Jason Wood

I noticed something rather unattractive about my behavior late last year.

I had fallen into the habit of being overly critical in my view of the world. It was just so easy to criticize organizations that had failed in some way. This tendency is one of the uglier sides of the security industry.

And I had let myself fall in with it.

Why It’s Easy to be Critical

After an episode of the Security Weekly News podcast and I realized I had been really critical in my commentary.

I had focused solely on the problem that was covered in my news story and was critical of whoever was affected by it. I usually wrote my commentary not long before going live, so I was often in a rush to finish. This made it easy for me to simply point at an issue, be a bit snarky for entertainment value, and leave it at that.

It was the easy road and was utterly useless.

Finding Solutions Takes Work

Even as I write this, I find myself thinking about the problem instead of the solution.

It’s hard to avoid being negative and critical. In security we look for problems and they are many to find. The difficult part is finding solutions to those problems. We won’t find easy answers to difficult questions and problems.

Instead we need to sit with the discomfort of a problem and explore ideas to solve it.

It is not a process with many dopamine hits. You start off with an idea of how to approach the issue, then immediately find reasons why that approach may not work. Perhaps those issues are show stoppers, but they are likely a sub-problem that needs to be broken down and addressed.

Finding a solutions is usually iterative process with many setbacks.

So what do I do? The only solution I can come up with is to change my focus from being problem seeking to solution seeking. And then direct my efforts accordingly.

If nothing else, I might be less overwhelmed by my own issues and find more solutions to them. I think I could use some more of that.

You never know what will send you down a path.

I’ve spent almost 25 years working technology and have put a huge amount of effort into learning new things. I couldn’t even guess how much time I’ve invested in it.

Here's how I first got interested in Technology:

After years of using family computers, I finally bought my first machine.

The problem was that I didn’t know much about computers worked. I had done some programming in middle school and high school, but that was about it. My “new” computer was a home built system that I wanted to upgrade.

But how do I do that?

About this time, my grandparents took their computer to an electronics chain for repairs. It came back with spare parts. According to my grandmother, they said they didn’t know what it was for.

There was no way I was going to let that happen to me.

I signed up for a PC upgrade and repair class as the local junior college as soon as I could. Through this class I found out that I enjoyed knowing how computers worked. Less than a year later I decided to work in computing as a systems administrator and started my training.

That turning point has provided for my family for a long time now.

In 1849 economics was described as “the dismal science”, but today we might describe security as a “dismal profession.”

I call it a dismal profession because it requires those who work in it to always be looking for what could go wrong and be hunting for the next problem. I believe it gives us a generally negative outlook on things, which flows into the other areas of our lives. It’s hardly the only dismal profession, but the cost we incur for working in the field is real.

Like all dismal professions, society depends on those who work in ours.

Why Work in a Dismal Profession?

Security is a critical component of the technology driven world we live in.

Adversaries are a constant threat that we face every day. Ransomware operators bring businesses to their knees and, when they target healthcare organizations, present an actual risk to human life. Nations have used cyber operations to disrupt critical infrastructure, steal intellectual property, and more.

We need skilled professionals to work in the field to protect how our civilizations function. Even though we will be affected by it; especially if we pour ourselves into it.

The question is, what can we do about it?

Make Time to Take Care of Yourself

Many of us (including me) have cratered ourselves because we never turn it off. We can't keep this up.

Schedule time to step away from a screen, get out of your chair, and go do something to refresh yourself. This may be difficult, because we’ve been encouraged to make our profession our hobby too. We may not know what would even be interesting to do away from the keyboard.

Experiment. Try things out. Be prepared to discard things that don’t work and try something else. Take vacations that are for fun.

If we do not make the time to take care of ourselves, then we end up paying too much of the cost of working our “dismal profession.”

Over the years, I’ve noticed that having standard operating procedures (SOPs) consistently makes things go better. Writing them isn’t the most exciting part of security, but if done well they continue to pay off over time.

Let’s consider the use of SOPs in threat hunting.

Not Missing Steps in Recurring Tasks

There are a lot of steps in conducting effective threat hunts and remembering everything you need to do is unlikely.

You have multiple data sources, different ways of searching them, and many different commands and queries to run. The chances of missing a step are high, especially when someone interrupts you with a problem they have. You may only be able to periodically do threat hunting, so it’s easy to forget things.

Documenting how you do a threat hunt ensures you aren’t missing opportunities to discover an intrusion.

Improvement Over Time

Threat hunting isn’t static, nor does it arrive in perfect form.

Adversary tactics and methods change over time, and you need to adapt your hunts to what they are doing. As you use your SOPs in repeated hunts, you’ll find ways to build better queries to optimize performance, to make better use of your available data, and to exploit new data sources. You’ll see gaps in what you are looking for and be able to fix that.

By writing out how you do your threat hunts, you will discover ways to improve your hunting.

Someone Else Can Backstop You

Being the only person who can do something is a great way to guarantee you’ll be stuck doing the same work forever.

Someone else could be hired to help you out and you need to get them up to speed. Or you might decide that you’d like to take a vacation and not have your threat hunting stop while you are gone. You may also be up for a promotion because you’ve done such a good job at building your hunting program.

All of these are significant personal benefits to writing SOPs.

Especially the vacation part; so you can rest, refresh, and come back ready to engage with the adversary again.

I’m always on the lookout for good reports or articles about intrusions to evaluate defensive measures.

They are a great source of information to overlay what adversaries are doing to a security architecture. And it doesn’t cost you anything to do it.

Here’s how I like to do this.

Finding a good report

First, I need a good article or report to review.

To be a good report, I’m looking for a high level from how an adversary got initial access to the final impact. They won’t contain the details or every step, but a good one will at least give a good flow of the intrusion.

Usually, this is a report by a security vendor, but it’s not unusual to find articles on news sites that contain enough information to be useful.

Applying the information

Let’s say we find an intrusion that began with a password guessing attack.

These attacks still work too often. The victim experiences a string of login failures and eventually the adversary makes a correct guess. They then login to a service that is exposed to the internet.

These attacks ubiquitous online.

Let’s apply it to an intrusion that began with RDP on the internet without multi-factor authentication.

• Do we have RDP hosted on the internet? No, we don’t.

  • But we do use VPN for remote access...

• Does the VPN allow access with only a username and password?

  • Frequently, the answer is yes.

• What would prevent the attack from being successful?

  • Solid multi-factor authentication. Remove all default accounts.

Now we know we have something to fix, and where the problem is. We fix that and repeat the process, going deeper into the network as we proceed.

Putting it into practice

This process can be as simple as a mental review of what you have in place, or it could be the foundation of a tabletop exercise. Or full attack trees with lots of branching options.

But now we’ve applied what adversaries are doing to what we are defending and have probably learned some lessons in the process.

I’ve told myself for years that I’m not an ideas person.

This is really frustrating when I try to figure out a topic for a presentation at security conferences. I usually spend hours laboring just come up with the idea. With enough time and effort, I will usually find something.

This month I stumbled into a much easier way to find a topic and it only took a few minutes to create two CFP applications.

How It Happened

Last month I decided to try out Ship 30 For 30 as a way to get into a regular writing habit.

As part of this, you are supposed to write every day for 30 days. (Or nearly every day. Stuff happens.) I’ve been working my way through the program for a bit over two weeks. Some posts seem to get interest from folks, while others don’t. No big deal, I’m creating a habit.

Last week I remembered that the CFP for SAINTCon was open, and I had planned on submitting a presentation. Ok, but what do I want to share? I felt stumped. Again.

Then I looked at the small library of posts I had written and realized I had topics ready to go.

My Results So Far

It only took a few minutes to put together my presentation application, since I had already worked through the topic.

The flow of the presentation was written down and creating an outline of it was no problem. While I was at it, I saw that BSides Cache was looking for presentations, so I selected a different idea and submitted that one to them.

You could almost call this a shortcut, but it obviously takes work up front. My presentation ideas may or may not be accepted, but (as with most things) I expect I will improve as I continue to work at it.

 The lesson to me is that writing consistently creates a bank of thoughts and ideas to tap on demand. Huh. What do you know…

Threat hunting when you are the only security person is a challenging job to take on.

You are responsible for everything that remotely sounds like security, so someone is always bringing a problem (or complaint) to you to fix. As important actively monitoring your environment is, it doesn’t scream at you like a down host or urgent deadline, so it is very tempting to only depend on automated defenses. The problem is that those notifications usually come late in to an intrusion.

I found myself stuck in this trap and managed to break out of it while still juggling all the sudden “emergencies” that people brought to me. Here’s what I did.

Made Time to Implement Better Monitoring

The first step was to actually implement the capability to hunt for malicious activity. 

I didn’t have any budget, but I was able to repurpose some old hardware, configure some SPAN ports, and setup Snort, Squil, and other tools to capture network traffic. The whole system was made of open source tools and rules, which allowed me to review events and network data. The tools would be different now, but the idea is the same. It took some late nights and weekend work to get this completed, but it got done.

Today, you can review where your systems and apps are, decide what tools would work, get them implemented, and then schedule the time to do the work.

Made Threat Hunting an “Urgent” Task

The next step was to make doing the hunting a task that had to be done.

No one other than me cared about my new urgent task, but I created a process that had specific output that I tracked to make it more important for me to get it done. I used Jira tickets to track what I discovered during my hunting sessions and required it to be done at least a few times each week. It wasn’t perfect, but it worked, stuff was found and fixed, and I felt a lot better about my work.

There’s not much to change here today, other than how you would want your process to work. Determine what you need to do per hunting session, how to track what you found and how you did it, and put it to work.

Adjust over time and you’ve got the start of your own hunting program.

Speaking at conferences or in other public settings is a great opportunity to boost your reputation and increase the security of your career.

There are lots of channels to share things you’ve learned and establish your expertise. We can write, we can post videos, and share things on social media, but I can’t think of a more impactful one than speaking in person to a group of people. When you get on stage you have everyone’s attention for the next 30 minutes to an hour.

Everyone in the room is there because they want to hear what you have to say.

Here is what you gain for facing any fears you may have and step up to the microphone:

Your Credibility is Increased

Giving a presentation requires a great deal of study and preparation. You likely already have good expertise in the area you want to talk about. You are seen as an expert in this area by everyone in the room. As a result, your credibility goes up immediately.

Establishes Your Reputation Publicly

There are many smart, talented people in cybersecurity, but the only people that know about them are their co-workers. Being a conference speaker establishes your reputation to a larger group of people. Typically, your presentation is recorded and published on the conference’s YouTube channel. You can (and should) put this on your resume and social media profiles.

You will also be able to meet new people that may introduce you to opportunities that would have never come your way otherwise.

You Become a Stronger Job Candidate

All careers go through ups and downs over the years. You will need to change jobs or find a new one. Depending only on your resume to demonstrate your value to employers can be a very rough road. Potential employers read hundreds of resumes for open positions. If employers can watch you give a presentation on a skill they want, you aren’t two pages of text anymore.

You someone they can see and hear sharing your experience with things they want. You can become a much more desirable candidate.

Beyond these three points, you will make number of new friends if you keep presenting at conferences and being visible in the field. It’s unnerving at times, but it also can be a lot of fun.

If you are the sole security person at your employer, you have lots of competing demands for your attention.

Because of this, you don’t have much time even for the really important tasks; even things like actively looking for intrusions. Fortunately, intruders tend to follow some patterns that you can prioritize for monitoring. And because of your time constraints, you'll want to make this monitoring as quickly repeatable as possible.

Here are a few observations that may help you from the hundreds of intrusions that I’ve analyzed.

Initial Actions

Initial access is usually made through stolen/brute-forced credentials, a phishing email, or a missing patch. This means that an application or an account will suddenly start doing unusual things.

This activity frequently begins with commands to figure out where they are on the network, what kind of system they are on, and what kind of permissions do they have. For example, how often do you think Dave in Accounting uses the netstat command? (Answer: Never) The intruder needs to figure out what they have access to, so they will spend some time working on this.

Actively look for unusual behavior as much as you can and make the process of searching for it as quickly repeatable as possible.

Credentials and Network Discovery

Once the intruder has some information about the host they are on, they start looking for more credentials and hosts.

Adversaries have a goal beyond compromising a single host, so this is a logical step. They will try to reach hosts that have important data on them and collect additional credentials to use as they exploit the network further. Whether they are looking to ransom or steal data, they are going to need to find it first.

This type of activity is very common and is also important to hunt for. Again, make it as repeatable as possible.

Why Focus Here? 

Why did I decide to share these observations? Because they get you closer to the beginning of an intrusion rather than the end of it. If we can catch the adversary early on in an intrusion, then we can prevent an incident from turning into a data breach.

“Should I start directly in security or should I work in IT first?”

This seems like a question that is frequently asked by folks who want to get into infosec. When I’ve been asked this, I’ve always said to start out in IT or development first. To be candid, my response is largely based on my own path into security.

But is it a good answer? Someone I know and have a great deal of respect for has the exact opposite opinion. This caused me to reconsider my view.

Let’s take a quick look at the two.

Starting out in IT or development

I think there are some benefits to starting out in a job that writes apps or manages IT systems. 

You learn a lot about how networks are managed, what practices are used in development, and generally what our technology counterparts are dealing with. You are able to learn about a lot of the mistakes that are made and why it can happen. You also figure out what makes their lives hard and why.

This has helped me out a number of times, so I’m partial to this path. It’s a longer road though.

Starting immediately in security

As I thought about the opposite approach to beginning in security, there are also some positives that come to mind.

Primarily, you don’t have to spend years doing a job you don’t want as a stepping stone to getting to infosec. The time and energy that would be put into learning how to manage Active Directory (for example) could be put into learning forensics, incident response, penetration testing, etc. That’s a definite advantage, since you’d likely be younger during that initial learning stage and would probably have fewer non-work responsibilities. 

So I can see why others would recommend going straight to security.

So which is better for someone? I still have my preferences, but it varies from person to person. 

Which would you recommend? What thoughts do you have? I’d love to hear what you think.

There are many traits that are desirable in a security professional, but I believe there is one that tops them all. Integrity.

I suspect there are some folks who would protest this statement and cite other characteristics that they value in security pros. Curiosity, technical skill, work ethic, creativity, and more. I don’t want to downplay any of these traits, because they are highly valuable to me too. However, I think a person’s integrity is still the most important of them.

Our employers and clients must know they can trust us and our integrity if they are to hire us.

Why is our integrity so important?

Those who hire us give us access to some of the most sensitive aspects of their businesses.

Here are a few of the things we are entrusted with:

• Privileged access to critical assets and information

• Knowledge of where the business is vulnerable

• The responsibility to protect the business from disruption

Frequently, we are hired because we actually have the knowledge to exploit systems and how intrusions are conducted. Despite knowing that we have this capability, we are put in these positions of trust.

Integrity in action

Here’s one of many stories I could tell about how this has played out. Late one night, my employer, another consultant, and I were working on a penetration test. We were on Skype at 3am trying to keep each other awake, when my co-worker told us about a vulnerability he had found earlier that day. If exploited and not caught, it could be used to send a large amount of money (potentially millions of dollars) to the attacker.

It was a great find by the consultant and one that were both laughing over and congratulating him on. Our employer made a comment about how important it was that our client (and he) could trust us not to abuse the things we found. This was obvious to me, but also stuck with me.

If our employers can’t trust us to act with integrity, then they can’t hire us. Our reputation for living with integrity is the of the most vital asset we have.

In a few minutes, my family is heading out to celebrate the 4th of July with some of our extended family.

The 4th is one of those days that we celebrate with food, parades, fireworks, and more. It's a celebratory holiday with few somber moments. It's the national highlight of summer.

While the 4th is a celebration of a single day and the ideals connected to that day, to me it is also a recognition of what has allowed us to continue to celebrate it for the last 248 years.

Some of my ancestors directly participated in the American Revolution. I don't know much about these people, other than that they exist. They and their families sacrificed and suffered so that we can celebrate today.

More personal to me is my grandfather who was a mortar crew member in the 3rd Marine Division during WWII. My other grandfather was drafted after WWII and was stationed in the Philippines. My aunt, uncle, and dad all served in the Army during the Vietnam War, with only my uncle serving in combat (1st Air Cav). I have friends who fought in Iraq. Today my son serves as a member of the Army National Guard.

So while I celebrate the birth of our nation today, I also remember and celebrate those who raised their hands to serve and the sacrifices their families made. Their reasons for doing so are varied, but without them we wouldn't be looking at America's 250th birthday in 2026. 🫡

I think I must give the YouTube algorithm a headache as it tries to figure out what I’m interested in. I am constantly curious about a wide variety of seemingly unrelated things, and I tend to binge watch videos on them.

I hear my curiosity is an asset when working in security, since there is always something new to learn. It’s just difficult to limit curiosity when something catches its attention.

Here are 3 subjects that have my exploring right now and why:

Geologic History

My wife and I were driving through Montana and southern Idaho a week ago and we were fascinated by the geology of the area. When we got home, I started reading articles and watching videos about the region. It has a wild history of flooding, glaciers, and volcanos.

My interest here purely curiosity driven. We live in a world with crazy, amazing things in the natural world. Why not indulge in topics related to it?

Fly-Fishing

I first got interested in fly fishing a few years ago, but never did anything with it.

Recently, my son and I were able to go on a guided fly-fishing excursion and it was a great day to be outdoors. Now I’m trying it out on my own (and yes, learning more on YouTube) as a way to detach from work and get some sun.

The Needs of Security Folks in SMBs

This is more of a professional passion project. My first position in security was at business with a couple hundred employees. I had a bit of experience, a lot of enthusiasm, and few resources. I had to learn a lot of lessons the hard way, and mostly on my own.

While my professional life has changed a lot since then, I’ve never forgotten what it felt like to be in that position. So I keep kicking around ideas on how to help the folks that are an “army of one” at their companies. I'd love to find a way to make these folks' lives easier.

How about you? What do you enjoy learning about that may or may not be work related?

One of the more frustrating aspects of working in security is seeing a danger that few others seem concerned about.

This can be even more upsetting when it feels like your employer has little interest in responding to your recommendations. You've seen the problem, documented the potential impacts to the organization, and proposed controls to decrease those impacts. All to no avail. What can you do?

One answer is to create a plan to respond to the incident that could occur if the wreck happens. That way you are ready and are the one with the plan to right the ship.

Making the Plan

How you go about doing this will depend on how you work best.

For me this involves getting a blank sheet of paper and drawing out a diagram that starts with the event, then branches off down different paths based on what could happen. For example, if someone falls for a malicious email, they could be phished for credentials or install remote access software. If it was a phishing message, then the diagram branches off into different steps to take in response.

However you develop your plan, make sure to document in whatever is appropriate at your business. A document, a wiki page, or whatever.

Let People Know About the Plan

Once you've got things documented, let others know about it. Ask someone responsible for desktop support to look it over. Ask your manager to review it. What did you miss? Add in their suggestions.

The benefit here is that they know you've created a response plan and you've asked for their expertise. They become a bit more invested in it and they know it exists.

In the end, you and your employer are better prepared if the risk you've spotted turns into an incident. It won't be a perfect plan, but you'll be far better off than not having a plan at all.

Developing your ability to do this is also significant skill to have in your arsenal.

Years ago I was the sole security person at my employer and I felt like I could never get security stuff done.

You probably know the feeling. If it wasn't on fire, due tomorrow, or involved someone standing over your desk, it just didn't happen. It was very frustrating because there was important work not being done and it was my job to do it. I just didn't have the time, or so I thought.

After a while I got frustrated enough to do something about it. Instead of waiting for time to be available, I scheduled time to do the work.

What it looked like

I built a crude process to track my progress doing active security monitoring. I logged my process in Jira tickets. Whatever I found in Snort, Tripwire, and Splunk got logged. I couldn't do it every day, but when I had it on the calendar I tried to spend at least an hour digging into our security data.

It sucked at first, but it got better over time. I got familiar with what was normal. I spotted stuff that wasn't. When the auditors came, I had my Jira tickets to demonstrate what I had been doing.

It wasn't perfect, but it was better than waiting for the time to suddenly be available.

I stumbled into a useful lesson. Don't wait for perfection. Schedule time to make the most of what you have. Improve over time. Track your progress.

I spoke at my first tech conference 15 years ago.

Since then, I've had a number of people say that they'd like to give a presentation, but then they say things like:

• I can't do it. I just don't know enough.

• I'm afraid I'd forget what I wanted to say and will freeze.

• What if someone gives me a hard time for it?

Here are 3 simple (but effective) thoughts I'd give anyone who would like to speak at a conference, but are holding back:

You absolutely know enough about help someone else

We think we need to have have incredibly deep expertise before we have anything to share. It's just not true.

Everyone is at different levels of their security journey. Some are at an earlier point and would love learn from your experiences. In several of my presentations, I would openly say that this was something I wanted to learn and that I was sharing what I had found out.

Pick something that you've learned (or are learning) and share your story about what the process. Folks will be interested in your topic and come to hear what you have to say.

Practicing your presentation reduces fear

Practicing what you have to say will make you far more confident in your ability to say it on stage.

I won't say that practicing eliminates fear, but it will make you far more confident that you'll be successful. Not only does it get your thoughts in order, you'll find the glaring mistakes that your slides have in them. (At least it helps me find the holes in my presentations.)

Plan to deliver your presentation to your cat or dog a couple of times and make sure you do it. It helps immensely.

Your audience wants you to succeed

When people decide to attend your presentation, they want to hear you have to say.

Usually there are a number of presentations going on at the same time as yours. Your audience saw the description of yours and picked you over the others. They are there to pick up some new things that will help them.

Don't waste your energy worrying about someone who might criticize you. They didn't get up on stage. You did.

Don't hold back if you have the desire to speak publicly. It can be a lot of fun and helps us all grow.

A long time ago, in a job far, far away I made my first serious professional mistake. I deleted 10 million image files on a website that received about 4 million page views per day. And I did it in the middle of the day. Oops...

I was learning to write shell scripts for Linux, and I needed to reformat the file names of these image files to make them work consistently on Windows and Linux. Perfect. I'm learning a skill and here is a problem to solve.

My script was about 95% working in a test directory and I thought I knew the fix. I made a "small" change to the script and decided NOT to test it and just run it in production. I executed the script.

The script was rapidly deleting files and I had no idea what was going on. Part way through, I decided to cancel the execution and check the results. Almost at the same time our monitoring team called me to tell me that the images were not loading on the site. I checked and found that I had deleted about 50% of the files with my "small" change to the script.

Some mistakes are so scarring that you experience an almost physical reaction when you come close to remaking them. What I learned from this one has served me well for my entire career.

Here's what I learned:

Lesson #1: Always test after making a change to something

This was a classic trap. I only made a minor change, so it should have a minor impact. Nope.

No matter how small the change, test what you are doing every time before running it in production.

Lesson #2: Don't make major changes during peak utilization

It was in the middle of the day when people were using the site steadily. Making this change at this time was a dumb idea. I should have waited until we were out of peak traffic and the impact of any mistakes would be smaller.

Lesson #3: Always have a way to recover

I lucked out here. I had made a backup of the files a couple of days earlier to another server. Recovery was as simple as reconfiguring 6 web servers to get their files from this server. It was a high impact event, but had a fairly short duration.

Now I always make sure I have a path back to where I started.