Breaking and Entering

thank you so much a warning a warning to you sir ten years ago Jack Daniels came up to me in Boston and he said hey there's this thing called b-sides oh my god okay and then next thing I know I'm running besides crazy yeah so two things you guys need to know other than besides is one this talk is on breaking and entering into information security into this field in this community it is a call to those of us who are here and a call to those of us who are coming in that's number one number two is I'm wrong I know I'm wrong I'm totally wrong and so this is the most right wrong

you're gonna hear but but when I said things you don't like you can hit me up on Twitter you can talk to me afterwards I would love to hear what I'm missing I'd love to get better at this because we need to get better at getting people in a lot of my background comes from something that I did for about four years I was very proud of that's me in the right and that's a whole bunch of kids we ran a thing called CBI Academy for a consulting firm in Detroit we did it for about four years it was great it was fun there was a two-year program get these people in we had a lot of

applicants like 55 for every one person we hired it so hard to get in and then we trained them up and we do shadowing and we jump in to do things we'd fire jump and a new pen testing in blue team and I are and all sorts of generic little work so a lot of fun and that gave me a good perspective about what it takes to get in the industry today of course meant duo and that's been the right it's it's a little bit different with a lot of lot of senior people in the feel a lot of expert people I get to hear about things from that perspective right and when you get a group of Cecil's

together maybe more me like what's a group of see sociology like birds flock of birds I know that's not in school now that's that's a fish or something that a lot of us get this gift to give in this industry huh no it's it's a snooze of see social engagement wandering is exhausting so this talk is fundamentally aimed at to audiences is aimed at our folks who are in this industry who are at the peak of our careers and it seemed a lot of other folks who are coming in its up with that one who doesn't like avocado toast what is it against avocado juice know whenever I hear people complain about Millennials I can't help but remember

when I was in the 90s and first being started out when I was in the nineties the first game started I was always a youngest man on every team I never got the joke I still don't quite understand 10x I would love to understand it but I think back to what it was like when my generation was coming in and we had a lot of things against us you may say hey Millennials are entitled they're lazy they're unfocused or antisocial and I was saying different work it was 67 of them or the past few years they're fantastic and they're creative but I remember as a gen Xer hearing that we were cynical that were slackers and were

angsty and disrespectful and today I'll say yeah you're right I mean but we have jobs and you go back right the generation before they had their moment they had their moment their time unusual to do you go back one generation later in the greatest generation I just take a moment and look at these people who look at these people staring at their devices not talking to people isolated here's a quote and I love this called kids love luxury these days they're disrespectful they have contempt for authority they love to chat I mean text messaging if you guys know who said this quote yeah very close the answer was Plato the actual answer is Socrates off by one generation sees a

generational Socrates fifth century BCE is complaining about kids these days he was actually complaining about play though the thing is that I would argue that all young generations are screwed up we all are we all are the difference isn't in whether or not we're screwed up this hour how much we're screwed up it's the difference in which way and it's that which way that allows us your orange juice toast now you may be wondering okay that's fine Plato Socrates all these sort of things I'm not here to learn about the history of generations over here to learn about computers so let's bring it down to computers for just a moment we are in this fantastic

industry where our entire job is to sing to the computer that's all we do we sing to the computer we sing in code we same configuration we sing a song that we hope will honor the computer so that my phone will work and I can get up damn lift or other things that may happen and it's so much of our computers today right I mean it's either in the clouds we don't get to touch anymore which is kind of a bummer it's a it's a Mac or it's a Windows box I got my new job and they're like what box do you want and my boss like if you say Windows you're fired a while ago I was looking and it really

surprised me to learn that like Bill Gates and Steve Jobs were born in the same year they're like months apart I mean that's pretty cool that's weird right that's weird why are they so close to major Steve Wozniak a little bit older that's okay these are like the quintessential geeks who define so much of our technology what was happening and the 50s and in you know when they came into the workforce in the early 70s late 60s that allowed them to be so freaking : to find the technology and and who else was around there there's some other cool people there's like rowdy a Pearlman if you don't know her check her out she defined network routing tcp/ip

spanning tree she's from MIT there would be no internet without her there was a Richard Stallman factor 19:53 bill joy pentesters in the room can we all agree Chow is the gift that keeps giving thank you bill joy right Tim berners-lee also did a fantastic thing he invented the web but also pertinent to our conversation in the original web proposal this is a straight line this as a project is bubble blots the way of all the things projects not security no security I'm at that's fantastic thank you first day one saying yeah we're not going to secure it and then we're gonna run Java yes right there hanging out there learning the doing cool stuff 60s come

around we're not good we're gonna skip over that and then they're coming of age in the day where you don't have to use the punch cards anymore the computers actually look like the appears we know monitors keyboards cool stuff they're not big buildings they're not arcane stuff you can touch them and right around that time the word hacker comes into being 1963 1963 first use of the word hacker in an MIT press book ornamenting paper right the tech and I love this because right off the bat hackers are like yeah we messed up the system the phones right right off the bat we're not necessarily the good guys but we're curious we're creative we're doing cool things so you

look you look at the dictionary definition of hacker today of course there's always a picture of a person with a hoodie I won't honor the person with the hoodie I've got my own hacker buddy it's a key from b-side Charlotte's like my favorite buddy but I see the hair to there it's pretty warm I'm sorry besides Charleston but but the definition emphasis mine an expert at programming in solving problems in the beginning is all about programming our song to the computer was in programming is if he couldn't program and it wasn't going to do a thing wasn't gonna do anything and that really defined what started a lot of people off in this career off in this path I'm gonna define

generations this way I'm not using Millennials and baby boomers I think that's gonna be a good touch n0 it sounds more hacker chant 0 those born in the 1950s and wintered the workforce in the 60s and 70s Gen 1 seventies eighties my people my people did a look array however here's not quite long enough the ëthe Orkut and it was a little what was happening when we were joining the internet happened and it was great the way I got in to this industry is not illegal today toaster theaters time didn't it but but it was like hey you look like a hacker I'm like I'm - you are feeling nice - you have long hair can you sing the

computer I can sing the computer and he had a job that was I needed so cute kids these days with your whole college degree no we were walking uphill to ways and getting a job because we look like a hacker 90s and the people that I've been working with the six or seven people that apprenticeship program are coming into this in a very interesting inflection point it's now a career you come out with a degree there's this talent shortage we hear about millions of jobs unfulfilled and then you have a degree you sit there going if there's millions of jobs unfulfilled I'll come have a job right it's frustrating um so these are waves right there's differences and when

I'm talking about gen zero one two and three I'm talking about people around that time who face different and interesting technical challenges and different interesting waves that propel their careers forward these were the waves that propelled their careers forward but back to the computers this is this is the state of our industry this is the state of our community and this is the history and that we're bringing forward in and a lot of the conversations we have do they tend to be around those sort of things wait a minute you don't know how to program you don't know how to rinky why would I need to run cables right it's in the cloud kids he stays it over as a

cloud of someone else's computer like Amazon I actually recently tore down my entire home lab it was beautiful a half a rack I loved it my daughter when she was little did not quite understood what I did I thought she digs we'd have conversations and she died and she'd get really excited it was one time when she had her friends or where she went do you know the Internet and her friends like yeah I do come here my dad has in this room [Music]

the the point is of course that so much of it is changed right and today that title lab is gone is powered off it's on the cloud why it's pennies on the dollar why would you do that this is the state of our industry this is the state of our community - - let's talk about a little bit more about the people bill joy bill joy UNIX VI has anyone decided what the right better is is the VI worst on going

bill joy bill joy right this is Paige from UC Berkeley they'll do I had a ranging thing quote he said he said you know what when I started competing it was awesome because you could program and the punch cards were going away he's like if I had started University two years earlier and had learned a punch card out of an out I would an astrologist an accountant those terrible terrible back in the day right but he had just the right time where he had access to computers he could practice giving homeless crafts he could build a lot of the foundational technologies that we run on and he had to can't you he's like hey I want to be an Internet

and today look like I want to be an Internet find Wi-Fi oh they didn't provision Wi-Fi connect to cellular boom I'm on slow okay bill Joy's like I need to get Internet six months of his life right a tcp/ip driver jeez ouch he is this quote though that I think is pertinent to this section it's called build rose law they'll Jose law no matter who you are most the smartest people work for somebody else I love that I guess able to go out to most of smartest people or somewhere else and it's it's pertinent to building products because you know you got to really know what you're doing in folks on your strengths it's also

very pertinent to hiring because it's very hard to hire because all the smart people are with somebody else and we do this all the time right a million jobs unfulfilled according to CEO so three million jobs unfulfilled occurred is C squared I'm sure there's no conflict of interest and there's there's zero percent unemployment right we hear this all the time all the times drummed into our head this is great there's no you know possibly and it sounds really exciting but in the beginning you guys may have heard that I said Mike Adam II programs I had 55 qualified applicants for it one person hired so what is going on why where is this disconnect okay and 55

people job searching but we have 0% unemployment in many jobs so that's what we'll look at next this is one of my Academy teams this we hired in small teams and about every three to four months we bring him in the team they get together they work on project it was really interesting with doing it some of these folks because those are hard to get in have really went very far Annie over here for the longest time was on my people took the compliance in GRC like a duck out of water and she loved reading Rex and I hate reading rice we need the PCI she's like okay look here it is and she come back and be done I'm like

oh my god you're amazing she has since left the fifth largest credit union in Michigan now has her as their head of compliance a few years and she's a waitress when she joined us you know really stubborn person Chelsea Caleb will also went on to do great things Jake in the end is now a manager in for Detroit casino protecting them and you know they've got money and things that people wanna steal just let me borrow the bag okay I promise so we're like you know 220 people we interviewed to hire this team I don't think we have a town church we say that all the time we have a town charter you can't back down with ten find talent I

would argue we have a hiring problem we have a hiring problem in a big way and it starts with this it starts with going hey you look like a happier let me hire you right we want to hire on the same people who look like us right we want to hire the same people who looked like someone who's already in the role and it's a cognitive bias I'm gonna jump into cognitive biases in a minute bit of a background real quick if you're getting in you're like hey what skills do I need to learn I'm not gonna say you need to know how to program a tcp/ip driver know you need to know things like

cognitive biases how do people think how can we have to keep in mind so much of the problems that we face state security our last mile problems how do we get the people to actually do the thing so hiring back to her a couple different things here one like me bias people are hardwired to like people who look like us or look like someone who's pro on the team hey John is awesome therefore I heard bill who looks like John bill must also be awesome so weird quirk in our human brains how it works performance bias is similar we're hardwired to go hey you look like me you therefore perform better right wait a minute

really I don't know but it doesn't matter because we got a choice support bias which is the managers greatest trick tree striker manager ever did the about every manager you ever worked for that you didn't like he was always sure he is right right choice support bias my choices are fantastic literally bill is good luck John even though bill sucks then what else to do this work no offense bill so how do you handle these biases how do you work around some tips and tricks for getting better people into the industry one is as promoting the job descriptions are terrible right thou shalt have 10 years of experience since the beginning yes for an entry-level job that you will

also be drawing lift on just to make your bills oh by the way I hope you can run to roll your own tcp/ip driver so one thoughtful Job Description I think as we become an industry we're trying to standardize what the jobs are and that's almost like antithetical to hacker this right everyone in this room should not fall into like three different job categories everyone has different backgrounds different skills different aptitudes have things you like different things you know that do the thing you like want the Java scripts to be grated like hey looking for awesome people and you're gonna do the thing you like and what we don't like we will find someone who wants that down the include

job description so one we do better job descriptions too we need better recruiting we recruit all the same pool all the time and it makes sense I mean we got a lot here we got all the people you're hiring they come to these conferences that - this conferences so you're in the right spot if you're looking to get started what about the people can't make these conferences you know what about them how do they get the vibe in so one of the things we did the Academy is we did a lot of recruiting from non-traditional sources pre-screening read resumes blind it's amazing how different the pool of people we interview looks when you run through

a bunch of resumes and with no names no ages honor something and different people who new interviewing we would bring in different people different perspectives some of the Academy teams some of the best people that we had on my Academy team for people that I would I don't hire them and my one of my people are like no but they're really good because of this I'm like I guess I'll take a chance but I don't see it and then there are rockstars and I'm like oh man my church supportive bias isn't working today I know but so bringing different diverse people to interview to get a different perspective so that the likely bias is cancelled out by having a bunch of

different people who look like the rest of the world your job and the last thing is post interviews leaving them good we've got to do a better job leaving them good we would interview people when I say we let me be very clear to be first jobs as a manager I interview people I had this great idea I hope you guys agree with me I thought if I was really mean in the interview then people the strong people would stay right and so I would ask his questions that be like what support iron if he is on that I caught 33 I'm like great how does it transfer the internet power this way okay great so I'm the fourth bit of that

packet and I keep asking questions and so they broke and then that was me okay you lasted about 20 minutes I'll hire you I thought this was a good idea this is a terrible idea stupid I ran into people like five years later and I felt real bad I was at the cottage ever and this guy McKay wouldn't even know who did I talk to you like five years ago absolutely I go to you now it's like I'm an accountant I'm like I'm so sorry what happened he was laughter you interviewed me I realized I really didn't belong to leave them good one of our things that was very proud of what the Academy program is our post

interview process but was 200 people we didn't hire we just go can you suck back we had plucked them into the logo besides we plugged them into the local security meetup community we plugged it into a group called my sec which is a very broad community across Southeast Michigan we pointed them in cyber area another free learning resources we took hey here's how you scale up here's what you're missing here's how to do it and then we invited them back for their use and often times people won't get it the first time but two teams later they would have scaled up and be ready so I think it's so important we leave people in a real good space after we interview

them fundamentally this is talking to to my people again we need to go find the weird but we need to find better weird you know I think there's there's this great thing in order to have the community but bracing the weird people and think about the weird people right only the weed people I know the the people with the Mohawks the people with the flamethrowers the people with the you know cool clothes that look like they just got out of bed and we already conference t-shirt but have like a blazer over top of it you know all those sort of things right those doesn't cool people those are the weird people that we accept and then someone comes in who

doesn't conform to our idea of nonconformity you know like oh we can't deal with you what I think you know diversity inclusion hacker style means going out and finding new weird weird that does not conform with our idea weird weird that does not match where we're at today weird that can shake things up and flip over tables much like gen zero did in the 60s and 70s right so find a weird three okay that's great but what do we need to do so we don't have a town shortage they've already argued we do have a skill shortage we have a major skill shortage and before you're like yeah absolutely we have a skill shortage people that

they don't know how to roll their own tcp/ip drive time again you're right damn them or cream cables Noah comes cables anymore in my day when you wired uphill both ways vampire clamps so we have a skill chart so I'm going to talk in this section about some of the skills these are not technical skills I'm sorry you can tweet at me that I suck its today and besides Charlotte you have lots of opportunity to find out the technical skills network enjoy the sessions know much deeper but I want to return for just a moment if I may to our friend and yours Richard Stallman he this is a picture from his MIT page he recently was what's the

colloquialism invited to add value elsewhere for both MIT and the Free Software Foundation FSM what happened this month if you're interested you can read about it you're not the worry that doesn't matter here's the point the point is as those who knew RMS directly and those who know RMS and Jason Lee go that has a jerk we all know Leo's a jerk but hey he did some cool stuff you wrote knew and he was pushing free software and we wanted to stick it to Microsoft back in the day we all want to stick it to Microsoft he said that the kids nothing but Microsoft's cold they did the Xbox don't you remember Bill Gates the Borg

and they're like who's Bill Gates that philanthropist yes yes but back in the day he was the one sticking it to the man and now he's out and I was gone I would argue there's two reason for those two main shifts one is the shift in the value of skills which I'll cover first and the next the shift in the composition of the workplace we're finding new weird which is fantastic and we're finding new ways of doing things which changes things up you know if you think about this not necessarily in terms of Ages but in terms of waves of technology Jack touched on this is quite a bit right in the beginning it was

fantastic it was isolated technology people born the fifties and sixties entering the workforce faced computers that were predominantly isolated they were not necessary networked there was a lot of work just to get them to talk there's lots of singing going on and not lots of producing by the machines we kept singing to the machines and seeing them eventually it started to be being this weird language that sounded like a robot dying and that's where my people came in the modems I'm so great and we began to have this wave of connected technology right and what changed was the need to know how to get the computers necessary to work but now it became the need to have the computers

talk and communicate and set up stuff in the web and promote stuff that way now of course today everything's free of things cheap people under the workforce all about ubiquitous technology gen one gen one our generation needed a great deal of technical knowledge but we also need enough social knowledge results and that connected and we need to sell the idea of what we're doing to people who were not technical and sometimes it's worked very well sometimes intent one example of this oh my god all right I'm gonna take out sorry you laugh at me I was selling a is sold and was implementing a multi-site VPN in the 90s and this was a day and age where you

actually had to buy separate pieces of hardware to do a VPN like here to be being concentrator here's your IPSec tunnel here's three pieces of Cisco hardware to install with a switch it was a yeah I was whoa what am i doing so we saw this and I'm building it I'm working with my team and we're like halfway through the implementation and I was managing a team this is when I was interviewed and terribly so 14 but I'm making this team and we're in an open area and they're whiteboarding and I'll be there whiteboarding the next set number 28 and then watched the vice-president know as you walked in but it elects the vice-president Anthony

he's watching us looking advancing I get it I get him out and they also turn and stare at me on their quad and I call somebody not make sense and the VP goes did you just say yes he goes didn't we sell like a million dollars worth of Cisco equipment that you've been configuring and doing VPNs on yes and you don't know subletting I'm a team know if you type the numbers in they're the same it seems to work but that was the damage we walked into you could have a little bit of technology and a little bit of people knowledge and make things work and connected tech now as we give the ubiquitous attack the problem that we're

facing today with controls as last mile right the people who are entering the workforce right today are the people who will have to like convince DevOps people that there should be security in their apps will just convince them to switch back minims because the developers don't want to do it because they created DevOps to avoid us security people that was the whole idea of people who you can write code fast you can push the production and break things with no security MFA right let's do MFA I'm a face fantastic it's easy it'll stop this is evil compromise the number one way criminals are making money because ransomware is is it getting harder I saw the thing in the

Wall Street Journal I read The Wall Street Journal please don't judge me I don't actually run nano though so that gives me the point but like 80% of people we don't do Emma things is too hard and too cumbersome a lot of these problems are not technical problems anymore we all know we should patch stuff right now we're know we should patch stuff yeah absolutely do IT guys want a bad stuff no it's all talking to other people now and to doing things and that's gonna wear gen2 is is entering the game and it takes a lot to be good at things and there's always that trade-off right the human mind can only do so much

neuroplasticity is a thing so whatever you're focusing in on is where you tend to get good and back in the day you spend a lot of time with the machines which meant you didn't spend a lot of time with people that was me too my my handle the 90s I don't often times say this but it's pertinent in the story was trance those trance if you find the old BBS well looks not that transfers another guy because because I would spend like 12 hours 24 hours 36 hours staring at the computer programming trying to get my code to run and my friends would walk in and I'd be like sleeping under the desk or they'd be

like waving their hand I look out over the most toad must seem to the regime alright and so they ended up with that handle and that was so many of us we got into this because we had access to the machines and we had free rein and we built technical skills that way which always comes with a cost so what you're focusing on all right so that was me then didn't build D in the center so I'm gonna show you picture I'm very proud of it okay guys ready I'm not gonna show you pictures on kids for one but I'm going to show you this because this is great this is cabling I did pretty we did an entire data center I

was so proud of this cabling and we had like racks and racks of this stuff and I could need like every part in this thing and so today when my generation is interviewing we're like well tell me what a fiber channel card is kids are like cloud and then we get mad right we're like all these and so every you should take like come to you services anyone looked at like the county in that plus certain recently it's ridiculous I was joking about the coax cables but they literally have a section of coax cables why are we doing this to people and it reminds me when I was growing up and people are like so wolf what are you

gonna get a real job that was about 10 years ago as a family member but early in the nineties they were like what you need to like work on cars cuz we I was in Detroit right how do you get a good job you're not a mechanic you know how to work on cars that's where all the jobs are I'm like I don't know how to work on cars I've never changed my own my life do you know you can pay $50 and someone does it for you you sit in your car suite and they do it for you it's phenomenal but it was the same thing right the my parents generation is like way you don't have any tech skills you

can't change it on a car and now we're like you don't have any tech skills you never keep on a data center come on it's a skills problem so support one is the skills that we needed to get here I'm not the skills they need to get there now it's just some real talk to my generation we need to remember that because the skills the moving forward are changing and we need to have those conversations ongoing as my academy grew we would build bigger teams this is a later team photo some great people here it is notice that the team sets will look more like the real world which I like make it as awesome ice told her to do

already gilberto now is one of the lead engineers at a bank jordan back here is she's part of a wisp women and security prodigies that she's a DEFCON ambassador so for anyone who wants to go to DEFCON there's scholarships for four women and she runs that program great group of people who taught me a lot of things about what matters today and one of the things too that we started notice is we got more and more people who look different by doing the things I talked about in terms of funding and weird and this ended up being a trying that we see across the industry right women in InfoSec was like wow there's a woman in the room that was

like the nineties in the odds and now we're about 10% on 2010 around this time I had a team with you go to and I my team 2020 we're on Raw for 24% so part of the workforce is where we're headed and we're pretty close to that so we're witnessing the shift in real time this cultural shift that goes along with these demographics because maybe if you're the only person in the room you don't say think about Stallman maybe if you were a quarter of the workforce the rest of us go what the hell right why are we putting up with this why are we letting our co-workers be treated like this and it's not inconsequential one of my

one of my colleagues at dual presented at blackhat she was at blackhat on some of our hiring practices at do all I think it's called like whoa hiring won't save us or something really good talk find it on YouTube but rather people and then 4chan gets involved and then they douse it with all these terrible comments about women and securing everything now what is going why are we putting up with this you know and I think we're seeing the shift where people just don't need to put up with anymore and shouldn't and so next one is having technical skills no longer excuses bad people skills RMS could get away with that for a long time before like yeah but he's fighting

Microsoft he wrote cool code yeah but he's a terrible human being why would the number that and I think as we move forward we need to hold ourselves in our community to that higher standard that was heavy let's get back to hacking hacker diction definition right emphasis mind it's moving from program to solving problems the guy in the hoodie both problems being more people hacking I love the social engineering I've opted to become social Jerry targets on my badge I love those things those challenges are fantastic so take advantage of what skills do people need that amass all the time a lot of us good people skills self awareness self management being able to have of good

relationships and then the meta skills is really where you it is this is where the money is people no one knows yeah and you have a great career if you're good at study but you will write this is a menace kill the tech is always changing there's this great art called a few years ago the buck dead and dying technology when I wonder what's dead and dying I open it up I'm like oh my god I made my money

yes sorry sorry trigger warning I [ __ ] on the trigger warning that way that me when I was when I was in the early aughts I won this contract to build this web user interface it was pretty cool it's pretty slick at the time today it's like ya young but that deal was we put a web interface in front of everything we had this web interface to get back from the mainframe we had all our Web Apps through it it was basically a launcher and a portal and one and I wasn't contract on a guess but I don't know what I'm doing I had no idea I'd like no idea I was using a text editor and

running the code and I get a server 500 I'm like well that didn't work reading my code or we do it again and so I'm like this I don't feel good about this so I went went to the key stakeholder the project right before you say can we talk those of the doors again what's in your mind wolf I said I don't know what I'm doing and he looked at me for a long moment ago stage do you want to hire me for this project cause I could hire a developer an engineer like you should and right then I should have had that ear for dev ops that I had had it then I would have been a lot of money but I

didn't but you should though those guys would know they're doing I don't like yeah but you know other thing so like what because well you know the team in both good relationships you know how to learn whatever I throw it you can figure out is it I'm not paying you to know I'm paying you to learn and implement I pay you to solve problems and a light bulb went on over my head I'm like great cuz that don't more authentic right I don't have to think that I know what I'm doing when I don't how we're on the same page when yes I'm selling you my ability to study because whenever my so how do you do this how do you move

people forward this is a coaching framework that I thought in my academy program it is blissfully stolen from the first 90 days we talk about people on four different dimensions we coach them about how to manage their perceptions we coach them about how to build relationships with coach them about how to build competencies I think those three areas are the key skills moving forward for this next gen coming into our security and then you bring all this together you do stuff that actually matters all right what are the wins what does your employer care about most the community care about whatever it may be I don't know what that is you got to figure that out yourself you have

relationships for that this breaks down into two different ways you can think about in terms of people skills and technical skills you want the hard and soft skills I always like that what's harder and harder soft skills soft skills but we'll call it that way it's okay all right and it's not like you can't not know the machine right so you guys are still probably wondering what are the rights technical skills to learn that's a talking of itself please enjoy beside Charlotte and get that information out when you find out let me know because that's not what this is about this is about having a good career and this is about moving your ball forward all right for when having a good

career in being a hacker what does that mean what's different between me an accountant and a hacker different than being a clerical worker in a hacker I'd say one of the main things as we break stuff right no Hector ever succeeded by embracing the status quo of accepting things as they are we don't color in the lines and you think about it there's a good reason for that gen zero right 1960s my generation the 1990s counterculture I mean we had nirvana probably doesn't compare it to Jimi Hendrix you can make some area nevermind but you see my point right I mean we grew up sticking it to the man we grew up with that rebel status in our

community and we really need to preserve it so thinking about this in the day of my wife is with me we're at a was it the fishing fishing theater right so we have thinner tickets and she makes sure manthara theater which is good and and we're watching school Iraq which was fantastic musical - great movie the the actor was doing a very good jack black impersonation and the song comes on stick it to the man you know the song you're doing another kid on you know once we sing loud we know it's going to MIT to it but then I can't stick it to the man that I've been you know the world began don't you need to take it to stick it to

the minimum and I stayed in Amman and I was like hey let's take it like what she was hey what she was look around like alright there's a theater there's a bunch of middle aged people to my people to my right out of the suit yes she goes you're the man you damn it so my people my generation right we need to let them stick it to the man how do we make sure that we can continue and being the rebel status when the people don't report to us that's not easy that's not easy you know go go break something go break a rule don't listen to what I say go stick to the banks I'm

the man and honestly you'll be fine right I'm just writing myself for a chair so it's so important that we set up systems so that we can allow our younger folks coming in to stick it to the man because the rebelliousness is such an integral part of our computing of our industry and that rebelliousness is what pushes the envelope forward is what will get us where we need to go the second part of that and including sickening to the man Keys skill breaking rules never likes to break rules here right can't break a couple rules there's an art to breaking rules I actually have rules on breaking rules I will share with you a few

number one break a rule every day it keeps you fresh break something there's something that people are asking you to do that we relation to next what getting that in troubles of muscle you got to exercise that muscle right get yourself into trouble and get out of it with a smile with panache for hackers come on I'll never break a rule which you cannot accept the consequences of breaking this is an important one if you can't afford the speeding ticket don't try 125 miles an hour if I can do it and talk yourself out of that ticket and then let us know because that's an awesome story so be accountable never break a rule where someone else pays

actually had to add this one break every day and then I can't we broke a rule mcawesome would you do yeah we walked out on our restaurant though like you realize that the waitstaff has to pay with their tips for that right oh yeah don't break a rule where someone else has to become a week we need to be gentle in the world and how we go about this and finally my favorite is people tell them when you're gonna break the rule especially good when you got a manager who encourages you to stick it to the man oh by the way I'm breaking their rule we were at at a speaker dinner last night and one of the

organizers of the speaker dinner comes up to me that organizes this event but organizers of the big pipes and she's like here's the rules in this that time should you do this I don't know she goes what I know I'm gonna break one of these okay and then I got a word for at the end of the day so it all worked out all right Jen to entering in has its own we don't have Woodstock right but we've got a tidal wave of things that I think have formed the background of this generation Harry Potter right Hunger Games Marvel movies we've been brought up for the last 20 years in great media I'm breaking the rules the city into the man

as that's what we grow up on is fantastic and so what does that mean for those of you entering in that means surprise you're the hero you're the hero of the story you've got fantastic skills Jack and I don't have any more we're looking at you guys stuff and and as us putting the other teams we need to realize that hey you guys are the heroes right how do we encourage euros how do we build heroes right we're no longer well I don't want to be in the know it actually would be kind of good again man we're Nick Fury in this picture right Jen one my people were Nick Fury we're building two people together we're

starting the movie we're getting the resources I'm getting the hell out of the way as they do awesome stuff and that often times I get to go back and I with Excel I actually do love Excel quick sidenote so I was like I would bury it so if it could make me coffee and like by the end of that meeting I'm like here's how you can have Excel chapter 5 so congratulations younger people coming in you are the hero it's probably what you're feeling like on the inside right now you may be having some impostor syndrome one if you're not the impostor syndrome don't feel like an imposter because you're not telling impostor syndrome that's a little bit circular

right don't do that second thing is we all feel that way and I think I also you've come to home imposter syndrome as a engine light or as a sign that under the right direction right because if I feel that way like I am at the right room you all are better than me and I don't belong here perfect that's to it so first the good news for the heroes in the room we are well compensated which is fantastic the starting salary in the state of 63,000 for information security professionals the median income is 60,000 state after state when I do a similar talk and I pull the numbers it's always this way information security isn't that weird we

start right out of college and we're making more than most people in the state strange to think of strange to think of so that's the good news we're off to a good start we got a good life going on we have some responsibilities with that obviously now the bad news we are effectively elite athletes mentally this is what we do maybe not badly that's how I feel all right yeah think so that's how I wish there's my so my point is this though I point is this I will say work-life balance one time in this talk and to say that I'm not saying work-life balance in this talk in this community in this industry a lot of us

to excel it it it becomes our lives this is what we do we travel like athletes some of us spend way too much time in airports we're constantly training constantly study we're constantly aware that if we slow down that we can fall behind once you fall behind it's very hard to catch back up again it is constant running constant motion and and it's stressful right we need to handle that stress so good rule is embrace de-stress get comfortable being uncomfortable I would start my Academy interviews days and congratulations have you guys watched the 18 I did that for two teams and I realize no one watch the 18 but it really is like that I'm like

I'm gonna give you a paper clip I'm gonna give you a roll of duct tape I'm gonna give you some gunpowder I'm gonna give you half the money you need in a quarter of the time you need and we're gonna do something awesome and some of my team would be like that's great that stresses me out but that's awesome and otherwise my team if you talk to some of the people I'm I can't be like oh my god I don't ever want to work for wolf again like yes but we did it didn't we that's not the point so you gotta become comfortable being uncomfortable you know that there's this this great analogy with trees and bottom to about those two

persons that the big dome that was built that everyone was using to figure out can we get to Mars and they planted a whole bunch of trees right so they all these trees in the dome and the trees keep falling over people history's following where there's nothing going on and start looking at it what ended up being was because there's no wind down the tree because there's no stress in the tree the tree grew no roots and therefore the slightest thing would not get over insecurity we've got to be able to have deep roots and those deep roots are in community and we have to be able to handle the stress that comes with this job

now burnouts real burnouts real don't get me wrong this is how about I was think about burnout I was so good but now I'm burnt and broken and that does happen to people don't get me wrong I'm not downplaying that but I would argue that a better analogy for burnout to something like this which is I feel great and then I'm dead and this segment could be through a day this cycle my personal way is about six weeks first couple weeks up my man I would do anything I'm talk to my boss I will write that white paper and I will give four talks by the way I sent up for for talks in three weeks all different

talks all different slide decks but we're used to this though we're used to so right we're used to running down batteries recharging things and I think this is a good metaphor because there's two different things you need one you need good power management and two you need things that do your recharging so here's some tips for both for power management stress management toolbox have a toolbox have a way of planning your schedule that includes things that will preserve your sanity because you will need it food to sleep obviously I love my massages that's one of my favorite ones I'd a massage right before coming out here because again at the moment so I had this massage that's

about my masseuse and she's like what did you do to your back how much you don't want to know how many talks us I know four you are crazy Midland I know they get like an extra half-hour so massage is taking time off right we need to take our time I don't know why this industry is like we don't take our time off ha I am man I do not need rest again have you have you did your self reason you know there is like a world outside this data center so taking the kitchens so there's having planned points throughout your week throughout your month to bounce and recharge and then on what charges you up right could be

sports could be exercise I'm loving the gym that always turns me on could be music I love getting off planes with the mi you know Mission Impossible theme song going on no one knows it they're like what is this weird guy doing power walking he is not Tom Cruise I am Tom Cruise I am ready Walker it off I hit the lift I do my meetings life is good hacker conference is another one I always whenever I'm at these conferences always come back with a whole bunch of ideas not much of excitement so know what charges you up and plan those things out within your week so that you got a variety of different things that are

pushing you forward and preserving your energy that's how to handle the stress but it's also important to know to handle the stop right short term stress awesome focuses you makes you more creative gives you ideas allows you to do the impossible long term stress terrible takes away your creativity takes away your ability to sing to the Machine so know the difference there are indicator lights for this I'll give you some of my favorite ones and some advice on what to do physiological effects we can't sleep if you're getting weight all sort of things maybe do some the balanced active as I mentioned earlier or gtfo gtfo will be a recurring thing about not competitive compensation why the

heck would we take non-competitive conversation don't do it folks come to it in of any industry that should have equal compensation for people regardless of gender or ethnicity it shouldn't be ours I mean we're the ones who sing to the Machine you can sink the machine if we sink the machine equal you should be paid equally if not we need to GTFO lack of training athletes for not training we're not maintaining we're gonna fall behind so big-time talk to your boss career path if there's not one level up get out or gtfo poor teamwork is another one there's all sorts of ways it can be better teammates I think we should but at the end of the day the human being is

a fantastic pack animal we are a great caveman seeing the Machine and as a pack animal the caveman our strength has always been each other right the people in the room that bring down the woolly mammoth in the data center I think that now just got weird but you know what I'm saying so if the team sucks get out if your leadership sucks get it out nothing defines your experience of the company more or less than its leader section one the reasons why I left many jobs if they don't appreciate you or recognize you maybe you've got expectations set wrong maybe to understand your job or maybe they don't understand what you're doing so try and fix that if not gtfo misaligned

values and culture I don't know how to go and do this one if you're sitting there going how man if you slimy what I do my job gtfo right we are the average of the people that we and we're the average of the things we do and if we're not in a good spot we need to get out and don't tape over these lights either I think because there's such a lack of talent in the perception of lack of talent right now by hanging out what any of these things are wrong we're actually not only hurting ourselves or hurting our industry because we're teaching companies that they can treat us a certain way and get away with it to get

out they stay in close ok I can lower my salary and whatever values I can those are things so reading the situations it's not right don't tip over the indicator lights gtfo now more about GT FL quitting compete scoping when it frees you up to excel something fits you that is awesome I'm not encouraging able to coisa quit the job though you need to know is this short term stress or long term stress long term stressors absolutely do something about short term stressors don't quit over look back to some of the things I was talking about stress relief because short term stressors will come and go well I'll have a bad quarter Oh a bad couple of months there was a time a

couple years ago where every single windows coming home to my wife I'm like I made it I just need to make it to the next week she goes do you know how long you've been saying that so don't tell me six eight week project and we crushed it and then we moved on knowing when to stay in when to go is really what ultimately will help us become those elite athletes those elite mental athletes that we need to be alright in conclusion I still got time right now I kind of do it kind of time I would tell you the story about how I got into ITT this is my first computer that I own

thank you it was a beautiful machine and I sang to it it booted right into basic which meant anything I want to do it a program and did not have the ideal sprites yet so I would take an ASCII map and do all my animations by be messing around the pasty maps but fun and this this was maybe when I was like 9 or 10 and I want to be hacker right so as I became a teenager I got on the DSS I want to be a hacker what do you do to you know prove yourself as a hacker I'd watched wargames and sneakers and watch Tron I assume there's something to do with the

lifecycle and everything find out how to be happy with the lights but it won't be like you need to you need to be route horse's head and so so a few years ago by I end up being at a hospital we're kind of Hospital about 17 I got in this basically like in the support staff role my girlfriend was there so I figured I worked there too thought their passions people to follow your passions and I was spending a lot of time with the nurses because teenage boy and we were we were at the time building a network it was very modern with Windows 3x net we're 3 1 2 and it didn't actually have cat cables so at

least we had Ethernet it was good and it was hard he kept breaking we and I would help out as I could and we finally we finally got online the nurse was in charge that project she quit she was out she's done she didn't want to be and I teach you what I mean healthcare she's done so Director of Nursing calls me down to her office and she was so incredible when she's five foot two in her 50s Texas woman who everyone was terrified of she was awesome so I'm I'm in her office I'm sure I'm getting in trouble she looked at me and she goes I've been watching you know Mikey I'm in trouble

you job to run RIT I'm like this is awesome and I said I said I remember very clearly I said I have one condition and you guys know that time when you say something you really want to get back okay because the room temperature fell 10 degrees folks there was a tin whistle and tumbleweed in the background and I was sure I was gonna get shot so when I was on these BBS's BBS culture was a whole other thing and you would often time to get in and ask things and they tell you that you're stupid and you keep asking into the gun answer let me change your name cuz now you're the smart guy oh those

things and so I'd be like alright how do I get room sysadmin there I can either rubbish it in the trash that sounds gross is there a better way well you can call people and what I did I would get the passwords you only talk to them like verbally that's fun and they write code to exploit all of those I'm a yes I can sing to the Machine and they're like what are you talking about - a 90 is no.1 - singing the Machine yeah so I'm in the room and the Director of Nursing is staring at me I'm staring at her she's staring at me and after a very long pregnant pause she goes what is

your condition and I said I need to have Road sysadmin she looked at me she goes deal about give you two dollars an hour or more but you're on I loved her like trash I'd ask for it and that was how I started my career is a blue TV fender right at a hospital protecting things I want to ask you guys today can you imagine any Hospital in America that would hire a 17 year old kid just out of high school and say sure have recess admin health records are over there kids these days and my debut just showed up we don't even need calories a lot of people my generation oncology is you know why because we showed up they

went you know how to sing more like we do you've got a job it was great I'm sorry but that's how I got in that's what I say it's no longer legal because the way I got in and the way a lot of our generation got in doesn't quite work anymore another definition of hacking I like is hacking is understanding the system better than it understands itself and nudging into do what you want the system was IT right back in the day or the telephone system you want to go back to the 60s it was IT it was in isolation but today IT is the backbone of everything the backbone of our government the backbone of is everything

about our government I got discouraged the big government of our businesses of our life its backbone of everything and what that means is our system is this really interesting closed loop between the technology and the people and so moving forward we can't just limit ourselves to happy equipment we have to nudge both people and the machine so key points to my generation and those before me who are currently the employers and the man unfortunately we need to open new roles for InfoSec we need to go beyond what looks like us what's come before we need to find those people bring them in we need to use our positions are very fortunate position we this really cool

weird bubble that suddenly computers are perdón people know how to do it and we got jobs we need to use those positions we got from there to protect those who are coming in and drive things forward we just share more than technical skills we need to share life skills and how to build a career over the longer term because every tech skill we have is dead or dying and I don't necessarily mean me and I mean every skill we all have is that are dying that's the beauty of technology and changes every few years and we need to build the people coming up as the heroes they are we need to be the Nick Fury we want to see in the

world all right to the avocados in the room don't be a jerk just because they're not enough econo people come on fine new weird find people not like you don't let hacking become just a job this is this really weird thing that we all do that we hang on conferences and we hang on bars when you're departing to travel preserve that preserve that as long as we can this is a limited-time bubble and I don't know how I'm gonna run run it hard to run a bomb remember that systems are social and tactical we need to hack both and for God's sakes people flip over some tables [Music]

we are reaching reaching in six years of have you dated from that first mention that I might teach six years of hacking right I want to hit it hard I want to hit it with things that we haven't seen before so we have someone you do to amplify so we need to create I want to hit the six-year anniversary with the degree of humility and curiosity I want to hit that degree with cooperation I want to hit it hard preserving a rebel status and preserving our ability to sing to the machines I want to continue breaking some rules but I want to see us build some people and that's it thank you much guys