Getting Started with Infosec Consulting

do i went and i asked about 100 to 150 other consultants and a lot of my friends our consultant said hey how do you get clients how do you figure out pricing how does consulting work for you so we talk about getting started with consulting this is really the summation of not just my experience but let's say a couple hundred of my friends and acquaintances as well so let's talk about the dream and there's a lot of truth here consultants are rock stars they travel the world pandemic willing our world-class experts do meaningful work have lots of freedom and are extremely highly paid and there's a lot of truth there for sure reality lots of deadlines i have three

deadlines today you don't have a boss you have multiple bosses multiple clients people talk about the feast and famine of consulting you have a lot of work then you don't have any then you have a lot and so forth it's not all exciting work i don't love writing reports i don't love writing proposals i don't mind i do it um i travel a lot now a large extent because i choose to when i do but you know my last flight and i've only had a few since the pandemic started i came so close to being stranded both going because of a hurricane between me and virginia beach and i almost got stranded coming back in dc

and dc's fine but dulles airport is is dull so let's just start from the beginning what's a consultant because people confuse this first of all we all know what an employee is right you have a job you work for one organization hopefully you love it i'm not anti-job i loved my first job absolutely contractor is not the same as consultant most contractors work for one employer and they might have different remuneration or financial terms but you're paid for your time so friend of mine had a job for well over a decade he was laid off he came back literally the next day as a contractor same desk same co-workers same work he's not a consultant you may use that

term if you'd like he's a contractor consultant typically with a consultant you have multiple clients so this year alone i think i've worked for five different clients if i go and i list them out in my mind one hasn't paid me yet but that's happening you have a lot more control you can say no i turned down something just last week it wasn't the right thing for me and ideally you're paid for results right you're not paid for your time ideally you're paid for results now usually there's some kind of mix here now granted there is some overlap between these three there's employees that consult on the side consultants sometimes take contracts and so forth

but they are different we talk about consulting models we're going to talk about being a full-time independent consulting as well as a little bit about consulting on the side for sure because the same things apply now i remember when i started consulting there was a recession going on and people tried to talk me out of consulting and there are all these people that have been laid off they're unemployed walking around saying i'm a consultant hey if you've never had a client you really are looking for a job you're not a consultant right you're unemployed if you want to say consult that sounds better that's perfectly cool you could be a consultant working for a consulting firm consulting firm or

consulting company number my friends do that number my friends love doing that we are not talking about that okay similar skill set in many ways but you're an employee you could be an employee or contractor who consults on the side and that's real popular often that's a lot more popular and common than people think often people say well you know my my job won't let me that that may or may not be true okay and i have a lot of friends that have become consultants that then take a full-time job and then maybe bounce back to consulting or contracting that bounce around and sometimes people have the mindset oh that's a failed consultant they took a

full-time job but i have a number of friends some pretty impressive you'd know their names who have bounced between consultant and full-time employee or contractor they don't really care what title they have they're just looking for exciting interesting hopefully well-paying meaningful work so consulting is a business and it's a great business for a lot of reasons i'm not going to go through all of these bullets but like low full startup costs right i just worked out of my house when i began i bought a laptop probably 90 profit in general degrees i wish i had finished my doctorate that was dr demopolis right but i haven't i have a bunch of certifications they really don't matter

when you have a lot of experience when you have less experience degrees and certifications matter more in terms of licensing there's generally no licensing required one big exception for some of us in some jurisdictions like i think the state of texas and michigan to do digital forensics work you need to be a licensed professional a private investigator a pi a friend of mine did that it was not that hard i had to sign something for him saying i promise he is a good person of good moral character and so forth but generally you don't need that and although not all consultants consider themselves entrepreneurs it's a relatively easy way to start now the one thing that shocked me the

most when i started consulting i didn't realize i was going to be running a business i was like no no it's like i'm like a geek i like this technology stuff and if i become a consultant i'll be able to do exactly what i want i'll have more freedom more choice over projects that i pick and hopefully make good money as well and i did but i didn't realize i was running a business you have to have or acquire some business skills now not everyone likes this personally i like hacking the business stuff as much as i like hacking technology but this was kind of a surprise for me that i'm running a business now i have

to figure out how like the invoice clients and and define clients and so forth and we are going to talk a lot about finding clients in a little bit so since you're running business you have to start the business now when i started i just said i am demopolis associates because it sounded like i should have associates and be bigger now in fact it's like it's me i have a support staff part-time support staff i do bring friends and colleagues into projects but i didn't file any paperwork or did anything and this is really common eventually after two years the bank hassled me took two years they said your check says demopolis associates you're ted demopolis

and they're they're kind of a pain in the butt so i said okay what do i need to do and they told me and i said you know i think i'm gonna walk to that bank down the street i walked down to another bank and said hey will you take this check and they said sure but you're really supposed to fill out a form called a doing business as because i'm not demopolis associates i'm ted demopolis or formerly theodore james demopolis in new hampshire it was 50 bucks right 50 bucks it was a form it was trivial now in some jurisdictions and this isn't legal advice for example in luxembourg my friend david cecilia when he started consulting

this is his quote the administrative part can take up to two months with all the papers unofficially speaking because this is not legal advice a lot of consultants just start and then deal with the paperwork and so forth later this may or may not be legal depending on your jurisdiction in north korea they'd probably execute you in luxembourg yeah probably no one would care but i'm guessing now i started as a sole proprietorship that means i am my own business now you could be a sole proprietorship and use another name i was joking that i was going to use the name wingnut technologies but friends talked me out of it so i went with demopolis associates

you'd be doing business as another name and still be a sole proprietorship that means you are your company and your company is you that's simple simple is really good i love simple the shortcoming with a sole proprietorship the biggest one is if your company gets in any trouble gets sued has any liability owes any debts and so forth well any problems your company has are your problems because you are your company you could create a corporation now the biggest reason to create a corporation is it's a separate legal entity if the corporation has problems like they get sued or they owe money or somebody slips and hurts themselves while they're doing while they're visiting you it's not your

problem it's the corporation's problem now there's something called an llc a limited liability corporation this isn't a corporation legally this is a u.s entity by the way an llc but it has that limited liability just like a corporation technically it's not a corporation other countries have things like an llc for example in germany in switzerland they have a gmbh which something i can't pronounce in german so wikipedia defines a corporation as a company or group of people authorized to act as a single entity they're legally a person and there's different kinds depending on the jurisdiction a c corporation is a full corporation in the us s corporation is sort of like a corporation light the biggest advantage again

limited liability there may or may not be tax advantages you can have multiple owners right sole proprietorship obviously can't because you are your own business you can't sell part of yourself and there may be you know you can issue shot stock and do other things now what you pick isn't critically important because you can always change right you can start as a sole proprietorship and incorporate that's simple to do or start as a sole proprietorship and then become an llc later now a partnership may or may not be a legal entity there's a lot of advantages in a partnership different partners bring different things to the table different skills different contacts that may be one of the biggest because

people you've done business with before are your most likely source of clients certainly initially now i've been down this line before there's enormous potential for arguments for disputes on on everything things you'd never think about even if you're in a partnership with someone that you've been friends since you've been in diapers with and known since then trust me i know that both things in writing hopefully a legal document but if not an email is better than nothing right you just document as best as you can and i like to document what you've agreed on and what you have not yet agreed upon which which is you're not going to agree on everything that's okay now my personal preference is partnering

on specific projects and initiatives and so forth but partnerships full partnerships are absolutely great now a few other things you're going to need you'll need some sort of digital presence right you don't need a website you're not going to get clients because of your website it's to give you credibility good friend of mine rick berkovitz has been a consultant working primarily in the technology space a lot with security although he's more of a chief operating officer type he's for like at least 20 years he doesn't have a website he uses linkedin as his online presence you don't need office space uh i don't have separate office space actually i do downstairs i generally work i have a separate office in my

apartment i generally work at the kitchen table because it works for me when i little kids i rented a dedicated office just so i could get stuff done for uh for about 10 years business cards letters envelopes pretty much obsolete many ways some clients may care i like business cards that's up to you insurance can be a big deal in the us health insurance is a big deal some clients will require liability insurance usually that's pretty inexpensive now consulting is a growing field now this is going to sound like a joke i could just change the slides in the last year but the past few years because i've been traveling much as a during the pandemic i've literally met

all these types of consultants now i have no idea what a water consultant does but an infosec consultant a lesbian dating consultant and a woman that speaks with the dead professionally walk into a bar right sounds like the beginning of a stupid joke this actually happened i've met consultants that do all kinds of things now i can't tell you that being a raw food consultant or a cosmetic packaging consultant is a growth field i can tell you consulting in general is definitely growing you can look up metrics easily and infosec consulting is very much a growth area now we tend to think that experts the specialists are more experts than other people so you know who's more of

an expert a brain surgeon or a doctor that does general practice you tend to think the brain surgeon or the orthopedic surgeon that specializes in replacing hips like my father did we tend to think specialists are smarter than generalists now that's not always true i called my doctor yesterday he's in general practice he's he's a brilliant guy and i literally know a brain surgeon he's much smarter than the brain surgeon however you do need to specialize now when i started just saying you're an infosec was totally a real specialization it isn't now you could specialize in verticals so later today i'm hopefully sitting in a talk by a friend of mine who specializes in security for small

business it's it's what he's into it's what he loves doing i know another consultant in infosec my friend doc blackburn he does a lot in health care right he does a lot in health care or it could be my specialty i am a pen tester or i'm this kind of a pen tester or i do strategic security planning i do a fair amount of that i have some friends that they specialize they do cell phone forensics one of them does only iphone forensics or you could specialize in both now what you specialize in doesn't need to limit you but i have clients that have hired me for one thing and that dragged me into other projects

often happily i once got hired somewhere to assess how good the knowledge of their customer facing security people were the big networking company you know them and uh they ended up dragging me into corporate restructuring for fortune 500 can be like well i don't know anything about this it's like that's why we want you to help you don't have any preconceptions and you're a smart person so you need to specialize in something right but you may end up doing things all over the place and commonly will now the second most common question that i get is on pricing the first is on getting clients so let's talk about pricing man we could talk about pricing for like

hours probably there's entire classes like you know graduate level classes on pricing people have their phds and arcane areas of pricing theory and so forth but guess what pricing is so easy for consultants it really is most of it is real easy so there's a concept of market-based pricing so my daughter's actually texting me as i'm here and i'm assuming she's reminding me she wants me to buy her some blueberries okay what do blueberries cost well what's the market price i can tell you i think they're in season now i think they're finishing the harvest in maine think they're in seasons or prices are a little low what do they cost well it'll be a range from low to high if i buy it

at market basket one of my favorite supermarket it's going to be relatively low if i go buy organic at whole foods and a new one opened up here it's going to be more expensive but it'll be a range right we might say so what's a plumber in des moines cost you can google this okay these are the rough hourly rates and you know if a plumber has less experience or maybe less of a less of a good reputation they'll charge closer to the bottom of that range if they have a better reputation maybe a lot of experience he'll judge closer to the high end what if somebody charges way lower i knew a plumber unfortunately he's passed away

he was charging 25 bucks an hour in scarborough it's like 25 bucks an hour like plumbers in scarborough charge more what's wrong there was something wrong with him he was a very good plumber when he was sober when he was sober uh someone that knows him well said they had seen him sober twice in their life so yeah you might say i'll charge less so i can get started and that may or may not work but if someone charges way less things like why are they charging less you know is there something wrong with them and so forth now you can also have fixed rates right fixed rates based on projects now fixed rates can be great it can be scary when

you have a fixed rate because what if it takes you longer or more resources right you can lose money on fixed rate bidding uh fixed rate projects you can also do real well generally for fixed rate i will figure out the hourly what how many hours i think it's going to take in any other resources and i will literally double the cost you know why two reasons two big reasons first don't projects normally take longer than you think they're going to like yeah almost always and secondly you're taking on more risk right by having a fixed rate so you deserve more potential reward well this is for plumbers okay and this is a daily or hourly rate

there's other ways you mentioned project based you can also have retainers retainers are paid in advance for work uh there's other considerations geography for example i know incident handlers in the uk get paid less than they do in the us why i don't know but i know they get paid less there also clients fixed rates uh of my 30 i think it's 31 years now of consulting most years i've had at least one major client that paid a fixed rate this is what we pay this makes it simple now fixed rates are usually fair or you don't take them when i first started consulting in 1990 i had a client they paid two different fixed rates for things that i did

the thing i did the most often they paid 1200 a day okay it was like 1990 i was a lot younger i didn't have a mortgage i didn't have kids like 1200 to do something i thought was fun take it or leave it was like take it you know they're often very fair now let's translate this to infosec okay you cannot easily google prices for like an iphone app pen testing consultant not as easily as let's say performers in des moines or roofers in seattle or something like that you may be able to find some information if you look online and talk to some people do some osint but it's not as easy let's say plumbers or trades people

here's a model i came up with this there's no magic here take your current job salary and by by the way job salaries are easy to look up online let's just pick round numbers say you're making a hundred thousand dollars a year or 100 000 euros and you work 2 000 hours a year right i know most of us a lot of us work a lot more than that so that's about 2 000 hours by 50 weeks at 40 hours in europe people say oh that's too much work in the u.s we're probably saying oh i work more than that and then just figure out just divide that's 50 bucks an hour you have to at

least double that at least why you don't have benefits healthcare in the u.s paid vacation they're not going to be sending you to conferences you know they're not going to be buying you computers now some people would say you should at least triple that right so at least double just judge at least 100 an hour or 800 a day bare minimum you're not going to be working 2 000 hours a week by the way or 2 000 hours a year yeah i've done it some years but it's not common it's just just to get like an idea of where you should be it is absolute minimum now can you charge more than market-based pricing right the formula i showed you is to get

an idea of market-based pricing yeah you can now of course it's not just about money and quite bluntly i have never focused on maximizing income money matters it matters a lot it matters maybe more to me than you i'm gonna have three kids in college next year plus i have expensive tastes i can sit on the beach and do nothing and spend no money and be happy or i can like travel in europe and drink expensive champagne and have a lot of fun too i have big expenses you know so money matters one if you're considered an absolute rock star in the field so let's say i needed a chief uh information security offers officer c

well i know a couple of great csos pierre noel old friend of mine he was cso for microsoft asia pacific cesar for huawei the entire company that telecommunications giant which is massive everywhere worldwide except for the us and australia or how about dr eric cole right he's phenomenal cso if i wanted to hire either of them okay as a seesaw whether it's as a virtual cesar or full-time or part-time or whatever term you want to use they don't care what market-based pricing they don't care what the market rate is first of all i need to excite them as they say dude you should come do this this is going to be a lot of fun we're

doing some great stuff and i need to pay them what they ask right they don't care what joe blow the most excellent middle-of-the-range csos charging he may be great but it's like and you got the experience you know you've got the name and so forth another reason you may be able to charge more than marketplace pricing in every field there are some people that want a premium experience or product i don't care whether it's infosec or baking cakes or yoga or anything like that so a little before the pandemic a friend of mine much younger friend of mine went to see some some hip-hop concert uh i like some hip-hop i didn't think this person was particularly talented or

amusing and the ticket i can't remember what the ticket was it was like they could get a ticket for it was like under 80 bucks right to go see it you could also pay for a better ticket you get a better seat they also had a package that was like it was over a thousand dollars where they picked you up in a limo they drove you you get to go backstage just for a little bit of time you didn't get to meet the band or anything now in either case you got to go see the concert right some people want that premium experience and it might not even really be that significantly better so let's make this

concrete i have a friend named cara cara decorates cakes okay she's into cake decorating it's her passion and she teaches people how to decorate cakes like okay decorating cakes like they're people that do that professionally and you know there's some awesome bakeries and bakers and she doesn't work with them she works with primarily women as she put it her her marketplace primarily housewives primarily women at home they may or may not have a job they're they're around her age they're just decorating cakes because they like it they they love doing it she has a few men but very few okay she decided she was going to hold an event at her house you can come hang out with her for the

weekend and decorate cakes not just you you and like i think she had 10 people or something like that or she capped it at 10. she charged 12 000 to come hang out with her at her house and decorate cakes for a weekend right crazy right guess what she sold out some people always want that premium experience or product third reason the results are critical right even a slight perceived improvement is worth a lot you can keep the ceo out of jail the ceo doesn't care what you charge maybe you're just a little bit better than someone else they'll pay a lot more or maybe you can save a life i had a health scare not too long ago

right turned up wasn't anything significant uh i didn't care what the doctor charged you know i didn't care if insurance covered it it was like if this might save my life i don't care i want the best now i don't like writing proposals i think i already mentioned this before as a consultant you have a lot of freedom um sometimes a proposal is necessary okay a formal or informal proposal if i write a proposal i don't care if it's formal or informal i want it to be a formality okay i'm not gonna answer a request for proposals on rfp unless they really want me to i need to be invited like we really want you to do

this and i still might not generally i want to already have an agreement with the person to do the work with like we've already come to it was a conceptual agreement yeah this is what they want done i can do this we're going to do it this way we talk back and forth we've got a conceptual agreement and i i simply document it if we don't have a conceptual agreement i've just talked to somebody about doing something like send me a proposal i find they're usually just trying to get rid of you it's like okay yeah send me a proposal maybe i'll look at it maybe i'll think about it the ideal proposal is just a formality you've

already got conceptual agreement doesn't mean you're necessarily going to get the work but you've got a very good chance if it's not a formality and even usually when it is you want multiple options right multiple chances for the person to say yes what if a proposal just says this is what i propose well it's yes no or ignore which is no i like three choices the medium choice this is what we talked about this is what i think we should do this is what makes sense a low option saying this is the minimum i think you should do you know whether i do it for you or not i really just do at least this

and then a high one a in a perfect world this is what we should do this would be awesome this would be great in a perfect world but we're not a perfect world and you know we have limited resources but in a perfect world now they usually go for the medium high maybe two percent of the time uh do not put anything any high level in a proposal unless you can actually deliver it because it gets chosen sometimes a few years back i spent seven weeks in abu dhabi abu dhabi's nice enough place it's very pretty i was on the beach you know which is of limited use when you're working but uh it's because somebody had

a high proposal had a high level in a proposal and i was part of it and i didn't want to spend seven weeks in abu dhabi right so make sure you can deliver it it was well paid it was great work i'm not complaining but it's basic psychology right multiple chances to say yes now there's going to be a price right like what you're charging we talked about pricing now this is going to sound a little odd first of all i will i will help people for free i will talk to essentially anybody right at some point i'll tell it's like hey look you know i consult as a living we're crossing the line to like paid

services glad to talk to you for half an hour or whatever but we're crossing the line to paid consulting let's talk about how we can work together sometimes there's no negotiations that are necessary in price and by the way often the word negotiate is not used at all at all but the basic rule is you don't negotiate on price you're not selling used cars right you're not selling used camels you're not selling really you're a professional you negotiate on value if they're like i like that middle level in your proposal but it's a little too expensive you know you want a hundred thousand we have 85 000 in the budget well you might say okay

well for eighty five thousand dollars this is what i can do right you remove some of the deliverables say okay maybe the final report you will write the final report for the project and i will review it or will leave this part out if you concede on price they have to concede on something too right if you're fighting on price something's wrong right you're like acting like walmart and uh you know walmart competes on price and they're very good at that you don't want to compete in price you want to compete on value you want to be a great deal you definitely want to be a great deal you don't want to be cheap though now

that said every year i'll i might do one or two things for free i've done some work for like for free for charities and good causes and so forth we're like you can't pay me okay i'll do it just to help out i've done this with some really good clients as well that have paid me well and there's like a project usually a small thing that means a lot to the buyer who's usually become a friend and they'll be you know this is all we have in the budget it's like that's not enough money i can't just i'll just do it for you it's like i'll do it to help up and they usually need to pay you anyway

now a lot of clients a lot of consultants start with a bang and then after a few years their contacts dry up this is really common they start very successfully because you've already got work lined up and so forth then it just kind of fades away you need to keep a steady stream of potential work coming in we talk about having potential new or re-engaged clients in the pipeline that's the term that's used if you do that right you're not you're hopefully going to avoid this feast and famine cycle where like you got lots of great paying work you can't imagine ever not being busy life is good maybe you don't sleep enough you don't take enough

time but you're doing exciting stuff it's awesome then you finish the work you haven't been doing anything to acquire any new work or to be visible to others and all of a sudden you have a slow period you can't remember back when you were busy well you need a steady stream of clients so let's talk about ways to get clients okay lots of different ways now the most common people to hire you most likely people to hire you are quite literally people you've worked with before there is risk in someone hiring you whether it's full-time or as a consultant or there's risk there's less risk if they've worked with you before so you've worked with others before

right it's so easy to find people these days like on linkedin and so other social media and online it was harder when i started so who have you worked with like where are they now just contact them tell them you're gonna start consulting even if you're not sure just reach out say hey how you doing great touch bases let's let you know or talk for a few minutes or what's up or something like that my first client was a company a industry consortium called the open software foundation and literally people i worked with hewlett-packard had gone to work there so people i had been working with like a few months before you know if i take a look

at my first three clients my second client was motorola and i had worked with them before as part of my first job right i had worked for them and they needed some consulting they needed some help they knew i was consulting they knew how to contact me because i touched bases with them they hired me my third client was actually julie packard my previous employee this one shocked me they reached out to me and trust me i was not the ideal employee at all i wasn't bad i was a pretty good employee i just didn't fit the mold it wasn't the right place for me to be forever so people you've worked with before they're your biggest source of clients

at least initially and also in the longer term and people move from company to company which is awesome secondly referral trusted party referring another trusted party a friend in producing a friend right you ask for referrals uh in most of my big clients i've had internal referrals yeah i've asked hey if there's anywhere else here anyone else i can help here let me know or if there's anywhere else i can provide value or introduce me to people and so forth and i usually do this when i'm most of the way through a project and it's not done yet but it's looking good you can also ask for referrals people you've worked with before you're not

working for now it's like i'm starting to consult hey this is what i'm doing what's up with you you know if there's anyone i can help let me know introduce us your local community right your accountant your doctor your attorney now in your local community i don't suggest going out of your way to do this but just when you normally see your doctor say hey doc you know what i do you know i'm an information security consultant or i do cyber security or whatever term you think is going to resonate with them if there's anyone you know that i can help let them know now i'm probably talking to my attorney in the next probably two

three weeks i'll remind them that you know i do some expert witness work in in you know in security if anyone i can help you know and introduce me it probably won't work for them directly because they do family law and i'm not getting involved in family law and cyber security most likely third now this is an easy one this one takes longer though volunteering there are so many organizations out there that are looking for volunteers right beside charlotte was probably looking for volunteers not too long ago might still be i know i just saw something from brucon uh in belgium actually they're they're in belgium that's great conference they were looking for volunteers actually

tweeting this out as a volunteer even if you have very little experience you're going to meet and interact with some pretty senior people right you're interacting with them as peers you now work for them even though you're working as a volunteer right they qualify as people you've worked with and they're more likely to hire you now right i suggest volunteering for more than a year right also saying i've worked with you know beside charlotte or defcon or brewcon or adds a lot of credibility now admittedly i've done less of this than i could part because of my busy travel schedule and i still have three teenagers it's easier than when they were smaller but for example there's an infosec group

in maine and it doesn't make sense for me to volunteer to be some sort of an officer or something like that because because i travel traditionally you can't make a lot of the meetings but when they had a cissp study group i said well what can i do to help it's like i could do a two or three hour session on crypto for people taking the cissp exam i can do that there's other organizations other conferences like i can help you with marketing for this you know i know a little bit i can help get the word out and so forth now you can also volunteer for good causes hopefully ones you believe with you

believe in uh this can work really well now it turns out in a lot of organizations in most businesses high-level people including executives are encouraged to volunteer and if you volunteer you're working with them as peers and they may not be able to hire you or in a position but if the boss's boss says oh we need some help with this go talk to ted man that that's that's a referral with enormous weight and i have had the boss's boss refer me to someone it's like there was no question on could i do it or what was i going to charge it was like can you do you have time can you help us uh i've done some volunteering here i've

done some with special olympics for swimming in new hampshire i didn't do this because i was expecting to find any work right but i've done a little bit of this i will probably be doing more of this as my children are older and so forth speaking so i heard something interesting uh i was in a webinar recently and apparently the biggest fear that people have according to many surveys is public speaking yeah an enormous fear trust me i'm not a natural speaker i was so afraid of speaking but we can all speak we all have experiences and knowledge to share right and if you're a speaker you're considered to be an expert just the fact that you're speaking

even if you're not very good you might have good information you have high visibility i absolutely get work through my speaking uh now that's one of the reasons i speak i speak because i enjoy it i like doing this now notice we're saying consultants are experts so let's talk just a second on this expert idea expert we're all experts i know i used to shy away from that term i'm not an expert expert doesn't mean number one expert in the world expert doesn't mean there's nothing else for you to learn experts are relative term expert just means you have valuable information that can help others and sometimes the biggest expert the one with the most expertise

is not the best one to help an organization one that's closer to where they are that's a few levels above them in knowledge can be more helpful sometimes so you you are an expert right and speaking helps you give you that expert status like if you're speaking it's it's impressive right and you get high visibility i remember i gave a talk once on application security application programming and security for microsoft it was a microsoft conference in waltham massachusetts i was the last speaker on a sunday i had four people what was the three people i remember one of them was snoring really loudly in front i had three active people now those three people really wanted to

hear what i had to say and uh it was like after it's like it's like remember telling a friend of mine who's in public relations high tech pr it's like man it's like in this talk it's like those people were there i think i helped them out but there's like almost nobody there and one guy was snoring he's like it doesn't matter you spoke at microsoft tell everyone that's impressive even if people don't hear you speak even i didn't like that you speak they don't like what you have to say you have different opinions or whatever the fact that you're speaking is impressive helps get clients writing now i said i was not a natural speaker

let's talk about writing uh i always hated writing english is not my first language okay for starters my only fluent language i hated writing in school i was a math major you know why no papers no labs to write up i find i like to write if nobody forces me to i become a decent writer right writing's a learned skill you can learn to write reasonably i'm gonna hopefully finish my fourth book really soon uh i have a slide coming up that's saying it is at the uh at the editors and it better because i think i'm finishing it today and getting into the editor over the weekend you can learn to write just like you can

learn to speak it doesn't have to be a book they can be articles and so forth there are so many things you can write they position you as an expert they give you visibility i've definitely gotten a lot of clients through writing friend of mine ken hartman wrote a paper on bitcoin excuse me on bitcoin on bittorrent and the legal aspects of bittorrent now he he's not a lawyer he had to do a lot of research he put a lot of time into that paper oh man he's tracked a lot of work to that paper a lot of expert witness and other work to this one paper that he wrote that one online now there are so many techniques you can use

those are the big ones okay what techniques gonna work for you first of all i don't know what's gonna work for you you don't either so you try different things i have two friends that speak at the rsa conference every year they speak at rsa okay i've never spoken at rsa maybe i will next year who knows one of them gets new work every time he speaks at rsa he gets another client to every single time the other one he doesn't get any work he gets visibility he gets bragging rights maybe it helps him in the long term it almost certainly does i do some teaching for the sands institute i've been teaching for them

off and on for about 18 years i don't get many clients from that i have a couple of friends i was talking to yesterday who also teach for sales they get most of their work through getting to sans i have friends that write and don't get any work through that i definitely get work through my writing you know now there's lots of things you can do to try to get work right um i don't know what's going to work for you so you try different things and see what works also something that works for you today may not work in the future friend of mine he's actually uh in infosec law he is a lawyer but he works in information

security that's what he does he used to get a lot of work through writing and then should kind of stop working it stopped working and so he's doing other things now he's actually blogging online to do that now he's getting a lot of work from speaking now you might need some outside professional help and i don't mean like you know by i don't mean professional psychological help you may need that lawyers possibly expensive um usually worth it what i do with lawyers now i do pay attorneys for sure i have no problem doing that uh i have a few friends who are lawyers i sometimes help them out with security issues they sometimes help me out by

looking at contracts and so forth so i barter my last book contract i got my cousin who's a very well respected lawyer it's not my cousin vinnie to review the book contract and i gave her a couple bottles of champagne it was good champagne probably would have been cheaper to hire a lawyer but i don't use bookkeeper you probably most most consultants who might cost a thousand dollars a year maybe maybe less i use an accountant for taxes i don't do my own taxes uh web and more designers i have a group of women in zimbabwe quite literally that i use for web design for simple technical stuff for administrative things and so forth most of us don't have design

skills most of us shouldn't spend time on things we can get someone else to do for 10 bucks an hour or something like that and the women in zimbabwe are great and they're extremely well paid by local by local standards and i probably should use them an awful lot more because i have them on retainer i use them off and on they're always like you have more for me to do and i'm like yeah no no not right now but it's worth having you there for when i need you now i don't like the concept of sales just the word sales scares me i think of you know someone trying to sell me a used

card that said i believe sales is an honorable profession especially when done well it's all about marketing it's related to sales sometimes people combine them together the purpose of marketing is to make basically sales superfluous so you have to talk people into buying things marketing in our case is making yourself visible in a positive way what by doing good stuff by giving talks at conferences by writing by volunteering by helping people right i'm doing videos on youtube i've sort of had a little hiatus but i'm starting them like this weekend i've actually got a couple to actually that actually to edit this weekend right i have one client one client excuse me one not one friend he was a consultant

he's now retired we worked together in hong kong you know how he got all his clients by having lunch with people that was his marketing at least once or twice a week he'd take off he'd say hey i'm gonna go have lunch with somebody and you always invite me along i didn't go usually it was someone usually he had worked with before or he had met somewhere professionally he got all his clients through lunch his marketing was lunch right and it worked and it worked really well so you're always going to be doing something to make yourself visible in a positive way you always could be learning now it doesn't matter if you're a consultant or

not but especially as a consultant rate of change has sped up a lot with a pandemic it certainly has there's a lot of free inexpensive education there's some really expensive and very well worth it education besides charlotte is awesome b-sides in general is awesome uh i've taken from coursera coursera has free courses and all kinds of things i've taken two crypto courses from stanford i took a blockchain class from princeton and they're free right mit open coursework all other stuff cyber has some inexpensive there's phenomenal free stuff on youtube it's amazing also don't be afraid to pay money to invest in yourself also just reading right playing with things having a home lab and so forth just gives incredible

things learning is investing in yourself right i invest both time and money so since the pandemic started it's like 17 18 months i've literally i'd have to add this up but i know it's been at least 10 classes that have taken took one class on procrastination or avoiding procrastination i took one class on risk management in security i took one class on security operations center i took a bartending class right anything that helps you learn i took that one with my son so is consulting for you i don't know i'm so happy i started consulting you know why not because i've been successful and i've done it for 30 something years and honestly it's one of the

biggest positive transformative things i've done in my life that's not why not because it worked out because i had to try it i would hate to say it's like oh you know i really wish i had tried consulting if i tried consulting and i it didn't work out maybe i couldn't get clients or maybe i just didn't like consulting or for whatever reason it didn't work out i'd be happy i tried it it's like i ran a marathon once like okay i did that i may never run one again but i did it and i'm glad i tried it right you could also start slowly you don't have to quit your job you can start consulting on the side

right and that's often very very possible that could itself could be an entire talk it is so just real quickly some resources i've got some consulting in more videos on my infosec rockstar channel on youtube i've got more to go i don't get 30 or 40. i've got to sign up successful infosec consulting it needs work but i've concentrated on getting clients right how to get clients my upcoming book it's a lie it says it's at the editor now but it will be by the time you see me it should be within you know 24 or 48 hours i'm going to try to price the book really inexpensively too i ran a conference last year i'm going

to do another one on consulting and entrepreneurial activities in infosec right free is the plan right free to attend maybe a small amount of money if you want recordings that frame my costs or something i'm not sure i'm looking for sponsors if i'm in twitter at ted demock.com i'm on linkedin feel free to join with me there's my email you can even call me on the phone if you want if i can help in any way anyway i'm just gonna finish by saying i'm so glad i started consulting if you're thinking about it you should look at you should try it it may or may not be for you i seem to think everyone should be a consultant

obviously that's not true but if i was suddenly 70 years old or 80 years old i never tried consulting i wish i had i didn't want to be there i tried it it worked for me it would have been a success even if i decided not to be a consultant long time thank you everybody thanks for being here