BSides LV 2022 - Wednesday - Hire Ground

[Music] so [Music] [Music] [Music] [Music] [Music] do [Music] [Music] do [Music] [Music] [Music] [Music] do [Music] do [Music] [Music] [Music] do [Music] [Music] [Music] do [Music] [Music] [Music] [Music] [Music] so [Music] [Music] [Music] [Music] do [Music] so [Music] [Music] [Music] [Music] [Music] [Music] [Music] so [Music] [Music] [Music] do [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] do [Music] do [Music] [Music] [Music] do [Music] [Music] [Music] [Music] [Music] [Music] [Music] do [Music] [Music] [Music] [Music] [Music] so [Music] [Music] [Music] [Music] [Music] [Music] so [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] do [Music] [Music] [Music] [Music] [Music] do [Music] [Music] [Music] [Music] do [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] do [Music] so [Music] [Music] do [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] do [Music] [Music] [Music] [Music] [Music] [Music] do [Music] [Music] [Music] [Music] [Music] do [Music] so [Music] [Music] do [Music] [Music] [Music] [Music] [Music] so [Music] [Music] [Music] [Music] [Music] so [Music] [Music] [Music] [Music] [Music] [Music] [Music] do [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] do [Music] [Music] [Music] [Music] [Music] [Music] do [Music] do [Music] [Music] do [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] uh [Music] [Music] [Music] [Music] so [Music] [Music] so [Music] so [Music] [Music] [Music] [Music] [Music] [Music] do [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] so so [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] do [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] so [Music] [Music] [Music] [Music] [Music] so [Music] so [Music] so [Music] [Music] [Music] [Music] [Music] so [Music] [Music] [Music] [Music] so [Music] [Music] [Music] [Music] [Music] [Music] so [Music] [Music] so [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] do [Music] [Music] do we're sitting on the tables if you could just be sure not to put food or drink on them because people will be doing resume review on those tables later and resumes get a lot of stuff on and that's not the kind of edits we want to see on our resumes so i'm kathleen smith yes it's kathleen on twitter i created higher ground seven years ago it is just an absolute wonderful thing to see so many people show up here to invest in themselves as far as what is going to happen with their career and why are why am i struggling and is everyone else struggling and coming here and being able to find out that everyone is struggling and thank you for those who came on wednesday the second morning early because it means you're really serious so we always make sure that we have a really serious talk on the second day um if any of you follow me on twitter you know that my friend mike murray usually has this spot but mike decided that life was too hard in april and left us so we have a memorial in the back but that is actually for everyone we've lost and so if you have someone you've lost over the last two years you're welcome to write a note about what you miss about them sorry i keep promising myself i won't cry and i do so it was really thank you so it was really hard to find someone who could talk about management because that is what we always talk about on the second day first day we really talk about sort of career search and challenges and how to make things better and how do we stand up to the challenges that we're facing so i was really excited when tom submitted his talk and i went yay we have so many great managers in our community who have learned through their mistakes and through their opportunities and their challenges and are willing to put it together in a talk and share with you so tom thank you for being here this morning and really looking forward to your talk and remember to talk into the might because we have an audience at home well thank you kathleen much appreciated and thank you for having me um thanks to everybody at b-sides the whole event crew everybody here has been amazing hope everybody is having a good time at b-sides this is such a great conference and i'm just really honored to be here this is actually my first time speaking at b-sides which is i know sounds a little weird besides vegas that is so i'm really happy to be here so before we get started i want to ask how many of you are current managers okay a large large amount how many of you are new managers so like you just just got started okay all right we've got several ah okay excellent yeah because i was going to say that you know welcome to the world of spreadsheets meetings and email um yeah yeah so you know you know right well there's more to management than just spreadsheets i assure you but uh but welcome um and how many of you are kind of aspiring managers you want to be there one day tim i know you do of course right few of you okay awesome well don't run away scared right by some of the things i'm going to be talking about as you can see on the agenda here there's a lot of material that i'm going to kind of cram into a 45 minute session that's why we're calling it kind of a one-on-one session but you know i want to take you kind of through my management journey and some of the things that i've learned over the years some of the failures i've made and also just some of the concepts that i've come to learn which hopefully you can take things uh take something out of this talk and then you can apply it in your daily job um so if you do me a favor think of like three things that you can take away as as i go through the presentation um and then think about how you can apply that when you get back to your job when you get when you leave vegas so a little bit about me so my career journey started you know about 17 years ago after getting out of the military i served in the united states marine corps i was probably in the best time that you could be in the military so from 1993 to 1997 it was between the desert desert storms the desert wars so not a whole lot going on even though i was in infantry as well my recruiter lied to me so that's how i ended up in infantry had to meet the quota i guess but after i got military went to school started getting involved in i.t type work so i started out on a help desk did vulnerability management i was the server guy i was running networks and servers and all of that and i was presented with an opportunity to join the very first infosec team i know i say infosec i'm saying that because i'm old right information security was before cyber security um and so i got the opportunity to start this department i was the first hire and i helped build an information security policy i got to do all kinds of things identity management i was exposed to things i had never been exposed to before and i got to coordinate our first pen test of the company and this was a kind of medium-sized property management real estate company and let me tell you it was glorious right the company i hired owned everything like in 10 minutes and i loved it i loved every minute of it and of course my my manager at the time is like freaking out they can be oh my gosh they've got access to all this data we're so vulnerable and i'm just loving every minute of them like this is what i want to do i want to be a pen tester i want to be a hacker because this is this is great so i shadowed this this gentleman i learned everything i could just from what what tools are you working on are you using you know tell me more about this and that was really kind of my catalyst into you know getting into pen testing and and of course staying technical so after that i ended up on uh at the time wasn't even called a red team it was an internal pen test team for a large bank in cleveland where i'm from and um i started doing things like physical security assessments and physical pen tests social engineering it was kind of in the golden age and i think uh chris nickerson if you know who he is he kind of coined the term tiger team he had that tv show where he was like stealing cars and all that fun stuff and and that's really was kind of the at the the start of red teaming so i was kind of in the infancy of that which is pretty cool um and then one day i started uh i left the bank and i um was consulting and i i left the bank because those of you that worked in finance or a bank they're they're like dinosaurs right very slow moving takes a long time to fix and make changes to things so i went into consulting which was the complete opposite right you're seeing different networks different clients the good the bad the ugly it was very exciting until one day my manager at the time said hey i'm taking a new position within the firm i'm going to head up like research and development and so that opens up a position in management and i said first thing i said was does it pay more money [Laughter] and he said to me no but we can change your title and i'm like okay great i'll i'll take it and in that kind of discussion with him i thought about like well do i really want to go into management when i'm a technical person i'm a pen tester i really like the technical aspect and he said well don't worry you could do both [Laughter] and i said all right great i'll do both and i did both for for a while for almost four years i was a principal consultant still doing pen testing still doing consulting but also managing a team of pen testers eventually though i got to the point where i felt burnout i was getting burned out and i needed to make a change and so i left the consulting gig that i had i went to varicode and became a manager where they told me we don't want you doing any pen testing we just want you doing um you know management and so that was uh unfortunately the last time i did a pen test was those many years ago um and we'll talk about you know people ask me like do you miss it do you miss the technical aspects and i'll say sometimes i do but management to me is actually a little bit more rewarding in a lot of ways and we'll talk about that too in this talk but um but throughout that those experiences have led me to bishop fox where i was a practice director and now an avp of consulting where i now deal with different things at the executive level so maybe one day i'll be doing a talk on executive and director level type stuff but um but yeah it's been a journey a great journey and i'm glad to share some of this with you today um and also i'm the founder and co-host of the shared security show so i've been doing that for 13 years not sure how i found time to do all that but we're one of the longest running uh security podcasts so check it out if you're looking for something to uh listen to so this presentation is i really put this together to to make us better leaders and managers and i've kind of laid out three things you'll hear three themes uh in this talk and they're all about conversations and about communication so one how can we improve as managers amongst ourselves and as our peers right it's important to talk to each other about how ways we can be a better manager and this is one of the reasons is this talk we're here we're talking about it we're listening um and hopefully we're gonna be better because of it the next one is having conversations with our teams so seeking feedback of how am i as your manager what type of feedback do you have for me how can i do my job better how can i help you that's one thing that we'll be talking about and then having more conversations with our teams about communication or i'm sorry about career conversations because that's something that i find that we forget about we get so busy in our day-to-day you know fight fighting fires and what's the next thing we need to talk about on our 101s and it's typically you know whatever the current fire is but what i'm saying is we need to take take a step back and really start having more career conversations because our employees are asking for those they need our help they need our guidance and our coaching on how to take their careers to the next level so this is important and there was a really good talk yesterday wes shepard gave a talk on failing upwards which i highly recommend you check out uh it'll be on the youtube um and great talk but you're gonna fail your teams are gonna fail and that's okay i think we have to embrace failure at some point because that's how we learn that's how we get better and i've made lots of mistakes and lots of failures in my career and and honestly early on i would get pretty upset with myself that you know especially with one thing i think a lot of hiring managers will understand if you make a bad hire if you hire somebody and you end up having to let them go say after a couple weeks in my case it was literally a couple days that i had to let somebody go that i hired that hurts that really stings and you kind of take it personally but over time i've kind of learned to just like not take those things so personally i'm human i make mistakes we all do but i look back and i think what did i learn from that experience and how can i do my interviewing how can i do my hiring processes how can i do a better job and i will say that i think over the years i've done a better job of hiring people because of those failures and because of those those bad experiences so um but failure is really the way that we learn and improve so who's uh grace murray hopper fans here yes yes she's she's an incredible leader i love this quote from her you manage things you lead people a little little thing about grace murray hopper way back in 1947 she actually kind of her and her team coined the phrase debugging um and they actually found a moth that was stuck in a relay which was stopping the operation of the computer and computers back then 1947. you can imagine it's like this entire room right um and then they took the moth out and they actually wrote a note that said first actual case of a bug being found i thought that was like really cool so back in the 40s but what i like about her is that she's absolutely a technical powerhouse right back she she's she's done so many things for the industry but she's also an amazing leader she's an admiral in the us navy right she's managing people large teams of people and so that's a little thing i like to call out about her that inspires me as someone that's been technical and now moving into management and managing large teams so hopefully she's someone that can also inspire you as well so let's talk about the problem with management um first thing i'll say is it's it's definitely the hardest and most challenging job that i've ever had um because of all the things that have to deal with especially with people but it's also the most rewarding job that i've had i thought getting you know 50 shells on my screen from you know popping boxes and accessing sensitive data that's a huge rush but it's more of a rush in my opinion of seeing my team do amazing things seeing them grow their careers seeing them challenge and doing stuff that they told me there's no way i can do this there's no way i'm capable of doing these things and they do it and you watch them do it or you help coach them through that and that is an experience that i don't think i could ever replace it's absolutely amazing the other thing about technical teams is that it can be a little bit different because i think as pen testers and hackers there's definitely the introverse verts for the versus the extroverts breakers versus fixers right we've got communicators and non-communicators you know pen testers and security consultants are an interesting bunch so sometimes you have to adapt your leadership style to those different personality types and we'll talk about personality types in a little bit but coming from a technical background jumping into management it can be very challenging and very difficult and so we'll share i'll show you some of the stories around that here coming up so do we all know the difference between a boss and a leader so a boss is i'd say more on the negative side of things right and i kind of put together just some some differentiators just so you can see but a boss really is about driving employees right and a leader is more about coaching and we'll talk more about coaching a little bit um but i did want to call out one thing in this um who has ever had a manager take uh credit for work that you did isn't that the worst absolute backstabbing thing anybody could do to you i've had it happen to me too and it's absolutely awful um so i take i kind of look at these these uh these differences you know a boss uses people they take credits but a leader develops people and gives credit and i think that's the one thing to take away from like this slide and just think about the bosses and the managers you on that bosses maybe bosses you've had in the past we all remember the good ones but we also remember the bad ones that um that maybe we even left an organization because we had a really bad manager so what is your role as a leader and speaking of kind of bad bosses i know there's a funny movie about that too but how many of you had a micro manager oh another one that's really bad right just horrible i've had those two i've had i had one manager that hovered over me back when we were working in offices and you know make sure are you done yet are you done yet are you done yet and like stuff that drives you crazy um but we don't want to be micro managers right as a leader you're really there to guide and facilitate your employees you're not there to hover over them um and you know thinking about how often we're talking to our direct reports so we'll talk about one-on-ones and the importance of that in a minute but we really need to be keep having those conversations uh about their jobs about their role and really encouraging them to do the best they can in their job and a lot of that comes down to setting the right expectations so i find that employees don't like to ask what's expected of me they want to hear from you typically so we'll talk about expectations in a little bit but i found some ways of how you can communicate those expectations a little bit better where you're not sounding maybe so forceful or you know like a dictator right but um there's things that we can do to to help that um and then when we're talking about career conversations um it's true employees are responsible for their career they're responsible for managing that but you as a leader you're there to meet those goals help them meet their goals and coach them through that so um i i find this funny too is like i've got employees like that just won't say anything of like you asked them hey so what do you want to do for training or where do you want to take your career and they just say that they say well i'm not really sure so that's your job then is to encourage them like have you thought about this have you thought about that have you thought about this and then they come back and say okay yeah i haven't thought about that that's what we mean by coaching you know giving them those ideas not telling them but giving them the encouragement so setting expectations so this is probably one of the most important aspects of managing in my opinion um and i asked too like all of you if you ever had managers that just never set any expectations with you right