Inside the Outsider

great so um no I didn't really volunteer I opened my email a few weeks ago and I was told that I was going to be the um what do you need got it by this guy that I was going to be the um keynot speaker and um I actually thought it was a joke I sent him a uh I just shot back a real quick email and I was like you are joking right and um as evidenced by the fact that I'm in front of you today and no he wasn't wasn't joking but he is right I um am incredibly incredibly nervous um it is my first uh solo speaking gig in about 15 years usually I'm hiding behind that

guy over there and so in order to help me there some of you in the audience will get this actually get a wardrobe change um figured it would give me like I don't know I can't even do it do it do it no no no no no no see I've already lost my place in my notes because of that okay so I hate microphones just bottom line is I absolutely hate them I could probably do this talk if you'd all like scoot really close and I just stood in front of you like like it was back in school but um when I when I realized that Josh wasn't joking I really really struggled with whether or not I should

accept the offer um I knew that he had uh considered me because of a mini rant that I had subjected him in him and Janice to a couple months ago and because of that um I didn't know what the hell I was going to talk about when I got up here I um you know it was really tough the stuff I talked to them about was kind of cresting over some lines and I didn't I wasn't sure what I was going to do so I made a list because lists are good and um the First Column of this list was things I like to talk about and this was pretty easy right because they end up being comfortable

things I like to talk about my kids I um like to talk about good books and um I like to talk about food specifically I like to talk about chocolate like my favorite thing in the world and occasionally I can talk about myself right so um when I came to making part two of that list which is things that I don't like to talk about that got a little bit harder um in general the topics were easy enough to come up with but you know again it's things you don't like to talk about and they're largely uncomfortable things so I surprised myself because the very first thing I put down was me um as much as I like to

talk about things I've done experiences I've had and you know tell you funny stories about my kids I'm very very rarely really talk about who I am and what I'm feeling and what I'm experiencing so real quick just let's just get that one out of the way um I'm a mom I've got three boys they're ages 17 13 and five I'm checking and um that means I will have one going into college next year one entering high school and one entering kindergarten so that's a little whole lot of crazy in our lives I am as said the lead organizer well I don't even know if you said it but I am the lead organizer of

shukan yeah you did okay whatever um shukan is this little conference in DC um we've held it every year for 12 years now um it's a lot of fun 12th anniversary I have no flipping idea J I think it's our 12th year okay um which makes it our 11th anniversary or 13th I don't even know I know I did math wrong um so those two areas of my life running shukan and being a mom are um really the only two areas of my life that I consider myself an expert in and it's not because I'm really good at either of them it's just I've put in thousands and thousands of hours doing exactly those two things um the last thing I'm going

to tell you right now is um see I've already missed my slides these stupid red lines aren't working sorry the last thing I'm going to tell you is that um I consider myself geek by proxy and not by practice I long ago gave up any kind of um technical training technical path and um has only been surrounded by it almost every day of my life for the last 20 years in part due to being married um to Bruce but who yeah yeah let's go with who all right my desk is not not not large enough so um I literally just lost my page I'm sorry so on paper um that list I just gave you that I'm a mom that I'm the

lead organizer of shukan and that I have absolutely no techn technical expertise doesn't really look like I have a lot to offer you on paper um and that's exactly what I felt when they asked me to give to give this talk I I didn't really know why they were asking me like why me and why does anything I have to say um why would that be important and Bruce kind of laughed at me I'm going to talk about him a lot because 20 years but he kind of laughed at me and pointed out that I was having a pretty good episode of something that's called impostor syndrome now um imposter syndrome is not as commonly thought the fear that people

are going to like figure out you're not as smart as you're pretending to be um it's kind of a byproduct if you will it's a bit of a fuzzy line but more accurately it's um the inability to recognize one's own uh expertise one's own accomplishments one's own abilities and um I guess in other words it's just a bunch of self-doubt right so it's something we've all felt at one point probably multiple points in our lives and um the greatest example that I have of this is that it took me years to say out loud that I wrench mukan I would dance around that subject like it was nobody's business I would say things like well I help run the con or um I do

most of the logistics and fact of the matter is um I own the business I do all the finances I make all the major decisions and doesn't matter that I pull in a bunch of opinions I talk to a bunch of people that make those decisions when it comes down to it I'm reliable I mean I'm reli am reliable but I'm responsible more to the point for all and anything related to the con God I hope I'm reliable um some I'm here aren't I so um and and I should take just a second because as Josh was saying this morning um it's not that Shan a one person show it isn't it all it takes an

army of people to put on an event like this and certainly to put on shukan and I wouldn't want want to and can't do it without those folks but it's in part due to those people that today I can easily say that I wrench mukan but here's another recent example um of impostor syndrome when i uh first started to tell people that I was going to give this talk um you know some folks were really cool they were like you know you're going to do great I know you're really nervous this is going to be awesome just go get them Heidi and those people they're now my best friends if they weren't already but they are

totally my best friends but other folks were um maybe a little more hesitant they're like well that's cool or it was kind of like this you know read between the lines sort of impression that I was getting that like well why would they pick you and the reality of the situation is they may or may not have meant that right but my own insecurities were coming into play and again I was stuck in a position where I didn't know what I had to offer any of you so real quick because I feel like I owe you just a little bit more um I have a prettyy pretty geeky past uh my first computer was a um timx

Sinclair I remember setting it up at one of my birthday parties and all these kids coming over and they had no idea what it was I wrote my first program on that computer yes it was Hello World U my father was the uh technology coordinator for our school district and I remember going with him to teacher in services and teaching my teachers literally how to turn on the Apple computer that's singular that we would bring us from school to school to show teachers what was coming in near years now about 10 years later my dad was installing like the IBM Lab at the high school or something so it went pretty fast during that time period right um I

was on the internet really early in um I can't remember now 6 7th 8ighth grade I had an account at the university the local University and I was writing the um back be Man pages for the University and I pretty much never left the internet after that I um went to school in Alaska met Bruce up at univiversity of alas Fairbanks I studied math like him I did not get my degree and uh we both went to work at Alaska's largest ISP so I worked at intern Alaska I worked front desk customer service I worked in marketing and um when I left I was actually the lead of the customer care Department um so then we moved to

Virginia I quit working and I took this huge long break from anything related to to Tech except for the fact that um during this time the Smo group had been created and um we uh that was still kind of bubbling around and they were having their Heyday going to Defcon I should go back a second and say that I beat all of them I went to DEFCON 5 while I was pregnant with my first child not an experience I would recommend but um I was just kind of on the you know the the edges of that I the group was kind of this thing they had this name for themselves and I was sitting at home

with my kids reading all the emails as they went by when we moved to Maryland that's when the idea of shukan came about and I kind of just went okay yeah I'm in so um for the first 3 years I wasn't in charge but I was at the top level and I eventually took over running the conference and the rest is pretty um recent history so I've told you all of that and it you know it's pretty much my resume for why I'm here today I should also tell you that I've never once in my life considered myself a hacker um but it should be telling that one of my high school or high school and Elementary School and Middle

School nicknames was brain um yeah that's a good one so I can look at all those things I just told told you and I can force myself to rationally understand that it provides me sort of knowledge and the basis for the rest of what I'm going to tell you today but I still have a hard time accepting it right I still feel like I'm sort of on the edge of what all of you guys are doing despite the fact that I've been here for so long and longer than most of you in this room so so it's impostor syndrome right I am I'm struggled with it all the time and here's the things that I do to help me

with that um I first of all and I'm going to totally sound like a mom when I say these things but that's because I am um remember that you're not perfect uh everyone fails at one point multiple points all the time in their lives um recognize it's important to recognize what you don't know um it is also important to embrace the knowledge that you do have and work to increase that knowledge and frankly calling out what you're feeling just calling it what it is saying I'm feeling like I don't know anything or I you know this is impostor syndrome whatever um that really helps too so I pretty much just went through that exercise in front of you and I'm

still nervous as hell right so you know it it works and it doesn't work but um we see a lot of this in the infosec industry and it probably it actually kind of leads into my next topic because it won't shouldn't surprise you that the phrase imposter syndrome are actually that used the um phrase impostor I think phenomena was coined in 19 in a study in 1978 about women in accomplished women they studied about 150 women and all of them felt this way to one extent or another um so I'm zooming past my uh my slide Marks here gender is a huge topic um there's a lot here that I don't want to talk about

and I don't even really feel qualified to talk about except that um as a woman I have some pretty strong feelings about a few things but they probably aren't what you think they are and first of all you hear all the time how we how we need more women in stem and in particular I can't tell you how often I see statements like we need women in stem fields to break the stereotype that's like thanks Captain Obvious you're helpful so here's my stick need is a really funny word I there's not many things in life we truly need if you go back to that list I the very first list I shared with you about things I like to

talk about food food is something I need right but of course we want more women in stem um as a group of course women offer a really unique perspective and diversity of any kind is usually a good thing and there are there are large numbers of studies being done um or that have been done and are being done that um tell us why we have this deficit of women in this field and we know that um we know that many of those reasons are um institutional they're generational they're cultural and that we need to address those in order to uh get more women in this field but going back to the original statement we need

more women in stem so all the stats that I looked at were on the technological side of stem if you don't get a degree in stem or aren't fulfilling a technical role you're not in stem and I think but for by from fighting so hard to point out all these important rules you're really kind of overlooking the contributions that are already there um folks like uh recruiter sales marketing graphic artists and you know even a slowly conference organizers um and as a demonstration of this we've had an enormous well enormous okay we've had like six but that's a lot of submissions to the shukan cfp from people in like recruiting and marketing and other sort

of support departments talking about industry Trends and and good business practices and you know maybe they fit our program maybe they don't but is that information useful absolutely that information is useful and I get it I mean I get that if you graduate with a degree in marketing you're not going to show up as a tick mark in a survey about stem graduates but by the time you're entrenched in a stem based company hopefully working for a greater good surely that should count as a tick mark some survey about stem careers and that's sort of my point and in the end this really trans transcends gender I mean I've put these silly slides up here

playing on the word support women but really take out the word women and put in people right my entire career which is not really a career but my entire working life has been in small business started out in Internet Alaska um my involvement in Fort Knox that's no OCS not the other one um bruus company Ponch and of course shukan and I can tell you that in those environments um many people wear many many different hats and it's just really important not to overlook contributions that are um Technical and not technical so inclusiveness is a really really big thing um so one way in this community that we uh try to um promote inclusiveness is through codes of

conduct okay this shouldn't be unfamiliar codes of conduct are a pretty common thing they exist at schools and workplaces and over the last um number of years the growing thing has been that they uh are being put in place at conferences and large Gatherings okay so to clarify this isn't a new idea it's been around for a long time but it's been at the Forefront of a lot of discussions around infosec and conferences like this um and mostly that's because of issues sadly involving women but the policies are there they're really there to Pro um protect everyone not just specific spefic gender or specific lifestyle basically codes of conduct are a um an anti-harassment statement encompassing

encourage and discouraged behavior and they should have a good reporting mechanism outlined you know who to contact who to call what you can do um they serve a purpose it's true and I'm not at all saying that they're bad but it probably isn't a surprise that I don't I'm not really behind the movement as a whole um I'm what I'm frustrated with is the cookie cutter cut paste attitude that a lot of conferences have had to just in reaction to this it was pretty easy you know when this called action came to play to uh just go to Ada initiative site they're now defunct but go to the website go to the code of conduct section kind of look them over

pick one that fit you change a few words and be done so I'm also frustrated with the fact that some of these policies that get developed are so overzealous and the attitudes that accompany them actually start to infringe on the rights of um free and public speech and I get that a conference isn't really you know a public space it's not the quad on campus where everybody can go protest but there's a need to also protect the rights of the speaker right so a big part of the rationale behind putting these codes of conduct into place was that there's this claim that Simply Having the policy will prevent harassment and I'm just going to sit

here and tell you that I'm not sure we have a whole lot of proof of that but I will concede and absolutely agree that having a policy in place really does help those who are looking to know that they have support from the organization um that's an absolute truth and and codes of conduct really do put a lot of responsibility on the con organizer or the con the organization behind the conference and and I'm not at all Shing that responsibility I I work very hard at shukan to make sure that our staff is trained we're doing more and more each year we're also working to um actually train our attendee to work with us to

make sure that we are providing an atmosphere that's welcoming and and open to everybody but I claim it's more than a two-way street it's it takes all of us it's sort of a that thing called the um like a roundabout for my traffic analogy here takes all of us working together to create an environment again that isn't marginalizing or overtly hostile while maintaining um open disclosure CU uncomfortable conversations do need to happen and again I claim that we all need to work together to change our culture and exper expectations sorry as a community so let's talk about the community um we see this word thrown around a lot on Twitter and Facebook I mean this is our

our community our hacker Community our infoset community um and you see this sort of stretch between industry community and then sometimes you see the word family I don't like the word family here's how I choose to look at it a family is part of a community and the community is a function of this IND right so by definition avoiding anything that mentions Bloodlines um a family is a group of people United by certain convictions a community is a body of persons persons of common and especially professional interests scattered throughout a larger society and an industry is a group of businesses that provide a um that provide a particular product or service so industry is driven by money

it's driven by capitalism and it's going to make decisions that are in the best interest interest of that industry right family is a more closed group right it's a closed group that um where of like-minded people where often like blood is thicker than water at least that's what it's supposed to be and neither of those models in my opinion represents what needs to happen in order to make infosec a better place community on the other hand I think bridges that Gap um it allows us to be free and individual thinkers and innovators um with the ability to learn and share information without needing to fit in in some kind of abstract way um and this

isn't to disparage those who use that word right I've got lots of friends who use the word family and I'm not purposely calling any one person or group out because this isn't a personal thing um I'm fully aware that this is a semantic argument and I'm tending towards being pedantic and I'm just going to admit that right now and we all have our chosen family there are people in this room that are part of my chosen family there are people in this room I have to call family um maybe that was by choice too though um I just think that for many of us the word family has a strong meaning and in an industry where

folks are often already socially challenged and disadvantaged um it's pretty easy to feel like you're not a part of this elusive family we should absolutely continue to focus on building a community where inclusiveness matters and where again ideas and free exchange of information is encouraged and the bottom line again is use whatever word you want right just be aware that though your word choices may or may not have the same meaning to the people who are hearing them and therefore they may have the opposite effect that you're intending so this is not a Star Trek reference but those of you who uh know me well knew I'd get one in here somehow um but I

thought while we were talking about family we would certainly talk about the Next Generation this one's going to be pretty short I um especially here I think that we all celebrate the Next Generation right we're at a university there's lots of kids in the room there's students here and I think that's fantastic so this is going to be a little bit preaching to the choir but more often than not I run across um comments that say they call they call out the noobs or they call out the tourists or they call out the wannabes and this is followed by this idea that these people have nothing to contribute um because they haven't walked the line they haven't learned

things the hard way and you know of course they haven't um the hard problems that our students today are facing are not the problems we faced 10 years ago they're not the problems we faced 20 or 30 years ago they're learning differently in part because of all the work that we have done to put these programs in place to put on conferences like this to set up the better um curriculum in the schools so that they can be smarter and and have better access to to um the uh the education that they need to be successful in this in this industry um and there's no reason for this to be like a fraternity or sorority

where you have to do go through the same initiation to be part of this club and it's a little silly maybe even to say this out loud I'll just back up a second but part a big part of life is Paving the um path for what comes behind us right so motivation changes as we get older I see it all the time I experience it myself life happens kids happen Health happens whatever so that next generation is really important um so if you're guilty of any of those comments that I said earlier calling out the noobs calling them wannabes um I'm going to tell you just to stop and instead try and adapt this attitude that I just saw

on Twitter and I'm going to totally it's Adam Ellie or Eli and he said I often follow infos noobs their curiosity will often teach us something new all right big jump to personal security I have long subscribed to the Bruce Potter theory of privacy is dead so I asked him to Define this in like two bullet points and he said in order to meaningfully participate in today's society you have to give up what we conventionally think of as privacy and that this trend will only continue as we get more connected so yeah privacy is dead and that being said The Potters are pretty private people all right but what about Facebook Heidi because I'm on

Facebook all the time and it's a great way to procrastinate just about everything in your life including writing this talk um but here's my pretty much singular point about this topic there's a difference between accepting known risk versus jumping into something without knowing the risk at all right um I had a Facebook account for years and didn't use it at all and it wasn't until um we went on the epic cross country bike Journey with JP there in the back that I started checking into Facebook a lot because I found that it was a really really easy way for me to get information about what was happening back home and it was also a really easy

way for me to push information out about our trip so yeah I'm on Facebook every day and yes I Ed my real birthday and if you remember that list at the top I really like chocolate but um for The Potters it's all about balance right so we try to be active in managing whatever information we have out there that's either private or um public while accepting whatever risk it is that we need to in order to accomplish our goals and you know again sometimes that goal is as silly as telling you the words of wisdom that my 5-year-old has uttered at 3:00 in the morning but it's what gets me through my day so now that I've talked about all the

things that I didn't really want to talk about I realized that um almost everything I've said today has had some kind of caveat I've said things like well I don't want to offend you or I'm not saying that this is bad and that might come across as defensive or trying to soften the blow and it's not it's just a reminder that everyone has opinions to offer and that listening to all sides is a key component to progress right so for much of what I've talked about it's not even that I'm right or that I'm wrong it's that I've tried to start a discussion and my hope is that everything I've said here today promotes further discussion if you're going to be

a part of this community these things are going to come into play okay I'm going to leave you with one last silly little momism okay life isn't about being the best it's about being your best and being your best includes being open to ideas and suggestions and always always learning that's it point that too