How to Fail Well (In Order to be Successful) — From IT to Infosec & More

what's really great is we have so many active people in the community who give back and if you don't know Roy Watson Austin he's just phenomenal and I probably just butchered your name there I'm sorry I actually got it okay this is my last name is Smith and people don't mess it so I just want to remind people that while we have content sessions going on our conversations need to be held at a lower volume please out of respect for our people who are presenting here so one thing that we're never really told when we're part of career development is that we should be learning how to fail we're always told how to succeed or that we're going to be

evaluated on succeeding but the one of the things that we have learned through all of the entrepreneurs that we've seen out there is that it's really great that they fail and they fail really well so I was really excited to see ro Roy's presentation on how to fail because I think sometimes we do fail and then we just sort of internalize it and we let it block us rather than taking what information out of that failure and moving on so I hope I haven't given away all of your presentation but Roy ticket is away tell us how to fail great thank you first off everyone thank you for coming especially during this time can everyone hear me well or agree excellent

okay so yes as I first off I like to thank all the people that are here too and also all the people especially Katherine and and actually the whole team that set up the security besides Las Vegas especially you know this year you know being in its 10th year yeah yeah clap of hands tenth year so it's pretty much today I'm going to kind of talk about my experiences and also over a long long long period career I won't mention how long and then also talk about some things that each of what each of us can use right away and then really I wanted to kind of give enough time for for questions as well and of course if you have any other

questions let me know too what I always like to do is I always put this disclaimer up I'm not going to read it but it basically says that I'm not if I have any issues or if I have any things that are wrong I'm not liable for it and also this presentation doesn't endorse it any of the companies that I've worked at or or I am working with as well and also of course if I mention a tools you're using a legal ethical manner as well and again there's no specific one way fits all for everyone results may vary as well so first off Who am I obviously that's not my picture if you actually take a look at there's this

site remember like two-year to maybe about like a month ago two months ago there was that face app that everyone was using that I mentioned that they wanted to see how old they were would be in about 25 years and then they had like all those Barbies concerns there is actually a website here called this person does not exist it uses AI to actually design different it uses different machine learning and algorithms to create different pictures of people to actually do not exist actually take a look at it all of the slides you don't have to take notes they will also be made available too but yeah pretty much that's my twitter my gmail as well I've been in healthcare now for

a long time I also enjoy Internet of Things IOT as well and I love about privacy and building local communities also at the same time over ten plus years I created co-created with with my brother and I and other people to the healthcare informatics program at at Brandeis University in Waltham Massachusetts it's been it's a great experience and I urge you if you are teaching as well especially teaching high school high school students or middle school students or vice versa it's the experience because you learn from them as well and you can basically keep adding on to that making your course is much better too as well and also I've worked in multiple industries too and

also for the last two years actually maybe three years I also had a great opportunity to relocate it from from Massachusetts actually to Hong Kong and also working in Beijing China as well and actually to learn the language and I'm still still learning still learning Mandarin as well but it's a great experience so this is the agenda today I already mentioned about experiences I'm going to make it very simple talk about my experiences how I failed what I did wrong and hopefully you can see some of the lessons learned - and also I will mention some of the keys to being successful and really address any questions or answers - so first off I just wanted a kind of outline so

basically during my first year of college I you know was the first time you know being away and you know I always loved computers and I always like to tell the story that when I actually was before I actually knew that my love for computers I actually wanted to become a dentist and what happened was that when I was away overseas I had like a Swiss Army knife and I cut myself and I fainted for like five minutes so I said obviously blood was blood or or medicine was not for me or dentistry was not for me so I tried to pursue computers but pretty much um my undergrad year since I was away kind of

away from the family for example I kind of like you know party too much you know and did other other things you know that you know I won't mention as well but pretty much the first college I you know I failed I flunked out you know so but pretty that was my undergrad year and after that you know it was like I just I just changed my kind of like I changed my life all around and I I worked so hard basically it took me about just an additional year to graduate college I went to another college and I worked my way up while people were having relationships having other things however I basically just kept taking

classes every every semester even including the summer months as well anyway no so after the second try of course I was successful as well and I did really well and then after that I actually started working in different companies and I'll talk more about that in next few slides but what I also wanted to mention is that it wasn't until probably about five years of working in the different industries that I basically pursued my graduate degree there I did really well and then after that I I know I became an adjunct faculty and created different courses too but I just want to mention that and again I always want to mention for dozer how many Oh show of hands how many

people are our teachers and educators as well how many people we're going to be or thinking about it as well I really recommend it because we need more people especially from the industry that know that not only the theory but the this the typical books as well you we need to have the real valued practitioners as well teaching as well but anyway I just want to mention that so this is some of the titles that I've had over the past few years obviously titles don't really mean anything I think for me my perspective is that it really depends on you know what you can do for the company and how you can make it better so for example

letter A is that I actually started out in IT Help Desk you know supporting different IT infrastructures and then after that I went through like us became like a Windows system administrator during different windows system admin stuff right and then after that I went I became kind of like really telecommunications IT consultants working for different companies and over at that time I actually learns many different infrastructures environments - it's a great time because you're still young and also your your your prior traveling like 50 percents plus over the time and then after that I learned many different company's architectures as well here's a great experience of course after that it was kind of not until I I came into

Massachusetts where I actually had like my first security analyst official information security job before that it was more like telecommunications firewall you know networking Cisco basically all the Cisco stuff all the Cisco certifications but if you go if you go down the line you can see kind of like the gradual stuff and then a couple years ago maybe like six years ago I was lucky I started working at in Massachusetts for another Institute a very large educational academia institution three-letter acronym called MIT and then I was doing at at medical departments I was leading their information security program a lot of great great great a lot of challenges as well but anyway and then of course after

that I also went to work in asia-pacific it was probably one of the great great best experiences too and then of course now I've been working back in health care and pharmaceutical as well as as a security manager as well but just want to mention that these are some of the industries that I've been in consulting when I say consulting is that the reason I mentioned consulting is that it could be right for you it could not be but you get a large exposure of different industries in a small amount of time you're kind of a consultants or you're not a full-time employee but you kind of get to get like a glimpse of the

different environments - and you can try to see what what is good what is bad about every industry - and then also at the same time was in the finance you know kind of like more procedure based a finance industry - and then talk was in healthcare and then academia and and then back to health care as well any questions so far so far any questions so far okay great so next I wanted to kind of talk about these are some of the keys to being successful again these are keys from from my experience and again there's no one-size-fits-all but for example I think everyone that's that's here especially at this time today the first thing that you can do is there

we've actually been today I've actually had about over five to six people during the the coaching sessions is it's a great experience and I heard you if you haven't taken advantage of that feel free to either do also ten talk to the coaches they have a different perspectives as well depending where they've been experiences as well and what they've had things that work for them things that have not worked for them and also also take a look at the resume review sessions as well it's a great experience it kind of date you know letting you know like what works what does not work as well and if you do have a great opportunity how many people

have you how many people here have presented yet besides or actually any any security conference or any IT okay great three excellent so I at besides Las Vegas there's a great mentoring program as well if you're either new to the industry or you want to get in the industry or you just basically want to have a mentor to basically look at your work what you present there's a great proving ground it's awesome and it's been a great experience I was a part of that many years ago is they're all awesome experience as a mentor so these are some ingredients even some ingredients the first thing that I always look when I am looking for any

new hires or intern or as well is the passion so there's there's there's basically you can have all the experiences you can come from the best university it doesn't matter um I always look for someone that's a team player that has the passion someone that looks out at the out of the box for example so for example the desire fueled by passion will bring about the greatest results in life that's what I believe you can have you know a lot of times people may ask about those certifications it's it's great to have the extra certifications but experience is also great too but also having the additional skills which I will also talk about more in the next

few slides is very important rather than that so I just want to mention any questions so far about that passionate work we so of course obviously this was the thing that we did 2014 but you know regarding passion keep trying new things doesn't matter if you fail doesn't matter doesn't you can keep trying as many times as I mentioned you know when I was in my first year first time in college you know I didn't really know how to do things but I failed and it's it's kind of like a vulnerable thing but sharing it but I wanted to share with you to let you know that you're not going to be successful the first time

that you do something see obviously easier to do it feel the first time rather than doing it when you know when you're in a higher position as well but keep trying for new things what I mean for that is that if things don't work out or let's say things may not work out in terms of let's say I interview or something like that but it's a great it's a great experience to interview with different companies for example and also at the same time you know push yourself don't settle for anything less you know learn what I always like to say is that learn to fail in order to succeed so you fail you keep you keep don't keep failing but of

course after you fail you you you know what lessons learned and then be successful at it and also what I like to try to say is that as you know there's so many different you know in the industry you know you hear you hear about that there's a huge gap with security information security etc but there's so many people looking especially looking for new jobs or for example there's a lot of opportunities in your age security I believe that especially anyone who's technical doesn't matter they had an official information security job you've dealt with some security challenges security is so huge there are so many different avenues with it so what I urge you to do

is like don't think like other security professionals think outside the box I think you know when when you when you're faced with a problem or an issue think like what what what a red teamer would do what a blue Timur would do what a purple Timur would do but think outside there - that's why I try to inspire you about that and also at the same time when you do something you know what I've learned is that doing that doing the job completely don't just do it just for the you know the just for it to be to complete do it as well so I can talk more about that as well so any any questions on that next thing it has

to do with networking obviously you want to network really well with others what I mean by that is this this was probably a couple of months old slide but you know there's about seven point seven billion people in the world please network with people since you're already here at the higher ground you're already networking with people do more of that I always like to say the three ends network network network because that is actually where your your opportunities your projects your actually other opportunities come out of as well for example let's say there is let's say you're new to information security and you're trying to get information security for the for the first time and you may not have some

projects or some experience one of the things that you can do is kind of to help the community is of course volunteer at the besides besides Las Vegas or any other conference - but also kind of help with different open source projects especially on github anything else as well it's a great experience with that and because in addition to that you actually will get more confidence and more confidence and then after that you might also meet other people that are interested in in hiring you as well so there's many opportunities for that next thing is really just right like I always like to say hallway can't right it's to come the purpose of all these conferences is

pretty much all week on right you can you can go to the different presentations as well but it's all about hallway con right be nice have fun be be be nice how you would want to be treated by others too and also listen and ask questions it's nothing wrong with asking questions don't worry about any questions or a dumb or anything laughs there's no such thing as any any weird weirder dumb questions as well because you rather make the the you rather make the failures or their mistakes now when you're your new rather than later but I can talk about that more too and the next thing is about investing in yourself so for example

only you will know what is the best investment in yourself so for example obviously you have you might be in a team and you have made have either one manager or multiple managers but it's in your best interest to basically invest in yourself what I mean by that is actually you know trying to every year for example any company there's usually a I think like tax deduction purposes $5,250 that you can use toward toward your professional development as well it depends on the company ranges right I just wanted to give you example you can actually use that to go to different conferences different things please use that because if you don't use that you lose it and I think the companies can

are actually the eggs I'm I'm not a lawyer as we're but they can deduct that much money as well so I asked you talk you have to ask to to be able to invest in yourself because sometimes of course the your manager or your managers they will let you know but it's in your best interest to let them know kind of guide them of what things you're interested in and what things you want to do for professional development professional development can be technical does it have to be technical could be something else as like teaching a class or a class of younger students or a class of older students it all depends as well or a

class of students that aren't technical that's probably a great challenge as well and also also at the same time show of hands how many people have had mentors in your in your lives whether it be technical or non tech oh holy agree excellent there's a so mentor you don't have to only have one mentor it really depends on which mentor you want to have so for example let's say you want to pursue something that let's say you want to do like offensive security for example maybe you want to mentor a senior veteran or more of a senior profession that is a you know that has been there and give you comes some kind of lessons

learns about offensive security also at the same time you probably one another more mentors and more mentors you have the better maybe you met probably one a mentor for presentation skills maybe you want a mentor for some communication skills etc is raw so it's it's it's okay to have many mentors most of the time and most people asked how do you get a mentor just ask ya as if they have time if they you know take a look you can take a look at your read different blogs participate of course you know if there are no funds for example for yep for thank you if there's no funds for basic training as well just just do like

webinars as well it's a free free opportunity take a look at many of the different things those of you are going to def con there's different groups as well around around the world around the states teach present as well now I'm gonna go really fast okay so as these are some skills these are some kind of critical critical skills when I'm looking for especially when I'm hiring leadership skills but of course the first one is communication skills all of these things I won't I won't read everything but I really feel that negotiation organization team player and inter interpersonal communication skills are really important as well and then I'm just gonna keep going really fast work-life balance obviously information

security technology in any industry there's a lot of stress mental health please please please please you know try to have a great exercise eat the right foods all of that I'm just gonna talk about that right meditation as well manage stress and and get enough sleep as well so and then pretty much putting it all together I just wanted to mention that you know passion networking with others investing yourself having the work/life balance and also the additional skills like I mentioned communication skills negotiation skills etc is very important so now I wanted to actually entertain questions as well and any specific questions yes yes sir

yep so the question was do you have any advice for someone who's trying to bring information security or hacking into academia so yeah one of the first things that I would say is that there's actually a great and he has a lot of all of his courses are actually all online he does uh you're kind of like a lot of malware malware etc I would say like you can actually use some of that there's been like a a lot of the professionals a teachers faculty they've been trying to kind of like convene to find what is the right fit and obviously it's different because every teaching environment or every college or university is different but I would say

you can use some of those too and don't be afraid to kind of like go to any faculty members who especially a secure security professional to actually ask him or her for the syllabus as well and you know even if you're a new professional going to teach you can actually learn from him or her and actually be kind of like a secondary instructor as well so something like that I would recommend so great question any other questions concerns or anything like that or yes yes sir

so a teenager who is really you know interested in video games all the time and that's kind of like all I do right any suggestions that you might have to sort of bridge that gap from gaming to actually programming whether it's programming games or getting into InfoSec or whatever it is do you have any kind of suggestions that might be something that might kind of help that person kind of gain some interest yeah sure yeah so ya know quick really quickly yes so the question was someone who's into video video games trying to get into information security I would say try to tell them to break the video game yeah as well or you've seen all

those issues with some of these video games right the security privacy issues something goes down there's a lot of depending if it's a you know male or female as well or the different um I would say like there's a lot of these I forget the code for Class C there's a lot of these different programs to that they're doing especially I think yesterday yeah thank you yesterday there was the women in security gala all the top security professionals the top I think the top 30 I forgot and I would say yeah just go to like depending what their age are what their ages are as well bring them to these different conferences well I think there was a

another colleague Jack Menino who brought his uh his uh either his son or daughter the first time he's really really really excited about that more than I think his son or daughter I forgot sorry jack but um but yeah I would say something like that feel the hack kids as well you know like the DEF CON has like the bringing the even younger generation to there's there's so many opportunities to so we read question yep any other questions I have about I think about two minutes or maybe less than two minutes

thank you very much [Applause]