
In this episode, we brought in two exceptional guests that are no stranger to chaos. In fact, they've identified ways to engineer for chaos. In the studio, we have Aaron Rinehart, CTO, and founder at Verica. We also have Jamie Dicken, former manager of applied security at Cardinal Health and current director at Resilience. These two are also authors of Security Chaos Engineering. If you haven't read that book it's already out, you should check it out.  Chaos engineering is the technique of introducing turbulent conditions into a distributed system to try to determine the conditions that cause it to fail before it actually fails. So they simplify it. What we do with chaos engineering is learn about the system without experiencing the pain of an outage or an incident. You learn to trust your gear by testing. The biggest impact really came once we understood how security chaos engineering fits into the bigger security picture. It's not about just being a part of the latest and greatest techniques and having the excitement of doing something that's cutting edge, but security chaos engineering at the end of the day. It's useless unless what you've learned drives change.    Key Takeaways: 0:00 Previously on the show 1:40 Aaron Rinehart and Jamie Dixon introduction  2:08 Episode begins 2:59 What Jamie and Aaron are doing today 3:13 What Jamie is doing 4:13 What Aaron is doing 5:00 Discuss chaos engineering 9:26 Importance of chaos engineering 10:16 Myths of chaos engineering 12:55 Chaos engineering customer impacts 17:34 Learning to trust the test and end result 19:03 Reader and customer feedback 22:21 Chaos engineering gone wrong 27:39 Implementing change in cybersecurity 28:11 Building a team of experts 39:08 Getting involved in chaos engineering  41:09 Tools for listeners 43:25 Keeping up with Aaron and Jamie     Aaron Rinehart on Twitter aaron@verica.io Jamie Dicken on Twitter Verica on LinkedIn Verica Free Book  Learn more about Hacker Valley Studio Support Hacker Valley Studio on Patreon Follow Hacker Valley Studio on Twitter Follow Ron Eddings on Twitter Follow Chris Cochran on Twitter Sponsored by Axonius
Mastering the Fundamentals with Lenny Zeltser
Oct 18 2021
Mastering the Fundamentals with Lenny Zeltser
In this episode, we brought back our good friend Lenny Zeltser.  Lenny is Chief Information Security Officer at Axonius.  He's developed a mindset of looking at security components as building blocks to create a holistic security environment. To this day, even while operating as an executive, he has wisdom that anyone can learn from. Quite often, the less sexy aspects of information security are ignored, when in reality, you need to understand what resources you're supposed to protect, which assets are compromised, and the infrastructure for your organization.  People jump right into fighting the big fires, and as you know, there is a reason why there are so many day-to-day urgent activities.  To start moving in a positive direction, Lenny shares this advice, “Understand what the major data sources you can tap into rather than thinking ‘let me create this one new way of serving everything I have are.’”  The information is there. Think about three sources of information that might get you the biggest bang for the buck!   Key Takeaways:   0:00 Previously on the show 1:40 Lenny introduction 2:05 Episode begins 3:10 What Lenny is doing today 5:35 The evolution of Lenny’s career 8:30 Parallels between beginning and now 10:38 Journey and growth of REMnux 13:00 Challenges Lenny has faced 15:21 Collaboration surprises 17:18 Horror stories 20:18 Enforcing policies 23:34 Asset management 26:08 New tech and trends 28:45 Biggest discovery about self 32:38 Advice for others 34:24 Keeping up with Lenny     Links: What Lenny Does Lenny on the Web Follow Lenny on Twitter Lenny on LinkedIn Learn more about Hacker Valley Studio Support Hacker Valley Studio on Patreon Follow Hacker Valley Studio on Twitter Follow Ron Eddings on Twitter Follow Chris Cochran on Twitter Sponsored by Axonius
Being the Charles Xavier of Cyber with Marcus Carey
Oct 18 2021
Being the Charles Xavier of Cyber with Marcus Carey
Know thy organization is key! Wise words from the powerful Marcus J. Carey.  Don’t be afraid to admit the bad stuff and be honest about the situation.  Most of the time people get fired because they are scared to admit the failure.   You have to build a tight network of people you trust who will be brutally honest with you.  You need those people who are going to tell you the truth.  Other people will see your superpowers before you do. Superman didn’t know he was different, but others saw the differences and the strengths he didn’t even realize he had.  Always pay attention to how people react to what you do, then you will figure out what you are really good at.  We over emphasize what we suck at and ignore what we are good at.  Don’t do that. You need to understand how amazing, awesome and beautiful you are.  Double down and double down hard.  Do not be afraid to show your talents and be confident in your superpower.   In security, there is a role for everybody.   Key Takeaways:   1:40 In this episode 2:12 Welcome 3:40 Marcus background 4:57 What lead Marcus to cyber 7:09 Self discovery 9:48 Creations and inventions 14:22 Gathering and retaining information 17:53 Auxiliary skill 21:35 Abilities and mission 25:26 Overlooked areas 31:44 Advice to others 35:41 Staying up-to-date with Marcus   Links:   Marcus on Twitter   Marcus' Books on Amazon Marcus on LinkedIn Learn more about Hacker Valley Studio Support Hacker Valley Studio on Patreon Follow Hacker Valley Studio on Twitter Follow Ron Eddings on Twitter Follow Chris Cochran on Twitter Sponsored by Axonius