Soldier To Cyber by Phill Kimpton

so good afternoon ladies and gentlemen my name is Phil Pendelton and this talk is titled soldier to cyber which is about my experience of leaving the army and making starts at pentester without any previous experience whatsoever I originally gave this talk last year to servicemen and women looking to leave the Armed Forces but when the opportunity came to present it besides today I realized that I can tailor it slightly so it was applicable to everyone so over the next 30 minutes I'm going to be talking about things such as free training resources that are available developing yourself the plan support groups and communities however I think just get to where I am today through these things alone so I'm going

to be talking about things such as creating an opportunity for yourself and how opportunity doesn't just come knocking at your door and you have to go find it I'm going to be talking about failure and why we should not be scared of it and more importantly I'm going to be talking about the damaging impact of negative thoughts and how they can hinder your success so whilst this talk is geared towards newcomers looking to make a start in industry I believe that there's something for everyone to take home today what I'd all like you to take home however most importantly is almost anything can be achieved with just three things and that's determination persistence and passion so my twitter

bio will tell you that I'm a skydiver a pen tester and a closet nerd and all them things are true but there is a bit more to me than that you'll see and that's the reason I've stood here today three of those things are I absolutely love my job I love how versatile it is I love how you keep on learning and two weeks ago I was getting paid to legally break into buildings which I just think is great I also am passionate about development and that's not just my own development but watching other people grow too and then finally I do get a kick I'll admit out of helping people so I'm here to share my

experiences we are today hoping that you can learn from them and hopefully not make the same mistakes that I did I started as a pen tester in September 2016 and as I've already touched on I had no previous experience whatsoever since then I've had explained experience in external infrastructure testing web app testing social engineering fishing engagements and I've also just recently started on internal testing however I'd like to stress that I am NOT a subject matter expert on any one of these disciplines by any means necessary well the reason I share this with you is because again two years ago I had no experience and it is literally a case of if I can do it then any of you come to

so how exactly did I get into pen testing well it was actually a bit of a mistake sort of accident once I left the army in January 2015 I thought she started working in the offshore oil and gas industry as a radio operator and I'll admit I was attracted by two things and that was the three weeks on three weeks off rotation I'd work three weeks on and then I go home and have three weeks completely off but get paid for it so I was working six months a year and then the next one was the salary and that was the big mistake I based my career choice on financial gain and not actually what truly

motivated me at the job itself their company I work for were great the people I work with were fantastic and some of whom I still keep in touch with to this day but it was the job itself that didn't motivate me it didn't challenge me and most importantly yeah didn't feel that I had a purpose after three months of this job I started to get bored but ignored it after six months I started to change in personality start to lose motivation but again I ignored that because who is supposed to really enjoy the job anyway I don't know that many people who do so you know I kept paying the bills paying my way and I ignored and

unfortunately this all came crashing down after about twelve months when I was diagnosed with depression and I can assure you now that I'm not the person who stood in front to you today and you know it was really if that's what it did to me in one year I couldn't go on for the rest of that thirty years of my working life left and others and I have no Helene chance that I was going to carry on that way so I had to have a think about what I wanted to do with my life and I got thinking back to when I was a child when we're child when were children we don't base our career

choices on how much we get paid it's what it's a lot more simple the built on what we love and what we dream about and I believe that children think big because they've not yet experienced the suppressing power of negative thoughts I'll admit I didn't follow what I wanted I didn't chase what I want to do my childhood dream sorry much handled career I wanted to be a Ghostbuster but okay whilst that may be totally unrealistic I can show you now that if the will start to get taken over by ghosts in two years time I'll be giving a talk on how to become a Ghostbuster instead so going back to negative thoughts here's what I believe from my

experience that impact that they have and that is it's highly likely that negative thoughts are the primary factor in preventing us from become it for being the person that we want to become I'm often contacted by people looking to make a start in the career some of whom have a lot of experience in IT for example network administrators malware analysts sock analysts and all these people have a wealth of experience and something to bring to the party and he still managed to doubt the cells and they absolutely absolutely have something to offer but then again if you're here today unlike myself you have no prior experience but you're passionate about it then I encourage you

to follow your passion I'm not trying to be stood side-by-side working with people who are passionate that people who just aren't that bothered and that's in any job with negative thoughts I experienced just then when the opportunity came to present at B sighs today when I first saw the advertisement on Twitter I thought about it for five minutes and then I put it off my talk won't get submitted anyway excuse me I'm about to start uni yeah you know it doesn't matter what I've - I won't have enough time so I put off the talk and I didn't submit it when I did submit it on the 29th of September 2017 I remember that day so well because it was the day

of my wedding and I've not yet admitted to my wife that my premarital preparation included submitting a talk for B sides no doubt she's now going to find out but I found it interesting that I put it off I doubted myself however the day were you feeling positive and just absolutely great I didn't think about it and I submitted the talk and commit to it and cutting all the excuses away if I'm totally honest with myself what I was scared of was failure and I've failed more times than I can remember in my army career the picture just here and I failed my first attempt of the parachute selection course and on the second time around I went in and I

passed it I was no fitter I just approached it with a different mentality and that was just to grit my teeth and keep going until until I passed or passed out unconscious so yeah I just managed to grin and bear it and made it my first attempt at OS CP last year I failed I listen to everyone else most people don't pass first time just go and see how it is and I approached it again with a defeatist attitude and needless to say I failed but two or three days later resubmitted my exam date and I think it was a month six weeks and I approached it with a better attitude and that was to pass and I

passed so it's a ball approaching things with a right attitude because this is truly what I believe failure is I know all what I found out in the last few months really to fail is the first attempt in learning and you do sometimes have to fail to succeed and you must embrace the lessons that failure has to teach you and this is a appointment on this slide now is what Thomas end on the next slide is what Thomas Edison the American Invents who created the light bulb had to say I've not failed I've just found 10,000 ways that don't work and whilst were honored the talk fairly I'll read a book recently as well as

creating his presentation and two points really struck me and it's books titled Think and Grow Rich by Napoleon Hill here's what Napoleon Hill had to say if you think you're beaten you are and if you dare not you don't so if you dare not do something for one year because of the fear of failure then that's a shame however if you dare not do something for five years then that's a tragedy so how do we start to succeed I've managed to narrow it down to two major points number one get rid of you excuse or you blame list and I'm guilty of this you know and it's only a say in the past six months have I understood the importance

of getting rid of Li blameless and having the maturity to look within yourself and accept responsibility some of these excuses are in fact I'll probably use dollar than many a times more times than I can remember but the top two but one of my favorites and I hear a lot from people number one I don't have time I often hear this one from people they say they don't have time yeah they have time to thumb the way through Facebook all day or they have time to watch the latest box sets back-to-back or watch the salt so I'm not going to I'm not going to put on your how to spend your time that's completely down to you it's again just

about having us self-assessment and realize they do you procrastinate could you spend your time somewhere back to work on your own personal development and just be honest with yourself the next one I can't afford it is another difficult one I'm not here to preach anyone how to deal with their finances but again I can't afford it is an exclusion often use by people who've managed to go out every weekend on the lash or they have the latest iPhone or the nicest car and yet they claim they can't afford to work on the personal development so I'm not preaching to you guys but again just have a think about what what is and if you can make any

improvements or Corrections in your ways when you lose your excuses that's when you'll start to find your results now the next one is surrounding yourself with like-minded people and it's no coincidence that successful business men and women surround themselves with other successful business men or women and the reason is is because they all feed off one another's creativity and ideas and because of it they come even more successful or athletes those mere mortals don't understand the training regime on a diet regime that they have to go through and they all support one another and I call these your mastermind groups and amazing things happen when people with a common interest or passion come together which I'm sure you can all

relate to unfortunately for us we've got it in abundance in the hacking community we've got for example Manchester grey house who do a meet up a once every month and they have a slack channel I'm a member of the slack Channel I've not met yet but I do intend to so you've got these local groups it can all meet up with and have these meetups with so please try and involve yourself or people gay immerse yourself with like-minded people you've also got friends and I'm talking to close friends here whose opinion and Bide guidance you truly value the ones who may not necessarily say the thing that you want to hear and maybe the harsh truth and if you have the maturity

to accept what they're saying and realize that it's what they're saying is impartial and it's because they care about you then you'll have a lot to learn from them and again that soil getting rid of the old blameless and you've also got Mentors some of you may have university lecturers you may have people colleagues at work whose whose ethics you value you aspire to be mentors could come in all shapes and sizes so one of mine couple years ago appeared to me in the form of my local postman and Andy and I you know we still keep in touch now he we go for a run every now and again I think we're going for a run this weekend as well but when

he first came to the door delivering a parcel yeah we were pleasant to one another hmm and then within the next four weeks he somehow managed to socially engineer his way into my house alive drinking brews together and put in the world to rights what could you imagine what I'd have missed out the opportunity if I just saw him as a postman and just left it at that I mean this guy has a wealth of knowledge and experience and you know some interesting things to say ensure our loans of have learned and still continue to learn a lot from him so just listen to what people have to say people who you don't may not

necessarily know you just open your mind turn it to solid if search however you have all the positive thinking in the world and you can get rid of your blame list and you will still not get anywhere what you need to do as well is you need to start developing your plan which is why I'm suppose you're here today so this slide if I can explain it excuse me it's not just a pretty sight slider made out to fill fill out the presentation I actually stick to this plan I have short-term goals medium-term goals and long-term goals not two years two to five and five years plus and I break them goals down with this first of

all at the top where you are now now relating it back to where I was I was in the offshore oil and gas industry life was pretty rubbish and I didn't want to be there and then yeah so I have to figure out where you want to be and at this point I didn't know so I had to have a thing what did I enjoy doing well show my age now because when I was between eight to ten I was playing on the eager 500 yeah and I was doing oh yeah okay I'm going I got rid of it actually but yeah yeah I'll do a little program playing some games and then naturally between the ages of 14 to 16

as many teenage boys do they play a lot of counter-strike however after the age of 16 apart from some what saw typical end-user interaction Microsoft Office for example or browsing the internet or Napster I had no way I had no expiry I lost touch with IT that was until that you know this time when I needed to figure out what I wanted to do I was at my friend ashes house and whilst he had his map book open the other window open which was running Windows 7 and I was thinking I was like what the hell are you doing you know what is this magic and I didn't know what virtualization was and that was only December 2015

so he tried to explain and I went home intrigued went onto YouTube to find out what virtualization was and that's when I fell down the rabbit hole of YouTube I like I came out some three months later having an idea about pen testing and something called Kali Linux and it looked cool good so and that's when the penny dropped and that initial sort of bit of fascination about what a virtual machine was turned turned into sort of a determinant idea that I wanted to become a pen tester so I knew where it was now and I also now knew where I wanted to be and once you've got that you're able to set your goals so for me it was pretty

easy I had no experience and I had to start from the complete beginning so everyone here heard of cyber your IT it's awesome isn't it yeah so that for those of you haven't cyber EIT is a learning resource on the internet which is completely free of charge so you can check out most of the major certificates and you can learn for free in fact the only thing it does cost you is a little bit of your time but if you can sacrifice a bit of eastenders for a bit of education that's not all that bad and next you've got YouTube now acai berry' here's just a quick screenshot it was four weeks ago so I apologize if it's

changed the lay-up since but you can see here what I've highlighted and these aren't all the courses but I started off with CompTIA A+ and that's where I was I had to learn about hardware configuration pulling laptops and desktops to pieces learning about virtualization networking basic security basics etc and then moved on to network plus watched a few the videos security Plus and I was in a bit of a rush to start getting on with Kali Linux so I learn a bit come to your Linux plus and that's how I started but I started it's all completely free YouTube's got a wealth of resources a one channel that I really recommend is a guy called Dale and that's his Twitter

handle orys it's the same name for his YouTube channel so this guy starts from there completely from again the bottom and his work to all levels so if you are even add myself now as a pen tester I'll still check out his videos and I'm amazed by what he has to share but if you want to start off from the beginning he breaks it all down for you so you start to educate yourself and it's now start time to start putting your hacking skills to practice I've blogged about this so that's at the top if you forget these three borrow a bit more information about it and again I didn't know how to make a website granted it's

a WordPress one but again I just YouTube it so I'll learn how to create my own website so I have no clue before that and you can teach yourself these things we've got phone the home on the Left which is it hosts a bunch of virtual machines which you can download a very difficulty easy medium or hard and they're created vulnerable so you basically happen you've got pen tester lab which is web app testing and then you've got hack the box which is a bit more light and infrastructure sort of thing and these what I wish I knew is again before I did my or CPA exam I wish I were knew about these three resources because after

passing the exam and once I started going onto these I realized that a lot of these exercises are quite similar to osep the osep exercise is not the exam so if you if you before committing or if you want to go down that route of osep this is these are all perfect ways to get into it for completely free and get that sort of level of training and get your skills up now they are free but pen tester lab and hack the Box do have subscribed services as well you can subscribe to them pen tester labs 15 pounds a month if you'd like to work on your web app testing it's great absolute fantastic for me and

no clue where that testing some may say are still dumb that's a not too sure but yeah it starts completely from the ground and works and works up and that's 15 pound hack in the box is 10 pounds so I subscribe to these 25 pounds a month and is that subscription worth it absolutely you know it's less than a round when you're out we're your mates so that's how I sort of compare things now one mistake I did make and again probably showing my age when I started taking notes I was taking on a notepad and pen we're not pirate pen I needless to say now they're notes that when it was first started learning I don't have

them I can't recall so really important to use a note-taker it doesn't matter what one you use so long as you get yourself into the good practice of taking you know to writing everything down because I assure you that even if you do start off at the very bottom you will need you'll call upon your notes again or something now the next slide the importance ease of networking and this could actually be a presentation on itself I've managed to fit it into a one-minute slide but I can't and I can't emphasize the importance of networking and the very fact that you're all here today so it shows that you do understand that because you're creating the

opportunity to meet other people but the important the networking is so it's so important and I found my first job after establishing a relationship with a fantastic recruiter who originally when I first met her in April 2016 I had no qualifications you know we met when you build that relationship and you get to see each other face to face or people may be able to figure out that you serious but I had no qualifications and sure enough she said when you get these qualifications get back in touch so a few months later gained some qualifications and I got back in touch and I'm not going to embarrass oh she's in here today but did actually get me my first job in

infancy now if I hadn't gone to this original conference then I may not be still here today I talked about no SCP so I'm going to bring up certification just a little touch I'm not going to try Ram certificates down anyone's throat and I can appreciate that a lot of talented men and women in this industry don't have a certificate to the name and they're lucky but also I'm going to say this on certification if it's the only thing between you getting us get an employment or not then I'd say it's a totally worthwhile investment so going back to the plan cycle you got where you are now we knew where we want to be and

we set our goals however you can all have you can have all the best intentions in the world and you can educate yourself and you know have all that positive thinking but if you fail to take action that in five years time you're going to be where you are exactly now so please you need to take action and it's as simple as that but something amazing happens when you take action as you take action before you realize it you start approaching where you actually want to be and then where you want to be then becomes where you are now and then again you figure out the next way you want to be set your goals and it

becomes a continuing cycle of personal development I started this two years ago and it's just been fantastic so exciting that I've never stopped and I don't think I ever will so it's summary ladies and gentlemen if you have a desire to join this industry then make your move start to develop your own plan and establish your own goals and put them into action for any you may you may have questions I'm going to be around I can appreciate I'll just about it 27 minutes and someone's on shortly so for any of you may have questions I'm going to be around just after this of for a couple of hours so please come and say hello and last week and we can have a

chat ladies and gentlemen I feel Kimpton thank you for your time [Applause]