Uh Oh, How Did I Get Here? by Gerard Barrett

everyone um yeah so my talk is oh how did I get here uh I'm one of these people who is a a career changer into the industry um and thought you know what it can be done uh people are coming in sort of talk a little bit about it and a bit more um a bit more on uh who am I I'm sure just part of me as Joe and it's it's an easier way to go I am a former Insurance front investigator that was my my life before moving into cyber security um since then I've been a soccer analyst and I've been a sock engineer and an mssp and at the moment I am a cyber

security engineer for a national gas and transmission which is essentially a split between national grid for the electricity and gas they're being split by off gym so they needed people into to kind of build things through for for national gas so that's my day-to-day life now I'm also a Committee Member for the hack Thursday um events in Glasgow for cyber security that have recently started uh I'm a UK chapter lead for cert Global um which is succeed from the logo as part of activity which is the Dutch Institute for vulnerability disclosure really cool people if you uh haven't come across them definitely worth looking up and I hope we're on a discouraged Community server um for ctfs in cinema

I've put in the Committee Member for hack Thursday Choice very keen on that one um I do have a bit of a good addiction for conferences and helping out I'm helping out tomorrow's hope so say hi if you see me and I'm also quite a keen Runner um and that will generally end up in the conversation if you talk to me at any point in time um so when we're talking about kind of the journey that I've had for moving from insurance to infosec um the insurance kind of fraud stuff isn't always about crash for cash and as you can see in the right hand image and which is what a lot of people think of

when they think of insurance frauds a lot of what I am's actually dealing with has parallels with cyber security because what I dealt with a lot with was identity theft and serious organized crime groups who would pretend to be someone so someone would take an insurance policy pretending to be Rosie but they'd have not Rosie's car and no one Rosie knows as the second driver on it who would then pretend that oh Rosie said it's fine for us for me to sort out the insurance through her go talk to her if you want to ask any questions if someone's been pulled over at the side of the roads and some of these groups as well use the insurance policies to

um stop the cars from being pulled over while they were committing other crimes running drugs burgling houses and trafficking people as well it's you don't think about it when in the terms of insurance being something that that actually comes through on and but that was actually my life for for quite a while I did that for nearly eight years and investigating through um my journey to cyber security um kind of started while I was doing the fraud work not quite in the galaxy far far away um I am based in Glasgow um so I actually found this guy about two months from my house uh well known to a lot of people in the industry

um and we made friends found on Twitter and started talking about things to do with victim support and because I was dealing with a lot of victims with the insurance fraud for the identity theft so I started to look a little further into different help support networks for people which are always really important and I take through because there's such parallels between the insurance people have been affected by Insurance frauds as well as the people who've been affected um by you know scams and fishing and so they tell you over Brew was something was was being run but settled on the police and Durham Police where they talked about telling two people so if you hear about a scam you tell two

people you hope that they tell two people and eventually that kind of Cascades through the entirety of the UK I'm I'm being able to keep people aware of you know this thing is weird you've seen a few tweets Lately from from some fairly well-known people in the industry saying hey I failed for this you should know about it we're not all invulnerable to it and but the advice as well kind of goes through for the take five when we give the people if you see something in that's looking to be urgent you take five these people who are you know looking at it going that's a really odd request why would we possibly um reply to that or you know building

that up soon always advice that we'll give from a social security point of view is just take five take your time it comes with all the problem of solving you do as well just take a couple of minutes don't panic and just have everything about it um I wanted to experiment with something um I've got a slide opal um where you think I may have uh ended up in the cyber security industry after meeting Mr Scott McGrady and as to how it ended up working through so I'll give it a minute or so if people can have a rescan it's a safe QR code I swear um hopefully it'll work through for you and just stop and have a little fun with

it and hopefully it'll update itself press gang after drinking kind of curious as to who's gone through and and voted through on that got two people

okay

quite curious as they no one trust me enough to be that oh someone has trusted me enough to be that a man who hacks and nobody thinks you're going to the industry For Love or Money no

I feel like I'm impacting my own pool results for just talking through the different titles foreign

after drinking a man who I'm a man who hacks uh love no money they're not winning that one at all um so to kind of talk through the through for them you know how did I actually end up through um I didn't quite end up in the industry through love uh end up in Scotland through love follow my new wife to be who want to be a school teacher about 15 years ago um and then that kind of progressed on where I ran out of money um and then ended up doing the the work in insurance so I started off in customer services for them moved in admineral and from there I moved into kind of when

I was looking at the admin stuff they they had a brokerage that did the company had set up that it was working for um and I went in there and I started to find a lot of Frozen documents things that didn't look quite right um and as a result I caught the notice of the fraud manager um who asked me said hey we've got a job going do you want to apply for it um and go through because you've been making so many referrals to ourselves um so when done from went on and started to do that for just under eight years um but yeah that was definitely the driving force for me I my first pay came

in when I got the insurance job I didn't get about 50 Quid left in my bank account so it was the insurance side of things that actually pushed me through uh onto it and I can honestly say I am definitely not a man who hacks and it wasn't something I really came across until just before I went into the cyber security I just was was ignorant of the terms that were being used I would have always thought of you know people who are hackers who are committing crimes no people who are committing crimes or criminals it's not that the hackers can be good people and that's when you have our whites and our our Grays and our

blacks um I was press going to see what people can give themselves a big part in the back uh I was pressed against after a heavy net out uh people might recognize that the Gathering of people you'll meet some of them tomorrow as well um during the pandemic the beer farmer started up the infosec happy hour um and because I knew Scott I got invited along and they were just wanting to gather as many people as possible um and then I got to know people who were in the industry and started to kind of chat from there um and as I kind of learned more you know yourselves role here today at a at a conference and so I started looking at

conferences and thinking about you maybe attending um but for me my first proper interaction with a conference was a text message going hey did you fancy helping out and thus started the addiction to Googling um so I helped out in September 2020 uh got a text message going hey can you can you help out um I was planning on the conference anyway in the end I ended up modern slack and having a look through um and just helping out in the background where I could at BC to Newcastle which helped out with for a couple years really good people it's on in September again so please join in um from besides Newcastle and I ended up

being a speaker and going at beer con too and so that was they run by the beer farmers who were wanting it aimed at rookies and so price of the rookie got to speak can help out at it and start talking about the connections and parallels between Insurance frauds and cyber security and but that was a real kind of baptism of fire in going hey you know helping out um but I highly recommend anyone doing it um it's always good to ask for help and ask to be if you can leave any help as well and I finished like that first year in 2020 going to Conant and which was a primary focus around the open source intelligence

talks and taking part in their own CTF as well which kind of brings me on to another area that people always talk about you know trying to get into the industry talking about careers um and people saying hey just start looking around and poking around at these um so when we talk about ctfs there's loads of them back there and there's one that started a couple of minutes ago hopefully people are watching this not too distracted by the CTF just yet I'm kind of hoping to get on it in the car on the way down uh after the talk um but the first CTF I ever did was actually with Trace Labs which if people

haven't heard about it is um related to open source intelligence and searching for missing people um as shows the interest quite small we actually I ended up in a team with three other three South Africans and we came sixth out of 100 and something teams um in my first effort for having to communicate with them through using Discord and going through I did make an attempt at half the Box um but at the time their sign up register required about 20 Pages worth of notes and getting in so that was a bit uh something that I wasn't quite able to to manage that time in my career because I was just starting out with no

cyber security experience so when we've done to try Acme which I love as a you know as a method to to go through and start to learn and it kind of came during the time around when they do their Advent of cyber every year um so I thought right I convinced a couple of friends to say hey give us a gold try out me we'll help you we'll be out there we'll be grand so what I ended up doing was certainly with these two lines and we got Leonard in the center and uh Scott as you've seen already that picture was only taken last week and three of us are met for the very first

time in three years uh allowing each other um and uh we ended up creating a Discord server in order to facilitate me basically being able to reach out to you like hey help please I'm stuck I've had to go but can you please come and give me a hand on on stock here um so that's how we we started it we started running a CTF server we called adorably persistent team I need to be careful because you generally refer to this apt which is going to cause a few concerns when we're in public and people are uh listening in to us having conversations uh so three of us have been running that the last three years

just started now purely as a hey let's give this a go and give a venue a location for people to be able to actually go and have a have a chat and work through CTF challenges so you tend to take part in all the trace Labs stuff that goes on as well as a few other bits and pieces and that's really helped kind of meet people and talk to people and use your conferences and ctfs connected to conferences or they're out so outside ones and I can be really good and interesting um way to kind of talk and meet people who are in different jobs as well some of them will be hiring managers some of

them won't but they might hear something that's going um so it's definitely worth going through I lists rooms I've completed one try Acme on my CV um I've listed the trace lab stuff it's of interest for people uh speaking of people uh people who've helped me and who really do like to help um others get into the industry when they're starting out their careers in support of the beer Farmers uh have to be said because they did the infose a copier they ran that during the pandemic they didn't they do the beer contacts uh conferences and they had the rights of the rookie for beer con too they've done them every year since as well and they'd

had one prior to that in beer con one um so it's definitely something um that they're very keen on supporting they've been very supportive for me as well uh from from there with the beer con too they provided us with mentors uh someone in particular for me was David Dave McKenzie and who was working for an mssp at the time um and he was my mentor for my talk I'm almost quite supportive helping out listen to my talk and in the end I actually got an interview for the company he was working for as a sock analyst um and that stemmed from kicking around the conferences going to these things ctfs and things like that and was quite

supportive um on worked out in my favor and someone else who's really good and you'll see them tomorrow um he'll be making his way up for early doors so providing with all the team coffee he's Arthur and because he will be will be coming through is James boort um who spent some time with myself and somebody else who were in between jobs at the time talk about threat modeling um and I was just like went to show that there's so much Community out there and people want to help each other up and it was it was quite good um and there was ctg Intelligence as well who are run by Pelham uh reach out that one's awesome

um and they had me along into panels just to talk about the experience so far um with regard to kind of stepping into the industry uh pelton's good people so definitely reach out and say hi and not sure if they're going to be a ring tomorrow or not but certainly worth a reach out on Twitter or whatnot certs it's one of these things that a lot of people will argue over um where you know people should have started going in for jobs or they should get them when you go in uh for me well I wasn't quite assertive it was something that I was nudged towards doing before I started out um with the guard to uh plural sites so

not a certs but what I did was what I'd been nudged towards by David was to do the kql course that they were providing kql is what the query language of Microsoft uses um so if you want to be a soccer analyst and you're going to you think the company you're going to be using kikiwill consider this a hawk for it go and do the kql course that's on plural site and it doesn't take that long it'll give you a good step up if you've got experience with SQL before you might feel it runs backwards to that um but it'll be it'll work out for you we've got the Microsoft certifications as well um which you'll do I've done a couple of

those they are quite tricky um but you will get there and throwing them there some of them are quite quite interesting to to go through and certainly help from a career change of point of view help put the basics in that you wouldn't necessarily have had but come people in comparison to people who come in with degrees and things like that um you've also got the comp Tia ones as well a lot of people like to do those um not talking anything myself so we can't really comment on them but a lot of people put up a lot of faith in them and and you can't talk with asserts in cyber security but they're talking about

uicp um offensive security or more blue team um but it's certainly something that people are always looking out for and when it comes to certifications and things like that real means they're expensive get an employer to pay for it maybe see about that um and pushing on from there um the theme to my talk um which I hope I've managed to do over the last couple of slides has been to show that I've had a hand up um to help and it's always important to be able to put the handout to help others as well um people will help because we want things to work out for each other and you know it's not about it's not about

closing the door on on people um we do talk about there being a skill shortage um and I suppose that is it's an argument that happens a lot but I'm not really sure it's so much a skill shortage um in the industry as something that's a Time shortage for people that you don't have the people who have the skills that you need to hire but at the time when a company's tend to be able to try and hire someone it tends to be at a point where they need someone to come in and hit the ground running um you know companies in the end of the day need to turn a profit they need to

be able to have someone who can come in and be productive in their shorter space system as possible which then leads to a skill shortage because people haven't been given the time to train up and I've been lucky I started the cyber security industry with a company who said hey you're a nice person we can teach you the rest those opportunities seem to be fairly rare but if you get the chance to come across one of them where you hear that someone's talking about it grab that with with both hands and because it's certainly the the way forward that you want and somewhere that has the time to be able to train people in and

you know is as far as you putting foreign for each other no cyber security has a really bad reputation for people keeping people holding the door closed on others stopping them getting through you get it sometimes where people have been new to the industry and they feel threatened aimed by those who are that may know more about the ins and outs I'm trying to hold trying to hold them back to try and go away we need to but we need the door to be kept open for people we need to be able to have that open door to allow people in like people myself come in move from insurance into sock analysts you think free how do the how

does that work out but actually it worked out quite well it was the same investigation techniques just on a different topic and which then can be taught to people so people from outside the industry will have plenty to uh to add in um this is question times I don't know if people have any questions for me and you can have to be appreciate tonight I will have stickers to that apt nice logo um I have a few of those kicking around on me so I'll have those so if you want one give us a shout and I'll be one of the staff as well please say hi uh drop my Twitter handle and Linkedin as well

um and these are the names of the people if you want to take a screen grab uh who helped me along my way and are really good people good humans reject them say hi and ask questions ask questions of me it's people have helped me through in my uh in my journey more than happy to help put others through on theirs