20 tips for aspiring #SOC analysts.
TL;DR - Candor, curiosity, passion for learning, humility, leading with empathy and being a good teammate can take you very far.
1. Candor is a strength, not a weakness. It’s OK to admit you don’t know. Learning what you don’t know is a gift, it’s an opportunity to get better.
2. Before you solve a problem, own the problem.
3. Passion for learning will get you very far. Learning begets learning and an increased capacity for knowledge often follows.
4. Learn how the internet works. You open Chrome and type “https://t.co/hPD46O7x0a” and hit “enter”. What happens next? What do you see in the pcap? Through this, you’ll begin to truly understand protocol.
5. Lead with empathy. For the orgs you protect, for the employees you defend, and for your team mates.
6. Learn the basics of file systems. You open a file on Windows computer. What happens next? What about on Linux or macOS?
7. Learn how to think like an attacker. Learn the basics of pen-testing and red teaming. CCDC, CTFs, YouTube are all ways to start to learn the basics.
8. When you encounter something you don’t know (this will happen often), it will bother you that you don’t know. Convert that energy into action.
9. Lateral movement is when an attacker moves to other systems. Steal this mental model: Access. Elevate. Movement. Storage. An attacker will gain access, find privileges that enable them to move to other systems and then repeat until they find the data (Storage) or path to complete their objective.
10. The quality of your investigations will be linked to the quality of the asks you ask. Ask: what is it? (backdoor, utility, API key), what does it do? (allow remote access by communicating to c2?), when did it get there?, how did it get there? where else is the activity? what do you need to do?
11. Speaking of investigations, great ones are stories (based on evidence). Learn how to tell great stories via verbal and written communication. Keep a copy of “Elements of Style” within reach. Practice writing. “The Windows Security Event log recorded a type 3 network login using the “admin” account originating from the IP address 10.10.10.1.”
12. I don’t know every Windows event log type. I don’t need to (neither do you). But, I do know how to establish a timeline of activity. Windows event log recorded event blah blah during known periods of attacker activity? Look it up. Interpret what happened. Establish new leads. Pursue them.
13. Speaking of event logs, /var/log on a Linux-based system can get you really far in terms of live response analysis.
14. Read open source reporting. Understand what’s happening and then ask, “how would we detect this?” And, “how would we investigate and respond?”
15. Networked apps are cool and all, but building your professional network is just as important. Don't overlook this.
16. CTFs are a great way to up-level your knowledge and experience. Set a goal to participate in one per quarter.
17. You won’t always have direct evidence. Sometimes you’ll need to infer what happened to find the next investigative lead.
18. Be a great teammate. Share knowledge. Build shared experiences. Help the new person.
19. Engage with the #security community (however much you feel comfortable with). There are so many talented folks that are willing to share what they know and help others.
20. Don’t stop learning. You’ll make mistakes. It’s fine. Learn from them.
In closing: stay curious, stay humble, never stop learning and be a good person and teammate. This will get you *really* far.
Feel free to drop a comment below with guidance, tips, or tricks to help others.
Bunsen: The Puppy Who Healed Our Family
For something to begin, something else has to end.
Our golden died of cancer.
The loss of a dog leaves a huge hole in your house. The place that they take up physically, of course, but also the place that they take up spiritually.
No, not something metaphysical, but something I feel is real.
There is an energy to a dog.
Each and every single dog has this unseen force.
I’m not talking about an actual, tangible thing, I’m a science guy, but I’m talking about the fact that a dog CHANGES your mood. I’m talking about how a dog, most days, may be the parts of your day that are the BEST parts of your day.
That IS some kind of force.
A loss of that can rock you.
A chance encounter with a very kind woman told me through my tears that grief can go somewhere, that the pain, sadness and emptiness can be poured into another creature.
For months I didn’t want to even think about another dog.
Maybe, I didn’t want to dishonour her memory Maybe it was because I had lost my best friend.
But those words - grief can go somewhere - led us to Bunsen and Bunsen led our family to happiness again.
A week A.G.T. (after grief talk) my wife and I met a Bernese Mountain Dog puppy at a farmer’s market. It was the cutest thing I had ever seen in my entire life.
It might surprise people, but I had NEVER ever seen a Berner puppy before.
Literally the next day someone through our school district mentioned a Swiss family had a litter of Berner pups.
I told my wife about it, and she was leery at first. Berners are HUGE dogs and she didn’t want a big dog.
With some convincing we were on the road to meet the puppies.
Upon our arrival we were met by a giant Bernese Mountain Dog and teenage girl. The Berner was a bit wary, but warmed up to us quickly. I couldn’t believe how big he was. After some chit chat she asked us if we wanted to see the puppies.
The answer was yes, obviously.
Inside their garage our family went and within seconds we were swarmed by tiny bears.
Puppies are adorable, many puppies are a whole thing, and a pack of Bernese puppies make grown ass men cry.
The teen said we were welcome to say hello and see if there was one would like.
As our family knelt down, the puppies hopped about, played with each other, with some waddling off to flop and snooze.
From the back of the pack I noticed a HUGE rolly-polly puppy. For the first few minutes he didn’t approach us, but held back, watching what was going on.
I locked eyes with him, little soulful, intelligent, kind eyes.
I said, perhaps - hi puppy- and the dog padded over to me.
I held out my hand and the big puppy sucked and bit on my finger. Slowly I scooped him up.
He was heavy and warm.
He was the softest thing I had ever touched.
His giant floppy ears felt like a fuzzy heated blanket.
His giant tri-colored paws grabbed my hand.
I couldn’t help myself, I kissed his head. I’ll never forget that moment for as long as I live.
I looked at my wife with tears in my eyes and said - it’s this one. This. This is the one.
She nodded.
That puppy came home with us a month later.
From the moment he stepped foot in our house the dark cloud of grief withdrew. Each and every second that little dog was the happiest thing on Earth.
He knew his name within a day and somehow potty trained within the week. His fuzzy-chubby body just moving around was both hilarious and the cutest damn thing you ever saw.
We laughed and laughed until it hurt.
He pounced on random stuff with his comically oversized oven mitt paws.
He listened to everything I said and I talked to him constantly.
In the night, when I was alone with him, I told him of Kahlan.
I have hundreds of puppy Bunsen stories, from him rolling his crate around like a hamster ball, to freaking out on a lemon, to his first encounter with a goat.
Bunsen brought that lost energy back into our house.
The energy of a dog.
That puppy grew up into a majestic dog that we see now as a hero. Not only a hero that does what heroes do - saving lives - but a hero of the heart.
We have had the privilege of having Bunsen in our family for SIX years today, as today is the big guy’s birthday.
That’s SIX years of adventures that would fill novels, SIX years of cuddles and hugs.
Six wonderful, amazing years.
Bunsen is such a special dog, but every single dog is.
That’s what makes all dogs good dogs.
Some days, at random times, I just look at Bunsen and say two words to him.
“Thank-you”
Happy Birthday Big Guy, we just love you so very much.
Do you enjoy coding? ... more importantly, do you enjoy dumplings? then this is the meetup for you!
Join @learnwdaniel and @lizziepika in the world's first hybrid coding/dumpling-eating meetup in San Francisco! 🥟🌉
Our 1st meetup is on 2/21 👉https://t.co/rt8sABhs5L
Did you know that you can get a free M365 E5 subscription with 25 user licenses to learn, create automation, and develop applications?
I know most folks never get the chance to admin this stuff, so sign up now, and let's walk through this together :)
https://t.co/WTJ7QnZ4pf
Destin, FL airport #VPS has a dog park right outside the terminal. So much better than those rank #petrelief areas found in the #SEA#DFW and #CLT airports 🤮 although, the grassy area behind the CLT Rental Car Center was nice. Trash can at the bottom of the steps for doggy bags
I'm so proud of her. The thing that people need to understand about service dogs is that we enable & empower our handlers to live as normal a life as possible, including going to the water park. So let's not teach children to discriminate what you don't understand or is different
Mom took me & fam to the Waterpark. Mom stood w/ me in the shade while the fam stood in line for tickets. Right in front of them a woman started criticizing Mom to a child for bringing me. Mom saw & stood up for herself, saying "People with disabilities can still enjoy life." 1/2
Mom cried last night. Friends were outside with the boomies and she cleaned inside with music playing on her #GalaxyBuds drowning out the noise. But sometimes avoidance/isolating is emotionally painful, especially after 16 months of it already
:) There's a book called Hope Has A Cold Nose by Christine Hassing that's shares the stories of #veterans and their #servicedogs. I think Mom would agree