BSides Glasgow 2018 - Phill Kimpton - Soldier to Cyber

okay good morning everyone my name is Phil Kimpton this talk is titled soldier to cyber and it's about my experience of leaving the Armed Forces and making a start in the IT security industry as a pentester without any previous experience whatsoever thank you and I originally gave this talk in January at besides leads and it was my first ever talk so I've slept slightly apprehensive but I was more to upper-hand Civ because the fact that whilst the talk was about twelve newcomers about the free training resources they're available there was another aspect to the talk which is about the human side and the emotional side so slightly nervous because I didn't know how well it would be

received however after the talk or when it was put on YouTube it seemed to be well received in a fact that I was getting emails of thanks from people in the States Canada New Zealand and they felt inspired so I was actually I was really humbled by that so it appears that people like to talk about the human side as well and that's why I'm here today so yes this talk is to for anyone looking to make a start in the industry but I'm sure that there's something for everyone to take home however if you'd only to take home only one thing out of this talk today I'd just like you to take home that almost anything could be

achieved with just three things and that's determination persistence and passion so I'll be discussing topics such as negative thoughts from what I've experienced how to kick-start your own personal success and these are things that I've only figured out for myself in the past six months and then I'll be talking about personal development creating a plan setting goals and the free training resources that are available so Who am I then well I'm a security consultant at ECSC and there's me my work attire but I feel that there's something I must clear before we continue and I'm often asked by people and I'm sorry to disappoint you but I've never worked with Neal Buchanan

but sweat if I will tell you that I'm a skydiver a pen tester and a closet nerd and what I stole them things is true there's three main reasons I'm studying from to you all today I love my job I'm just a completely passionate about l of our versatility is and how I keep on learning I'm also passionate about personal development and that's not just my own but watching other people grow and the third reason I just get a kick out of helping people and since starting in September 2016 I've had experience in external infrastructure testing webapp internal infrastructure phishing and social engineering but I'm more stressed that I'm not by any means a subject-matter expert of any one of

these disciplines but if you ask me what tend to favor what my strengths are I'd say it's definitely social engineering and it just seems a bit more natural to me just we just come off a job actually up in Aberdeen we were successful and I've had I've had success in all jobs it's so much so on one last year it was to come off the street and see what you could do in if you could infiltrate and I built such a rapport with one of the guys from the University that we were testing that after three days he actually gave me a gift for my five year old fictitious son and I saw realized I

was going to hell at that point but how did I get into pentesting well it was actually the fortunate results over what was at the time unfortunate circumstances I left the Army in January 2015 and the only starts of pentester in September 2016 and in the interim I worked in the offshore oil and gas industry and I was attracted by just two things and that was the three weeks on three weeks off rotation and all sort of salary and that was my mistake the three weeks that I was on I wished my life away and the three weeks that I was off I dreaded going back so I was never actually in the moment enjoying my life

I what started to happen will you know based on your career choice on financial gain and not what truly motivates you is the issue here what started to happen after three months I was already bored of this job after six months started losing motivation and out she started to change my personality changed and I always said to my wife I said if you came in in disguise I don't think you would recognize me I just wasn't really a nice person to be around and then after twelve months I Otzi was diagnosed with depression and I truly believe from this that it was because of the job and it didn't give me a purpose and if that's what it did

after twelve months there was no way that I was going to continue my work in life around thirty years the rest of my work in life in that way and it got me thinking his children we don't base make our career choices based on how much we get paid our choices are built on what we love and what we dream about children think big because they've not yet experienced the negative the suppressant power of negative thoughts now admittedly I didn't pursue my childhood dream about what I wanted to do I always wanted to be a Ghostbuster but going back to the negative thoughts from my own personal experience I believe that negative thoughts are the primary factor

in hindering our own success and we put ourselves down constantly now who here in your normal situation who here would eat the supple anyone no ok these are half just a normal situation boy yeah so we won't feed our body this rotten apple yet we feed our mind with it K in thoughts on a constant basis and we do all experience negative thoughts ensure you can never get rid of them but it's about what I found from my experience it's about controlling them and just net not letting them take over your mindset except in them and controlling them a negative thoughts take over that moment we wake up and I call them negative thought catalyst we as soon as we wake

up we've got negative thought catalysts right in our face and the start for example a media or the tabloid we wake up and we turn the telly on straightaway and we've got the media you know listening to part rapes murders corporate scandals and it's constant and it's hardly ever positive news and I first became aware of the power of the media and how it can affect our thoughts in this some of the 2000-2012 the Olympics and what happened was I recognized there was no there's no negative reporting in the media at this time whilst we were hosting the Olympics and I actually noticed the conscious change in people and that they seemed to be more positive so myself personally

and this might sound a little crazy I've caught all current affairs out in my life and it's funny lights are don't miss it all the real important stuff has its way of coming to you you know someone else will talk to you about a menu and then you'll find a little bit more but I don't feel that any loss for pointing out my life at all in fact isn't benefit next you've got your family friends or colleagues I'm sure enough yeah it's hard it's difficult if you've got negative family members it's difficult but again just accepting it and realizing it so you know moving on controlling it friends and colleagues can be a little bit different and it's

it's a lot distancing yourself from negative people and I consider fact that if we were sat in a room together as non-smokers we won't put ourselves through the health risks of smoke inhalation yet when someone's being negative you know which is not to be rude we sit around and we take in we get the impact of the mental sort of health effects so it's again just excusing yourself and move yourself away from that situation if someone's negative you can't do anything about that you know I'm sure you can try and make them positive but if they're not receiving and they don't want to be positive pull yourself away and then finally you've got social media which is

a double-edged sword unlike most things it is beneficial when used in moderation however it becomes an issue and I totally believe in freedom of speech absolutely 100% but that doesn't necessarily mean that I have to listen to the person so if someone's got a certain point of view that doesn't work with me I don't get bent out of shape about it and you know if it's constantly I don't know just people straight away but if you know is if it's a person who I just know I won't jell with and they're negative Donald Trump for example I blocked him now I was fed up with seeing the tweets of Donald Trump just constant so yeah blocked moved on and in my past

a negative thought that really held me back and one I've noticed in this industry excuse me is the fear of failure and I've failed more times than I can remember in my army career I failed my first attempt at a parachute selection and on the second time when I repeated it I was no fitter I just approached it with a different mindset and that was to pass and I just Hong Kong Hong gone in there until I passed and likewise with the osep the first attempt I failed I went into the exam listening to what everyone else had to say saying that you all pass first time not many people do just go in and

get a taste for it see how it feels so I went in with a defeat is that with the attitude just to get a taster into field see how it feels however on the second attempt again I wasn't I didn't I didn't really do much difference or make any many changes to my education in preparation for ICP but on the second time I just went in with a mindset that I'm going to pass this I'm going to give it my best shot and I passed because really what failure is it's the first attempt in learning and we all have to fail to succeed what people just don't talk about the failures you know you only heard here up

people's successes so we're all inclined to think you know we're embarrassed of failure and that's the wrong attitude to have I believe you know you must embrace the lessons that can be learned from failure and it's important that you use your past there's a school to learn from don't use it as a back to beat yourself up with now Thomas Edison the American Invents who invented the light bulb had at this to say or failure as I've not failed I've just found found 10,000 ways that don't work so it's about picking yourself up and try it again and not giving up and earlier this year I was reading a book by Napoleon Hill it's titled thinking Think and Grow Rich and

he had two really interesting points and that's a if you think you're beaten you are and if you dare not you don't so if you dare not do something for one year then that's a shame you've lost a year of your life if you do you delay you don't go for a course or an exam because you fear of failure and that's it that's a year gone and that's a shame however if you dare not do something for five years because of the feeling of failure then that's a tragedy let fear be a counselor and not you jailer so how do we start to succeed I've narrowed it down to three main points a number one is to get rid

of your excuse or you blame list the top two of my favorite I don't have time I can't afford it now I don't have time excus often used by people who had time to watch the latest Netflix box set back to back or they can watch EastEnders then Coronation Street and a bit of Emmerdale as well so they claim that they don't have time when realistically if they're honest with itself they're just not investing the time wisely so just assess your own and see see how your how you spending your time if you procrastinating and spending too much time on the phone thumbing through Facebook another one I can't afford it and I appreciate people of different

financial situations but I can't afford it is an excuse commonly used by people who have the latest iPhone latest carpet hire purchase the nice is closed they can afford all these things yet they can't afford 15 pounds on a udemy course to invest in their own education and again it's just working out your priorities so definitely number one is to get rid of your Blayne list number two surrounding yourself with like-minded people and it's no coincidence that successful businessmen and women surround themselves with other successful business men and women and he thrived for each of his ideas or you've got athletes those mere mortals don't understand their training regime what they have to go through the diet regime

and all their disciplines so they support one another and I call these your mastermind groups and I'm sure you're all aware and you've felt this in the past that amazing things happen when people with a common interest come together just you know the light start switching on great ideas happen you've also got your mentors it might be someone who professionally you look up to saw my good values and standards could be someone outside of work a mentor approached me in a fully disguise of my local postman at the time and you know he delivered his letter we got chatting and then some some weeks later he's managed to social engineer his way into my house so we're having a brew and

you know we're putting the world's to rights over and two-three years on now I still keep in touch with a DS it's about thirty years my senior we got rolling together no only we just you know have a chat and I learned so much from undhiyo there's a lot to take from people but could you imagine what I'd have missed out on if I just saw him as a postman and chat with our engaged with it so engage with people and if they strike something with you just listen to them and then finally we've got friends whose opinion and guidance you truly value the ones you can say whatever they want and get away with it

so their advice might be impartial and you know I've got some quite honest friends and I asked him a question I asked a couple of family members as well some different people I asked them give me three of my strengths and three of my weaknesses and I wasn't interested in the strengths but I was just a bit of a disguised question and what I've also found out is if you try less people don't like the word weakness so if you go in to ask someone ask them free work on point what three points I could work on and something funny happened they they all gave pretty much the same answers so they all can't be wrong so

it's definitely gave me some punks that I needed to work on my own personality my own behavior okay so moving on so last point to start success is to start making small changes in your life and if you keep doing what you've always done you'll keep getting what you've always got and simply put that means if you want to change then you have to change and it's about a small changes in discipline that make eventually become big changes they may initially seem insignificant but if you can imagine if you just change the view on a ship and you change your direction of course by one degree over five hundred miles you'll be in a completely

different completely different destination so that small change your initial change actually it's the big things and here's just some examples what I can find which are considered small getting up 15 minutes earlier if you're always late then just get all better little bit earlier introducing a small amount of exercise into your life and again I'm sure it's the same and most of us in this game once I've got my teeth into something I can't let go of your arms but stuck it out laptop so I get my exercising in the morning and then I'm good ready to go for the day and I can concentrate on my job and it's all about these introducing these small changes

reduce your calorie intake by small amounts so if you realize you're me in you know if you drinking make a full fat ohh change it for diet coke you know and even that small change just make these my slight adjustments and they will start to make the changes read in books not everyone's thing we've got audiobooks my last job I used to drive an hour each way Communion and I just used to belt it there get as fast as I could and never listen to audiobooks until recently and I've just now feel like I've done myself Oh a massive injustice by not listening to audiobooks and educate myself whilst on the drive and then finally is keeping the promises

that you make and the person that we let down the most with our promises is actually ourselves you know we get these ideas in our heads and we honor them so it's about start honoring your own promises that you make to yourself now you can apply all these things and have all the positive thinking in the world but what you do need to start working on is your personal development and the late Jim Rohn said work harder on yourself than you do any job and I never fully well I've really just actually got this recently and what that doesn't mean is yeah you know you'll be at work on Monday chilling out and yeah sorry Phil

said work harder on myself than a deal my job but what it does mean is do a good job and always do a job honestly but when you get home work on yourself and when you work on yourself you become a more valuable employee anyway and previous put a couple years ago I was a bit like a stream I taught the of least resistance but it's rare that anything worthwhile is ever gained from little or no effort and that's the honest truth so you just got to work hard so to start cheap and you need to develop your plan now we start here for this and it's not just a pretty slide but she stick to

these so you see where you are now now you have to start with the end in mind so that's where you want to be and then once you've got that worthy it with the end in mind you can then set your goals and take the action so for me going back hours offshore life was rubbish I needed a new job and I had to think about what did I enjoy I'm gonna pop the age of take 8 to 10 I've played around on the Amiga PC or meeting 500 and then naturally between the ages of 14 to 16 I was playing a bit of Counter Strike and after that you know it's I think my my

IT skills was well as far as you know Microsoft Office suite and learning how to open up my browser in incognito mode and what happened around this time when I was going through the depression I was at my friend's house and he had his map book open I really map book he had another window and it was running Windows huh I was thinking what the hell is going on here what's he doing I was jet I was straightaway intrigued and he explained to me it was a virtual machine I didn't know what that was December 2015 so I went home and I got on YouTube and then I fell down the rabbit hole of YouTube and I came out some three months

later you know after watching all these videos with an idea of what Kali Linux was and just started get at the started playing around and that's when the penny dropped and I suddenly realized that what happened it starts sparks as an initial interest became a passion and a desire and I realized that I wanted to become pence Esther so I was able to set my goals and for me it was pretty easy I didn't have any idea at all so I started off from the bottom with all the comps here certificates on the A+ I worked up simple as that just chipped away kept chipping away and worked up now what I also have now

still still stick to these I have my professional goals I've got short in the green short term which is zero to two years medium and the yellow two to five and then long so I've just don't have skated that because that's my old personal plans however you know what you what you write something down you become comfortable for it and likewise I do it with my personal goals and this is what I've got for this year I've never run a marathon I've done a half marathon but so I want to run a marathon and that's in preparation for the next goal and that's who I want I'm in the process now of organizing the charity event for a

little girl and I'm going to start at Northampton Saints a run to st. L and it will be close so that's 130 miles roughly and I'm but I want to do that in four days so it's about 32 miles a day and then also I've got next to do a workshop at a security conference and I've got an idea for that as to so start the martial arts class and I've started mentoring someone but I believe a sort of mentor of a few people anyway just help people out so the these three that they're in my facing a reminder that I need to do these so you set your goals and now this is where you need to take

action and that everyone has all the best will in the world but unless you take action you know you're not going to achieve anything now fortunately for me where I was so starting in the pen testing there's loads of free training resources available and cyber e is an awesome training resource at the time I took the screenshot this is exactly what it looks like it's split down beginner intermediate and advanced and it's completely free so you can just watch these videos and if it's something you wish to look into and study then again just chip take away EastEnders 30 minutes and you just watch one of their two of these videos and I just chip away

late you've got YouTube one person I really recommend following on YouTube is guy called Dale lord m/sec and it really breaks his videos and explained them very well and he's got beginner tutorials too you then also got training resources full hob pentester lab and hack the box and they're all free granted pentester lab and hack box do have subscribe services but they are also free but the SUBSCRIBE services together I think for pentester lab my hat the Box 25 quid a month and definitely worthwhile if you that's wait look what that's the director you want to go about 25 pounds a month it's not too bad if you consider it sits around and beers and the next

one I've recently come across is immersive labs now if you're a student that's completely free of charge or if you're ex-military that's also free so immersive labs is awesome and it's not just for pen testing you've got compliance information assurance digital forensics so it's just an excellent platform and I do spend a lot of time for crass donating on immersive loves when I'm supposed to be doing my own Union uni work its split down you know you got here Linux command line you've got common tool sets volatility so your memory analysis Wireshark so there any exercises are progressive so whilst you're learning you start off at their beginners and you can work off and it's

just it's an awesome platform and its really worth checking out and if you want to check it out you can have a free trial on me so that's the that's the URL and I'm assured that this works I did test it this morning I'll admit so that's a valid I believe up until the 9th of June really worth checking out if it doesn't work give me a show and I'll get on swimmin C and find out what's happening but I'm sure it will work okay so another one while she started is always take notes don't trust your memory and when I first started you know a bit older than everyone else when I was oh when I was

starting the first job I was taking notes on a fault I'm on a fault pad and there's no way you can carry them around with you everywhere and I can never recall them them notes ever again so just have a note-taker and keep it and take all your notes you can next we got certification and I'm not trying to run certificates or qualifications down anyone's throat because I'm consciously aware that some of our most talented individuals don't have a certificate to the name however if a certificate is the only thing that between yourself and getting a job of what you want then I'd suggest it's worthwhile investment and that's all I'm going to say about

certificates we've also got networking and just being here today you know meeting new people and networking getting to know people you might not initially get I exactly what you want from here today you if you've come looking for a job it might not happen so don't be disheartened what happened with me is the first cyber conference I went to in April 2016 I went there with no qualifications but I established a relationship with a recruiter who are still keeping in touch with and she said to me you'll get this and come back and I did and sure enough she got me the job so what I initially felt like a bit I went to this conference it was a bit of

a disappointment and I didn't get anything out of it I met someone and that's what that was how I got my foot in the door take advantage out and meeting people here today so in summary excuse me ladies and gents if you have a desire to learn and you want to join us industry then you've got to make a move starts a plan develop your own plan establish your own goals and take action and you finally take responsibility for your own future and don't leave it down to someone else ladies and gentlemen my name is wilkinson thank you for your time [Applause]